1 /* 2 * linux/ipc/namespace.c 3 * Copyright (C) 2006 Pavel Emelyanov <xemul@openvz.org> OpenVZ, SWsoft Inc. 4 */ 5 6 #include <linux/ipc.h> 7 #include <linux/msg.h> 8 #include <linux/ipc_namespace.h> 9 #include <linux/rcupdate.h> 10 #include <linux/nsproxy.h> 11 #include <linux/slab.h> 12 #include <linux/cred.h> 13 #include <linux/fs.h> 14 #include <linux/mount.h> 15 #include <linux/user_namespace.h> 16 #include <linux/proc_ns.h> 17 #include <linux/sched/task.h> 18 19 #include "util.h" 20 21 static struct ucounts *inc_ipc_namespaces(struct user_namespace *ns) 22 { 23 return inc_ucount(ns, current_euid(), UCOUNT_IPC_NAMESPACES); 24 } 25 26 static void dec_ipc_namespaces(struct ucounts *ucounts) 27 { 28 dec_ucount(ucounts, UCOUNT_IPC_NAMESPACES); 29 } 30 31 static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns, 32 struct ipc_namespace *old_ns) 33 { 34 struct ipc_namespace *ns; 35 struct ucounts *ucounts; 36 int err; 37 38 err = -ENOSPC; 39 ucounts = inc_ipc_namespaces(user_ns); 40 if (!ucounts) 41 goto fail; 42 43 err = -ENOMEM; 44 ns = kmalloc(sizeof(struct ipc_namespace), GFP_KERNEL); 45 if (ns == NULL) 46 goto fail_dec; 47 48 err = ns_alloc_inum(&ns->ns); 49 if (err) 50 goto fail_free; 51 ns->ns.ops = &ipcns_operations; 52 53 refcount_set(&ns->count, 1); 54 ns->user_ns = get_user_ns(user_ns); 55 ns->ucounts = ucounts; 56 57 err = sem_init_ns(ns); 58 if (err) 59 goto fail_put; 60 err = msg_init_ns(ns); 61 if (err) 62 goto fail_destroy_sem; 63 err = shm_init_ns(ns); 64 if (err) 65 goto fail_destroy_msg; 66 67 err = mq_init_ns(ns); 68 if (err) 69 goto fail_destroy_shm; 70 71 return ns; 72 73 fail_destroy_shm: 74 shm_exit_ns(ns); 75 fail_destroy_msg: 76 msg_exit_ns(ns); 77 fail_destroy_sem: 78 sem_exit_ns(ns); 79 fail_put: 80 put_user_ns(ns->user_ns); 81 ns_free_inum(&ns->ns); 82 fail_free: 83 kfree(ns); 84 fail_dec: 85 dec_ipc_namespaces(ucounts); 86 fail: 87 return ERR_PTR(err); 88 } 89 90 struct ipc_namespace *copy_ipcs(unsigned long flags, 91 struct user_namespace *user_ns, struct ipc_namespace *ns) 92 { 93 if (!(flags & CLONE_NEWIPC)) 94 return get_ipc_ns(ns); 95 return create_ipc_ns(user_ns, ns); 96 } 97 98 /* 99 * free_ipcs - free all ipcs of one type 100 * @ns: the namespace to remove the ipcs from 101 * @ids: the table of ipcs to free 102 * @free: the function called to free each individual ipc 103 * 104 * Called for each kind of ipc when an ipc_namespace exits. 105 */ 106 void free_ipcs(struct ipc_namespace *ns, struct ipc_ids *ids, 107 void (*free)(struct ipc_namespace *, struct kern_ipc_perm *)) 108 { 109 struct kern_ipc_perm *perm; 110 int next_id; 111 int total, in_use; 112 113 down_write(&ids->rwsem); 114 115 in_use = ids->in_use; 116 117 for (total = 0, next_id = 0; total < in_use; next_id++) { 118 perm = idr_find(&ids->ipcs_idr, next_id); 119 if (perm == NULL) 120 continue; 121 rcu_read_lock(); 122 ipc_lock_object(perm); 123 free(ns, perm); 124 total++; 125 } 126 up_write(&ids->rwsem); 127 } 128 129 static void free_ipc_ns(struct ipc_namespace *ns) 130 { 131 sem_exit_ns(ns); 132 msg_exit_ns(ns); 133 shm_exit_ns(ns); 134 135 dec_ipc_namespaces(ns->ucounts); 136 put_user_ns(ns->user_ns); 137 ns_free_inum(&ns->ns); 138 kfree(ns); 139 } 140 141 /* 142 * put_ipc_ns - drop a reference to an ipc namespace. 143 * @ns: the namespace to put 144 * 145 * If this is the last task in the namespace exiting, and 146 * it is dropping the refcount to 0, then it can race with 147 * a task in another ipc namespace but in a mounts namespace 148 * which has this ipcns's mqueuefs mounted, doing some action 149 * with one of the mqueuefs files. That can raise the refcount. 150 * So dropping the refcount, and raising the refcount when 151 * accessing it through the VFS, are protected with mq_lock. 152 * 153 * (Clearly, a task raising the refcount on its own ipc_ns 154 * needn't take mq_lock since it can't race with the last task 155 * in the ipcns exiting). 156 */ 157 void put_ipc_ns(struct ipc_namespace *ns) 158 { 159 if (refcount_dec_and_lock(&ns->count, &mq_lock)) { 160 mq_clear_sbinfo(ns); 161 spin_unlock(&mq_lock); 162 mq_put_mnt(ns); 163 free_ipc_ns(ns); 164 } 165 } 166 167 static inline struct ipc_namespace *to_ipc_ns(struct ns_common *ns) 168 { 169 return container_of(ns, struct ipc_namespace, ns); 170 } 171 172 static struct ns_common *ipcns_get(struct task_struct *task) 173 { 174 struct ipc_namespace *ns = NULL; 175 struct nsproxy *nsproxy; 176 177 task_lock(task); 178 nsproxy = task->nsproxy; 179 if (nsproxy) 180 ns = get_ipc_ns(nsproxy->ipc_ns); 181 task_unlock(task); 182 183 return ns ? &ns->ns : NULL; 184 } 185 186 static void ipcns_put(struct ns_common *ns) 187 { 188 return put_ipc_ns(to_ipc_ns(ns)); 189 } 190 191 static int ipcns_install(struct nsproxy *nsproxy, struct ns_common *new) 192 { 193 struct ipc_namespace *ns = to_ipc_ns(new); 194 if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) || 195 !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) 196 return -EPERM; 197 198 /* Ditch state from the old ipc namespace */ 199 exit_sem(current); 200 put_ipc_ns(nsproxy->ipc_ns); 201 nsproxy->ipc_ns = get_ipc_ns(ns); 202 return 0; 203 } 204 205 static struct user_namespace *ipcns_owner(struct ns_common *ns) 206 { 207 return to_ipc_ns(ns)->user_ns; 208 } 209 210 const struct proc_ns_operations ipcns_operations = { 211 .name = "ipc", 212 .type = CLONE_NEWIPC, 213 .get = ipcns_get, 214 .put = ipcns_put, 215 .install = ipcns_install, 216 .owner = ipcns_owner, 217 }; 218