1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Author: Andrei Vagin <avagin@openvz.org> 4 * Author: Dmitry Safonov <dima@arista.com> 5 */ 6 7 #include <linux/time_namespace.h> 8 #include <linux/user_namespace.h> 9 #include <linux/sched/signal.h> 10 #include <linux/sched/task.h> 11 #include <linux/clocksource.h> 12 #include <linux/seq_file.h> 13 #include <linux/proc_ns.h> 14 #include <linux/export.h> 15 #include <linux/time.h> 16 #include <linux/slab.h> 17 #include <linux/cred.h> 18 #include <linux/err.h> 19 #include <linux/mm.h> 20 21 #include <vdso/datapage.h> 22 23 ktime_t do_timens_ktime_to_host(clockid_t clockid, ktime_t tim, 24 struct timens_offsets *ns_offsets) 25 { 26 ktime_t offset; 27 28 switch (clockid) { 29 case CLOCK_MONOTONIC: 30 offset = timespec64_to_ktime(ns_offsets->monotonic); 31 break; 32 case CLOCK_BOOTTIME: 33 case CLOCK_BOOTTIME_ALARM: 34 offset = timespec64_to_ktime(ns_offsets->boottime); 35 break; 36 default: 37 return tim; 38 } 39 40 /* 41 * Check that @tim value is in [offset, KTIME_MAX + offset] 42 * and subtract offset. 43 */ 44 if (tim < offset) { 45 /* 46 * User can specify @tim *absolute* value - if it's lesser than 47 * the time namespace's offset - it's already expired. 48 */ 49 tim = 0; 50 } else { 51 tim = ktime_sub(tim, offset); 52 if (unlikely(tim > KTIME_MAX)) 53 tim = KTIME_MAX; 54 } 55 56 return tim; 57 } 58 59 static struct ucounts *inc_time_namespaces(struct user_namespace *ns) 60 { 61 return inc_ucount(ns, current_euid(), UCOUNT_TIME_NAMESPACES); 62 } 63 64 static void dec_time_namespaces(struct ucounts *ucounts) 65 { 66 dec_ucount(ucounts, UCOUNT_TIME_NAMESPACES); 67 } 68 69 /** 70 * clone_time_ns - Clone a time namespace 71 * @user_ns: User namespace which owns a new namespace. 72 * @old_ns: Namespace to clone 73 * 74 * Clone @old_ns and set the clone refcount to 1 75 * 76 * Return: The new namespace or ERR_PTR. 77 */ 78 static struct time_namespace *clone_time_ns(struct user_namespace *user_ns, 79 struct time_namespace *old_ns) 80 { 81 struct time_namespace *ns; 82 struct ucounts *ucounts; 83 int err; 84 85 err = -ENOSPC; 86 ucounts = inc_time_namespaces(user_ns); 87 if (!ucounts) 88 goto fail; 89 90 err = -ENOMEM; 91 ns = kmalloc(sizeof(*ns), GFP_KERNEL); 92 if (!ns) 93 goto fail_dec; 94 95 kref_init(&ns->kref); 96 97 ns->vvar_page = alloc_page(GFP_KERNEL | __GFP_ZERO); 98 if (!ns->vvar_page) 99 goto fail_free; 100 101 err = ns_alloc_inum(&ns->ns); 102 if (err) 103 goto fail_free_page; 104 105 ns->ucounts = ucounts; 106 ns->ns.ops = &timens_operations; 107 ns->user_ns = get_user_ns(user_ns); 108 ns->offsets = old_ns->offsets; 109 ns->frozen_offsets = false; 110 return ns; 111 112 fail_free_page: 113 __free_page(ns->vvar_page); 114 fail_free: 115 kfree(ns); 116 fail_dec: 117 dec_time_namespaces(ucounts); 118 fail: 119 return ERR_PTR(err); 120 } 121 122 /** 123 * copy_time_ns - Create timens_for_children from @old_ns 124 * @flags: Cloning flags 125 * @user_ns: User namespace which owns a new namespace. 126 * @old_ns: Namespace to clone 127 * 128 * If CLONE_NEWTIME specified in @flags, creates a new timens_for_children; 129 * adds a refcounter to @old_ns otherwise. 130 * 131 * Return: timens_for_children namespace or ERR_PTR. 132 */ 133 struct time_namespace *copy_time_ns(unsigned long flags, 134 struct user_namespace *user_ns, struct time_namespace *old_ns) 135 { 136 if (!(flags & CLONE_NEWTIME)) 137 return get_time_ns(old_ns); 138 139 return clone_time_ns(user_ns, old_ns); 140 } 141 142 static struct timens_offset offset_from_ts(struct timespec64 off) 143 { 144 struct timens_offset ret; 145 146 ret.sec = off.tv_sec; 147 ret.nsec = off.tv_nsec; 148 149 return ret; 150 } 151 152 /* 153 * A time namespace VVAR page has the same layout as the VVAR page which 154 * contains the system wide VDSO data. 155 * 156 * For a normal task the VVAR pages are installed in the normal ordering: 157 * VVAR 158 * PVCLOCK 159 * HVCLOCK 160 * TIMENS <- Not really required 161 * 162 * Now for a timens task the pages are installed in the following order: 163 * TIMENS 164 * PVCLOCK 165 * HVCLOCK 166 * VVAR 167 * 168 * The check for vdso_data->clock_mode is in the unlikely path of 169 * the seq begin magic. So for the non-timens case most of the time 170 * 'seq' is even, so the branch is not taken. 171 * 172 * If 'seq' is odd, i.e. a concurrent update is in progress, the extra check 173 * for vdso_data->clock_mode is a non-issue. The task is spin waiting for the 174 * update to finish and for 'seq' to become even anyway. 175 * 176 * Timens page has vdso_data->clock_mode set to VDSO_CLOCKMODE_TIMENS which 177 * enforces the time namespace handling path. 178 */ 179 static void timens_setup_vdso_data(struct vdso_data *vdata, 180 struct time_namespace *ns) 181 { 182 struct timens_offset *offset = vdata->offset; 183 struct timens_offset monotonic = offset_from_ts(ns->offsets.monotonic); 184 struct timens_offset boottime = offset_from_ts(ns->offsets.boottime); 185 186 vdata->seq = 1; 187 vdata->clock_mode = VDSO_CLOCKMODE_TIMENS; 188 offset[CLOCK_MONOTONIC] = monotonic; 189 offset[CLOCK_MONOTONIC_RAW] = monotonic; 190 offset[CLOCK_MONOTONIC_COARSE] = monotonic; 191 offset[CLOCK_BOOTTIME] = boottime; 192 offset[CLOCK_BOOTTIME_ALARM] = boottime; 193 } 194 195 /* 196 * Protects possibly multiple offsets writers racing each other 197 * and tasks entering the namespace. 198 */ 199 static DEFINE_MUTEX(offset_lock); 200 201 static void timens_set_vvar_page(struct task_struct *task, 202 struct time_namespace *ns) 203 { 204 struct vdso_data *vdata; 205 unsigned int i; 206 207 if (ns == &init_time_ns) 208 return; 209 210 /* Fast-path, taken by every task in namespace except the first. */ 211 if (likely(ns->frozen_offsets)) 212 return; 213 214 mutex_lock(&offset_lock); 215 /* Nothing to-do: vvar_page has been already initialized. */ 216 if (ns->frozen_offsets) 217 goto out; 218 219 ns->frozen_offsets = true; 220 vdata = arch_get_vdso_data(page_address(ns->vvar_page)); 221 222 for (i = 0; i < CS_BASES; i++) 223 timens_setup_vdso_data(&vdata[i], ns); 224 225 out: 226 mutex_unlock(&offset_lock); 227 } 228 229 void free_time_ns(struct kref *kref) 230 { 231 struct time_namespace *ns; 232 233 ns = container_of(kref, struct time_namespace, kref); 234 dec_time_namespaces(ns->ucounts); 235 put_user_ns(ns->user_ns); 236 ns_free_inum(&ns->ns); 237 __free_page(ns->vvar_page); 238 kfree(ns); 239 } 240 241 static struct time_namespace *to_time_ns(struct ns_common *ns) 242 { 243 return container_of(ns, struct time_namespace, ns); 244 } 245 246 static struct ns_common *timens_get(struct task_struct *task) 247 { 248 struct time_namespace *ns = NULL; 249 struct nsproxy *nsproxy; 250 251 task_lock(task); 252 nsproxy = task->nsproxy; 253 if (nsproxy) { 254 ns = nsproxy->time_ns; 255 get_time_ns(ns); 256 } 257 task_unlock(task); 258 259 return ns ? &ns->ns : NULL; 260 } 261 262 static struct ns_common *timens_for_children_get(struct task_struct *task) 263 { 264 struct time_namespace *ns = NULL; 265 struct nsproxy *nsproxy; 266 267 task_lock(task); 268 nsproxy = task->nsproxy; 269 if (nsproxy) { 270 ns = nsproxy->time_ns_for_children; 271 get_time_ns(ns); 272 } 273 task_unlock(task); 274 275 return ns ? &ns->ns : NULL; 276 } 277 278 static void timens_put(struct ns_common *ns) 279 { 280 put_time_ns(to_time_ns(ns)); 281 } 282 283 void timens_commit(struct task_struct *tsk, struct time_namespace *ns) 284 { 285 timens_set_vvar_page(tsk, ns); 286 vdso_join_timens(tsk, ns); 287 } 288 289 static int timens_install(struct nsset *nsset, struct ns_common *new) 290 { 291 struct nsproxy *nsproxy = nsset->nsproxy; 292 struct time_namespace *ns = to_time_ns(new); 293 294 if (!current_is_single_threaded()) 295 return -EUSERS; 296 297 if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) || 298 !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN)) 299 return -EPERM; 300 301 get_time_ns(ns); 302 put_time_ns(nsproxy->time_ns); 303 nsproxy->time_ns = ns; 304 305 get_time_ns(ns); 306 put_time_ns(nsproxy->time_ns_for_children); 307 nsproxy->time_ns_for_children = ns; 308 return 0; 309 } 310 311 int timens_on_fork(struct nsproxy *nsproxy, struct task_struct *tsk) 312 { 313 struct ns_common *nsc = &nsproxy->time_ns_for_children->ns; 314 struct time_namespace *ns = to_time_ns(nsc); 315 316 /* create_new_namespaces() already incremented the ref counter */ 317 if (nsproxy->time_ns == nsproxy->time_ns_for_children) 318 return 0; 319 320 get_time_ns(ns); 321 put_time_ns(nsproxy->time_ns); 322 nsproxy->time_ns = ns; 323 324 timens_commit(tsk, ns); 325 326 return 0; 327 } 328 329 static struct user_namespace *timens_owner(struct ns_common *ns) 330 { 331 return to_time_ns(ns)->user_ns; 332 } 333 334 static void show_offset(struct seq_file *m, int clockid, struct timespec64 *ts) 335 { 336 char *clock; 337 338 switch (clockid) { 339 case CLOCK_BOOTTIME: 340 clock = "boottime"; 341 break; 342 case CLOCK_MONOTONIC: 343 clock = "monotonic"; 344 break; 345 default: 346 clock = "unknown"; 347 break; 348 } 349 seq_printf(m, "%-10s %10lld %9ld\n", clock, ts->tv_sec, ts->tv_nsec); 350 } 351 352 void proc_timens_show_offsets(struct task_struct *p, struct seq_file *m) 353 { 354 struct ns_common *ns; 355 struct time_namespace *time_ns; 356 357 ns = timens_for_children_get(p); 358 if (!ns) 359 return; 360 time_ns = to_time_ns(ns); 361 362 show_offset(m, CLOCK_MONOTONIC, &time_ns->offsets.monotonic); 363 show_offset(m, CLOCK_BOOTTIME, &time_ns->offsets.boottime); 364 put_time_ns(time_ns); 365 } 366 367 int proc_timens_set_offset(struct file *file, struct task_struct *p, 368 struct proc_timens_offset *offsets, int noffsets) 369 { 370 struct ns_common *ns; 371 struct time_namespace *time_ns; 372 struct timespec64 tp; 373 int i, err; 374 375 ns = timens_for_children_get(p); 376 if (!ns) 377 return -ESRCH; 378 time_ns = to_time_ns(ns); 379 380 if (!file_ns_capable(file, time_ns->user_ns, CAP_SYS_TIME)) { 381 put_time_ns(time_ns); 382 return -EPERM; 383 } 384 385 for (i = 0; i < noffsets; i++) { 386 struct proc_timens_offset *off = &offsets[i]; 387 388 switch (off->clockid) { 389 case CLOCK_MONOTONIC: 390 ktime_get_ts64(&tp); 391 break; 392 case CLOCK_BOOTTIME: 393 ktime_get_boottime_ts64(&tp); 394 break; 395 default: 396 err = -EINVAL; 397 goto out; 398 } 399 400 err = -ERANGE; 401 402 if (off->val.tv_sec > KTIME_SEC_MAX || 403 off->val.tv_sec < -KTIME_SEC_MAX) 404 goto out; 405 406 tp = timespec64_add(tp, off->val); 407 /* 408 * KTIME_SEC_MAX is divided by 2 to be sure that KTIME_MAX is 409 * still unreachable. 410 */ 411 if (tp.tv_sec < 0 || tp.tv_sec > KTIME_SEC_MAX / 2) 412 goto out; 413 } 414 415 mutex_lock(&offset_lock); 416 if (time_ns->frozen_offsets) { 417 err = -EACCES; 418 goto out_unlock; 419 } 420 421 err = 0; 422 /* Don't report errors after this line */ 423 for (i = 0; i < noffsets; i++) { 424 struct proc_timens_offset *off = &offsets[i]; 425 struct timespec64 *offset = NULL; 426 427 switch (off->clockid) { 428 case CLOCK_MONOTONIC: 429 offset = &time_ns->offsets.monotonic; 430 break; 431 case CLOCK_BOOTTIME: 432 offset = &time_ns->offsets.boottime; 433 break; 434 } 435 436 *offset = off->val; 437 } 438 439 out_unlock: 440 mutex_unlock(&offset_lock); 441 out: 442 put_time_ns(time_ns); 443 444 return err; 445 } 446 447 const struct proc_ns_operations timens_operations = { 448 .name = "time", 449 .type = CLONE_NEWTIME, 450 .get = timens_get, 451 .put = timens_put, 452 .install = timens_install, 453 .owner = timens_owner, 454 }; 455 456 const struct proc_ns_operations timens_for_children_operations = { 457 .name = "time_for_children", 458 .real_ns_name = "time", 459 .type = CLONE_NEWTIME, 460 .get = timens_for_children_get, 461 .put = timens_put, 462 .install = timens_install, 463 .owner = timens_owner, 464 }; 465 466 struct time_namespace init_time_ns = { 467 .kref = KREF_INIT(3), 468 .user_ns = &init_user_ns, 469 .ns.inum = PROC_TIME_INIT_INO, 470 .ns.ops = &timens_operations, 471 .frozen_offsets = true, 472 }; 473 474 static int __init time_ns_init(void) 475 { 476 return 0; 477 } 478 subsys_initcall(time_ns_init); 479