1 /* 2 * Copyright (C) 2006 IBM Corporation 3 * 4 * Author: Serge Hallyn <serue@us.ibm.com> 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License as 8 * published by the Free Software Foundation, version 2 of the 9 * License. 10 * 11 * Jun 2006 - namespaces support 12 * OpenVZ, SWsoft Inc. 13 * Pavel Emelianov <xemul@openvz.org> 14 */ 15 16 #include <linux/slab.h> 17 #include <linux/export.h> 18 #include <linux/nsproxy.h> 19 #include <linux/init_task.h> 20 #include <linux/mnt_namespace.h> 21 #include <linux/utsname.h> 22 #include <linux/pid_namespace.h> 23 #include <net/net_namespace.h> 24 #include <linux/ipc_namespace.h> 25 #include <linux/proc_ns.h> 26 #include <linux/file.h> 27 #include <linux/syscalls.h> 28 #include <linux/cgroup.h> 29 30 static struct kmem_cache *nsproxy_cachep; 31 32 struct nsproxy init_nsproxy = { 33 .count = ATOMIC_INIT(1), 34 .uts_ns = &init_uts_ns, 35 #if defined(CONFIG_POSIX_MQUEUE) || defined(CONFIG_SYSVIPC) 36 .ipc_ns = &init_ipc_ns, 37 #endif 38 .mnt_ns = NULL, 39 .pid_ns_for_children = &init_pid_ns, 40 #ifdef CONFIG_NET 41 .net_ns = &init_net, 42 #endif 43 #ifdef CONFIG_CGROUPS 44 .cgroup_ns = &init_cgroup_ns, 45 #endif 46 }; 47 48 static inline struct nsproxy *create_nsproxy(void) 49 { 50 struct nsproxy *nsproxy; 51 52 nsproxy = kmem_cache_alloc(nsproxy_cachep, GFP_KERNEL); 53 if (nsproxy) 54 atomic_set(&nsproxy->count, 1); 55 return nsproxy; 56 } 57 58 /* 59 * Create new nsproxy and all of its the associated namespaces. 60 * Return the newly created nsproxy. Do not attach this to the task, 61 * leave it to the caller to do proper locking and attach it to task. 62 */ 63 static struct nsproxy *create_new_namespaces(unsigned long flags, 64 struct task_struct *tsk, struct user_namespace *user_ns, 65 struct fs_struct *new_fs) 66 { 67 struct nsproxy *new_nsp; 68 int err; 69 70 new_nsp = create_nsproxy(); 71 if (!new_nsp) 72 return ERR_PTR(-ENOMEM); 73 74 new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, user_ns, new_fs); 75 if (IS_ERR(new_nsp->mnt_ns)) { 76 err = PTR_ERR(new_nsp->mnt_ns); 77 goto out_ns; 78 } 79 80 new_nsp->uts_ns = copy_utsname(flags, user_ns, tsk->nsproxy->uts_ns); 81 if (IS_ERR(new_nsp->uts_ns)) { 82 err = PTR_ERR(new_nsp->uts_ns); 83 goto out_uts; 84 } 85 86 new_nsp->ipc_ns = copy_ipcs(flags, user_ns, tsk->nsproxy->ipc_ns); 87 if (IS_ERR(new_nsp->ipc_ns)) { 88 err = PTR_ERR(new_nsp->ipc_ns); 89 goto out_ipc; 90 } 91 92 new_nsp->pid_ns_for_children = 93 copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns_for_children); 94 if (IS_ERR(new_nsp->pid_ns_for_children)) { 95 err = PTR_ERR(new_nsp->pid_ns_for_children); 96 goto out_pid; 97 } 98 99 new_nsp->cgroup_ns = copy_cgroup_ns(flags, user_ns, 100 tsk->nsproxy->cgroup_ns); 101 if (IS_ERR(new_nsp->cgroup_ns)) { 102 err = PTR_ERR(new_nsp->cgroup_ns); 103 goto out_cgroup; 104 } 105 106 new_nsp->net_ns = copy_net_ns(flags, user_ns, tsk->nsproxy->net_ns); 107 if (IS_ERR(new_nsp->net_ns)) { 108 err = PTR_ERR(new_nsp->net_ns); 109 goto out_net; 110 } 111 112 return new_nsp; 113 114 out_net: 115 put_cgroup_ns(new_nsp->cgroup_ns); 116 out_cgroup: 117 if (new_nsp->pid_ns_for_children) 118 put_pid_ns(new_nsp->pid_ns_for_children); 119 out_pid: 120 if (new_nsp->ipc_ns) 121 put_ipc_ns(new_nsp->ipc_ns); 122 out_ipc: 123 if (new_nsp->uts_ns) 124 put_uts_ns(new_nsp->uts_ns); 125 out_uts: 126 if (new_nsp->mnt_ns) 127 put_mnt_ns(new_nsp->mnt_ns); 128 out_ns: 129 kmem_cache_free(nsproxy_cachep, new_nsp); 130 return ERR_PTR(err); 131 } 132 133 /* 134 * called from clone. This now handles copy for nsproxy and all 135 * namespaces therein. 136 */ 137 int copy_namespaces(unsigned long flags, struct task_struct *tsk) 138 { 139 struct nsproxy *old_ns = tsk->nsproxy; 140 struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns); 141 struct nsproxy *new_ns; 142 143 if (likely(!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | 144 CLONE_NEWPID | CLONE_NEWNET | 145 CLONE_NEWCGROUP)))) { 146 get_nsproxy(old_ns); 147 return 0; 148 } 149 150 if (!ns_capable(user_ns, CAP_SYS_ADMIN)) 151 return -EPERM; 152 153 /* 154 * CLONE_NEWIPC must detach from the undolist: after switching 155 * to a new ipc namespace, the semaphore arrays from the old 156 * namespace are unreachable. In clone parlance, CLONE_SYSVSEM 157 * means share undolist with parent, so we must forbid using 158 * it along with CLONE_NEWIPC. 159 */ 160 if ((flags & (CLONE_NEWIPC | CLONE_SYSVSEM)) == 161 (CLONE_NEWIPC | CLONE_SYSVSEM)) 162 return -EINVAL; 163 164 new_ns = create_new_namespaces(flags, tsk, user_ns, tsk->fs); 165 if (IS_ERR(new_ns)) 166 return PTR_ERR(new_ns); 167 168 tsk->nsproxy = new_ns; 169 return 0; 170 } 171 172 void free_nsproxy(struct nsproxy *ns) 173 { 174 if (ns->mnt_ns) 175 put_mnt_ns(ns->mnt_ns); 176 if (ns->uts_ns) 177 put_uts_ns(ns->uts_ns); 178 if (ns->ipc_ns) 179 put_ipc_ns(ns->ipc_ns); 180 if (ns->pid_ns_for_children) 181 put_pid_ns(ns->pid_ns_for_children); 182 put_cgroup_ns(ns->cgroup_ns); 183 put_net(ns->net_ns); 184 kmem_cache_free(nsproxy_cachep, ns); 185 } 186 187 /* 188 * Called from unshare. Unshare all the namespaces part of nsproxy. 189 * On success, returns the new nsproxy. 190 */ 191 int unshare_nsproxy_namespaces(unsigned long unshare_flags, 192 struct nsproxy **new_nsp, struct cred *new_cred, struct fs_struct *new_fs) 193 { 194 struct user_namespace *user_ns; 195 int err = 0; 196 197 if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | 198 CLONE_NEWNET | CLONE_NEWPID | CLONE_NEWCGROUP))) 199 return 0; 200 201 user_ns = new_cred ? new_cred->user_ns : current_user_ns(); 202 if (!ns_capable(user_ns, CAP_SYS_ADMIN)) 203 return -EPERM; 204 205 *new_nsp = create_new_namespaces(unshare_flags, current, user_ns, 206 new_fs ? new_fs : current->fs); 207 if (IS_ERR(*new_nsp)) { 208 err = PTR_ERR(*new_nsp); 209 goto out; 210 } 211 212 out: 213 return err; 214 } 215 216 void switch_task_namespaces(struct task_struct *p, struct nsproxy *new) 217 { 218 struct nsproxy *ns; 219 220 might_sleep(); 221 222 task_lock(p); 223 ns = p->nsproxy; 224 p->nsproxy = new; 225 task_unlock(p); 226 227 if (ns && atomic_dec_and_test(&ns->count)) 228 free_nsproxy(ns); 229 } 230 231 void exit_task_namespaces(struct task_struct *p) 232 { 233 switch_task_namespaces(p, NULL); 234 } 235 236 SYSCALL_DEFINE2(setns, int, fd, int, nstype) 237 { 238 struct task_struct *tsk = current; 239 struct nsproxy *new_nsproxy; 240 struct file *file; 241 struct ns_common *ns; 242 int err; 243 244 file = proc_ns_fget(fd); 245 if (IS_ERR(file)) 246 return PTR_ERR(file); 247 248 err = -EINVAL; 249 ns = get_proc_ns(file_inode(file)); 250 if (nstype && (ns->ops->type != nstype)) 251 goto out; 252 253 new_nsproxy = create_new_namespaces(0, tsk, current_user_ns(), tsk->fs); 254 if (IS_ERR(new_nsproxy)) { 255 err = PTR_ERR(new_nsproxy); 256 goto out; 257 } 258 259 err = ns->ops->install(new_nsproxy, ns); 260 if (err) { 261 free_nsproxy(new_nsproxy); 262 goto out; 263 } 264 switch_task_namespaces(tsk, new_nsproxy); 265 out: 266 fput(file); 267 return err; 268 } 269 270 int __init nsproxy_cache_init(void) 271 { 272 nsproxy_cachep = KMEM_CACHE(nsproxy, SLAB_PANIC); 273 return 0; 274 } 275