1 // SPDX-License-Identifier: GPL-2.0-only 2 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 3 4 #include <linux/workqueue.h> 5 #include <linux/rtnetlink.h> 6 #include <linux/cache.h> 7 #include <linux/slab.h> 8 #include <linux/list.h> 9 #include <linux/delay.h> 10 #include <linux/sched.h> 11 #include <linux/idr.h> 12 #include <linux/rculist.h> 13 #include <linux/nsproxy.h> 14 #include <linux/fs.h> 15 #include <linux/proc_ns.h> 16 #include <linux/file.h> 17 #include <linux/export.h> 18 #include <linux/user_namespace.h> 19 #include <linux/net_namespace.h> 20 #include <linux/sched/task.h> 21 #include <linux/uidgid.h> 22 23 #include <net/sock.h> 24 #include <net/netlink.h> 25 #include <net/net_namespace.h> 26 #include <net/netns/generic.h> 27 28 /* 29 * Our network namespace constructor/destructor lists 30 */ 31 32 static LIST_HEAD(pernet_list); 33 static struct list_head *first_device = &pernet_list; 34 35 LIST_HEAD(net_namespace_list); 36 EXPORT_SYMBOL_GPL(net_namespace_list); 37 38 /* Protects net_namespace_list. Nests iside rtnl_lock() */ 39 DECLARE_RWSEM(net_rwsem); 40 EXPORT_SYMBOL_GPL(net_rwsem); 41 42 #ifdef CONFIG_KEYS 43 static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) }; 44 #endif 45 46 struct net init_net = { 47 .count = REFCOUNT_INIT(1), 48 .dev_base_head = LIST_HEAD_INIT(init_net.dev_base_head), 49 #ifdef CONFIG_KEYS 50 .key_domain = &init_net_key_domain, 51 #endif 52 }; 53 EXPORT_SYMBOL(init_net); 54 55 static bool init_net_initialized; 56 /* 57 * pernet_ops_rwsem: protects: pernet_list, net_generic_ids, 58 * init_net_initialized and first_device pointer. 59 * This is internal net namespace object. Please, don't use it 60 * outside. 61 */ 62 DECLARE_RWSEM(pernet_ops_rwsem); 63 EXPORT_SYMBOL_GPL(pernet_ops_rwsem); 64 65 #define MIN_PERNET_OPS_ID \ 66 ((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *)) 67 68 #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */ 69 70 static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS; 71 72 static struct net_generic *net_alloc_generic(void) 73 { 74 struct net_generic *ng; 75 unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]); 76 77 ng = kzalloc(generic_size, GFP_KERNEL); 78 if (ng) 79 ng->s.len = max_gen_ptrs; 80 81 return ng; 82 } 83 84 static int net_assign_generic(struct net *net, unsigned int id, void *data) 85 { 86 struct net_generic *ng, *old_ng; 87 88 BUG_ON(id < MIN_PERNET_OPS_ID); 89 90 old_ng = rcu_dereference_protected(net->gen, 91 lockdep_is_held(&pernet_ops_rwsem)); 92 if (old_ng->s.len > id) { 93 old_ng->ptr[id] = data; 94 return 0; 95 } 96 97 ng = net_alloc_generic(); 98 if (ng == NULL) 99 return -ENOMEM; 100 101 /* 102 * Some synchronisation notes: 103 * 104 * The net_generic explores the net->gen array inside rcu 105 * read section. Besides once set the net->gen->ptr[x] 106 * pointer never changes (see rules in netns/generic.h). 107 * 108 * That said, we simply duplicate this array and schedule 109 * the old copy for kfree after a grace period. 110 */ 111 112 memcpy(&ng->ptr[MIN_PERNET_OPS_ID], &old_ng->ptr[MIN_PERNET_OPS_ID], 113 (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *)); 114 ng->ptr[id] = data; 115 116 rcu_assign_pointer(net->gen, ng); 117 kfree_rcu(old_ng, s.rcu); 118 return 0; 119 } 120 121 static int ops_init(const struct pernet_operations *ops, struct net *net) 122 { 123 int err = -ENOMEM; 124 void *data = NULL; 125 126 if (ops->id && ops->size) { 127 data = kzalloc(ops->size, GFP_KERNEL); 128 if (!data) 129 goto out; 130 131 err = net_assign_generic(net, *ops->id, data); 132 if (err) 133 goto cleanup; 134 } 135 err = 0; 136 if (ops->init) 137 err = ops->init(net); 138 if (!err) 139 return 0; 140 141 cleanup: 142 kfree(data); 143 144 out: 145 return err; 146 } 147 148 static void ops_free(const struct pernet_operations *ops, struct net *net) 149 { 150 if (ops->id && ops->size) { 151 kfree(net_generic(net, *ops->id)); 152 } 153 } 154 155 static void ops_pre_exit_list(const struct pernet_operations *ops, 156 struct list_head *net_exit_list) 157 { 158 struct net *net; 159 160 if (ops->pre_exit) { 161 list_for_each_entry(net, net_exit_list, exit_list) 162 ops->pre_exit(net); 163 } 164 } 165 166 static void ops_exit_list(const struct pernet_operations *ops, 167 struct list_head *net_exit_list) 168 { 169 struct net *net; 170 if (ops->exit) { 171 list_for_each_entry(net, net_exit_list, exit_list) 172 ops->exit(net); 173 } 174 if (ops->exit_batch) 175 ops->exit_batch(net_exit_list); 176 } 177 178 static void ops_free_list(const struct pernet_operations *ops, 179 struct list_head *net_exit_list) 180 { 181 struct net *net; 182 if (ops->size && ops->id) { 183 list_for_each_entry(net, net_exit_list, exit_list) 184 ops_free(ops, net); 185 } 186 } 187 188 /* should be called with nsid_lock held */ 189 static int alloc_netid(struct net *net, struct net *peer, int reqid) 190 { 191 int min = 0, max = 0; 192 193 if (reqid >= 0) { 194 min = reqid; 195 max = reqid + 1; 196 } 197 198 return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC); 199 } 200 201 /* This function is used by idr_for_each(). If net is equal to peer, the 202 * function returns the id so that idr_for_each() stops. Because we cannot 203 * returns the id 0 (idr_for_each() will not stop), we return the magic value 204 * NET_ID_ZERO (-1) for it. 205 */ 206 #define NET_ID_ZERO -1 207 static int net_eq_idr(int id, void *net, void *peer) 208 { 209 if (net_eq(net, peer)) 210 return id ? : NET_ID_ZERO; 211 return 0; 212 } 213 214 /* Should be called with nsid_lock held. */ 215 static int __peernet2id(const struct net *net, struct net *peer) 216 { 217 int id = idr_for_each(&net->netns_ids, net_eq_idr, peer); 218 219 /* Magic value for id 0. */ 220 if (id == NET_ID_ZERO) 221 return 0; 222 if (id > 0) 223 return id; 224 225 return NETNSA_NSID_NOT_ASSIGNED; 226 } 227 228 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid, 229 struct nlmsghdr *nlh, gfp_t gfp); 230 /* This function returns the id of a peer netns. If no id is assigned, one will 231 * be allocated and returned. 232 */ 233 int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp) 234 { 235 int id; 236 237 if (refcount_read(&net->count) == 0) 238 return NETNSA_NSID_NOT_ASSIGNED; 239 240 spin_lock_bh(&net->nsid_lock); 241 id = __peernet2id(net, peer); 242 if (id >= 0) { 243 spin_unlock_bh(&net->nsid_lock); 244 return id; 245 } 246 247 /* When peer is obtained from RCU lists, we may race with 248 * its cleanup. Check whether it's alive, and this guarantees 249 * we never hash a peer back to net->netns_ids, after it has 250 * just been idr_remove()'d from there in cleanup_net(). 251 */ 252 if (!maybe_get_net(peer)) { 253 spin_unlock_bh(&net->nsid_lock); 254 return NETNSA_NSID_NOT_ASSIGNED; 255 } 256 257 id = alloc_netid(net, peer, -1); 258 spin_unlock_bh(&net->nsid_lock); 259 260 put_net(peer); 261 if (id < 0) 262 return NETNSA_NSID_NOT_ASSIGNED; 263 264 rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp); 265 266 return id; 267 } 268 EXPORT_SYMBOL_GPL(peernet2id_alloc); 269 270 /* This function returns, if assigned, the id of a peer netns. */ 271 int peernet2id(struct net *net, struct net *peer) 272 { 273 int id; 274 275 spin_lock_bh(&net->nsid_lock); 276 id = __peernet2id(net, peer); 277 spin_unlock_bh(&net->nsid_lock); 278 return id; 279 } 280 EXPORT_SYMBOL(peernet2id); 281 282 /* This function returns true is the peer netns has an id assigned into the 283 * current netns. 284 */ 285 bool peernet_has_id(struct net *net, struct net *peer) 286 { 287 return peernet2id(net, peer) >= 0; 288 } 289 290 struct net *get_net_ns_by_id(struct net *net, int id) 291 { 292 struct net *peer; 293 294 if (id < 0) 295 return NULL; 296 297 rcu_read_lock(); 298 peer = idr_find(&net->netns_ids, id); 299 if (peer) 300 peer = maybe_get_net(peer); 301 rcu_read_unlock(); 302 303 return peer; 304 } 305 306 /* 307 * setup_net runs the initializers for the network namespace object. 308 */ 309 static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) 310 { 311 /* Must be called with pernet_ops_rwsem held */ 312 const struct pernet_operations *ops, *saved_ops; 313 int error = 0; 314 LIST_HEAD(net_exit_list); 315 316 refcount_set(&net->count, 1); 317 refcount_set(&net->passive, 1); 318 get_random_bytes(&net->hash_mix, sizeof(u32)); 319 net->dev_base_seq = 1; 320 net->user_ns = user_ns; 321 idr_init(&net->netns_ids); 322 spin_lock_init(&net->nsid_lock); 323 mutex_init(&net->ipv4.ra_mutex); 324 325 list_for_each_entry(ops, &pernet_list, list) { 326 error = ops_init(ops, net); 327 if (error < 0) 328 goto out_undo; 329 } 330 down_write(&net_rwsem); 331 list_add_tail_rcu(&net->list, &net_namespace_list); 332 up_write(&net_rwsem); 333 out: 334 return error; 335 336 out_undo: 337 /* Walk through the list backwards calling the exit functions 338 * for the pernet modules whose init functions did not fail. 339 */ 340 list_add(&net->exit_list, &net_exit_list); 341 saved_ops = ops; 342 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 343 ops_pre_exit_list(ops, &net_exit_list); 344 345 synchronize_rcu(); 346 347 ops = saved_ops; 348 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 349 ops_exit_list(ops, &net_exit_list); 350 351 ops = saved_ops; 352 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 353 ops_free_list(ops, &net_exit_list); 354 355 rcu_barrier(); 356 goto out; 357 } 358 359 static int __net_init net_defaults_init_net(struct net *net) 360 { 361 net->core.sysctl_somaxconn = SOMAXCONN; 362 return 0; 363 } 364 365 static struct pernet_operations net_defaults_ops = { 366 .init = net_defaults_init_net, 367 }; 368 369 static __init int net_defaults_init(void) 370 { 371 if (register_pernet_subsys(&net_defaults_ops)) 372 panic("Cannot initialize net default settings"); 373 374 return 0; 375 } 376 377 core_initcall(net_defaults_init); 378 379 #ifdef CONFIG_NET_NS 380 static struct ucounts *inc_net_namespaces(struct user_namespace *ns) 381 { 382 return inc_ucount(ns, current_euid(), UCOUNT_NET_NAMESPACES); 383 } 384 385 static void dec_net_namespaces(struct ucounts *ucounts) 386 { 387 dec_ucount(ucounts, UCOUNT_NET_NAMESPACES); 388 } 389 390 static struct kmem_cache *net_cachep __ro_after_init; 391 static struct workqueue_struct *netns_wq; 392 393 static struct net *net_alloc(void) 394 { 395 struct net *net = NULL; 396 struct net_generic *ng; 397 398 ng = net_alloc_generic(); 399 if (!ng) 400 goto out; 401 402 net = kmem_cache_zalloc(net_cachep, GFP_KERNEL); 403 if (!net) 404 goto out_free; 405 406 #ifdef CONFIG_KEYS 407 net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL); 408 if (!net->key_domain) 409 goto out_free_2; 410 refcount_set(&net->key_domain->usage, 1); 411 #endif 412 413 rcu_assign_pointer(net->gen, ng); 414 out: 415 return net; 416 417 #ifdef CONFIG_KEYS 418 out_free_2: 419 kmem_cache_free(net_cachep, net); 420 net = NULL; 421 #endif 422 out_free: 423 kfree(ng); 424 goto out; 425 } 426 427 static void net_free(struct net *net) 428 { 429 kfree(rcu_access_pointer(net->gen)); 430 kmem_cache_free(net_cachep, net); 431 } 432 433 void net_drop_ns(void *p) 434 { 435 struct net *ns = p; 436 if (ns && refcount_dec_and_test(&ns->passive)) 437 net_free(ns); 438 } 439 440 struct net *copy_net_ns(unsigned long flags, 441 struct user_namespace *user_ns, struct net *old_net) 442 { 443 struct ucounts *ucounts; 444 struct net *net; 445 int rv; 446 447 if (!(flags & CLONE_NEWNET)) 448 return get_net(old_net); 449 450 ucounts = inc_net_namespaces(user_ns); 451 if (!ucounts) 452 return ERR_PTR(-ENOSPC); 453 454 net = net_alloc(); 455 if (!net) { 456 rv = -ENOMEM; 457 goto dec_ucounts; 458 } 459 refcount_set(&net->passive, 1); 460 net->ucounts = ucounts; 461 get_user_ns(user_ns); 462 463 rv = down_read_killable(&pernet_ops_rwsem); 464 if (rv < 0) 465 goto put_userns; 466 467 rv = setup_net(net, user_ns); 468 469 up_read(&pernet_ops_rwsem); 470 471 if (rv < 0) { 472 put_userns: 473 key_remove_domain(net->key_domain); 474 put_user_ns(user_ns); 475 net_drop_ns(net); 476 dec_ucounts: 477 dec_net_namespaces(ucounts); 478 return ERR_PTR(rv); 479 } 480 return net; 481 } 482 483 /** 484 * net_ns_get_ownership - get sysfs ownership data for @net 485 * @net: network namespace in question (can be NULL) 486 * @uid: kernel user ID for sysfs objects 487 * @gid: kernel group ID for sysfs objects 488 * 489 * Returns the uid/gid pair of root in the user namespace associated with the 490 * given network namespace. 491 */ 492 void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid) 493 { 494 if (net) { 495 kuid_t ns_root_uid = make_kuid(net->user_ns, 0); 496 kgid_t ns_root_gid = make_kgid(net->user_ns, 0); 497 498 if (uid_valid(ns_root_uid)) 499 *uid = ns_root_uid; 500 501 if (gid_valid(ns_root_gid)) 502 *gid = ns_root_gid; 503 } else { 504 *uid = GLOBAL_ROOT_UID; 505 *gid = GLOBAL_ROOT_GID; 506 } 507 } 508 EXPORT_SYMBOL_GPL(net_ns_get_ownership); 509 510 static void unhash_nsid(struct net *net, struct net *last) 511 { 512 struct net *tmp; 513 /* This function is only called from cleanup_net() work, 514 * and this work is the only process, that may delete 515 * a net from net_namespace_list. So, when the below 516 * is executing, the list may only grow. Thus, we do not 517 * use for_each_net_rcu() or net_rwsem. 518 */ 519 for_each_net(tmp) { 520 int id; 521 522 spin_lock_bh(&tmp->nsid_lock); 523 id = __peernet2id(tmp, net); 524 if (id >= 0) 525 idr_remove(&tmp->netns_ids, id); 526 spin_unlock_bh(&tmp->nsid_lock); 527 if (id >= 0) 528 rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL, 529 GFP_KERNEL); 530 if (tmp == last) 531 break; 532 } 533 spin_lock_bh(&net->nsid_lock); 534 idr_destroy(&net->netns_ids); 535 spin_unlock_bh(&net->nsid_lock); 536 } 537 538 static LLIST_HEAD(cleanup_list); 539 540 static void cleanup_net(struct work_struct *work) 541 { 542 const struct pernet_operations *ops; 543 struct net *net, *tmp, *last; 544 struct llist_node *net_kill_list; 545 LIST_HEAD(net_exit_list); 546 547 /* Atomically snapshot the list of namespaces to cleanup */ 548 net_kill_list = llist_del_all(&cleanup_list); 549 550 down_read(&pernet_ops_rwsem); 551 552 /* Don't let anyone else find us. */ 553 down_write(&net_rwsem); 554 llist_for_each_entry(net, net_kill_list, cleanup_list) 555 list_del_rcu(&net->list); 556 /* Cache last net. After we unlock rtnl, no one new net 557 * added to net_namespace_list can assign nsid pointer 558 * to a net from net_kill_list (see peernet2id_alloc()). 559 * So, we skip them in unhash_nsid(). 560 * 561 * Note, that unhash_nsid() does not delete nsid links 562 * between net_kill_list's nets, as they've already 563 * deleted from net_namespace_list. But, this would be 564 * useless anyway, as netns_ids are destroyed there. 565 */ 566 last = list_last_entry(&net_namespace_list, struct net, list); 567 up_write(&net_rwsem); 568 569 llist_for_each_entry(net, net_kill_list, cleanup_list) { 570 unhash_nsid(net, last); 571 list_add_tail(&net->exit_list, &net_exit_list); 572 } 573 574 /* Run all of the network namespace pre_exit methods */ 575 list_for_each_entry_reverse(ops, &pernet_list, list) 576 ops_pre_exit_list(ops, &net_exit_list); 577 578 /* 579 * Another CPU might be rcu-iterating the list, wait for it. 580 * This needs to be before calling the exit() notifiers, so 581 * the rcu_barrier() below isn't sufficient alone. 582 * Also the pre_exit() and exit() methods need this barrier. 583 */ 584 synchronize_rcu(); 585 586 /* Run all of the network namespace exit methods */ 587 list_for_each_entry_reverse(ops, &pernet_list, list) 588 ops_exit_list(ops, &net_exit_list); 589 590 /* Free the net generic variables */ 591 list_for_each_entry_reverse(ops, &pernet_list, list) 592 ops_free_list(ops, &net_exit_list); 593 594 up_read(&pernet_ops_rwsem); 595 596 /* Ensure there are no outstanding rcu callbacks using this 597 * network namespace. 598 */ 599 rcu_barrier(); 600 601 /* Finally it is safe to free my network namespace structure */ 602 list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) { 603 list_del_init(&net->exit_list); 604 dec_net_namespaces(net->ucounts); 605 key_remove_domain(net->key_domain); 606 put_user_ns(net->user_ns); 607 net_drop_ns(net); 608 } 609 } 610 611 /** 612 * net_ns_barrier - wait until concurrent net_cleanup_work is done 613 * 614 * cleanup_net runs from work queue and will first remove namespaces 615 * from the global list, then run net exit functions. 616 * 617 * Call this in module exit path to make sure that all netns 618 * ->exit ops have been invoked before the function is removed. 619 */ 620 void net_ns_barrier(void) 621 { 622 down_write(&pernet_ops_rwsem); 623 up_write(&pernet_ops_rwsem); 624 } 625 EXPORT_SYMBOL(net_ns_barrier); 626 627 static DECLARE_WORK(net_cleanup_work, cleanup_net); 628 629 void __put_net(struct net *net) 630 { 631 /* Cleanup the network namespace in process context */ 632 if (llist_add(&net->cleanup_list, &cleanup_list)) 633 queue_work(netns_wq, &net_cleanup_work); 634 } 635 EXPORT_SYMBOL_GPL(__put_net); 636 637 struct net *get_net_ns_by_fd(int fd) 638 { 639 struct file *file; 640 struct ns_common *ns; 641 struct net *net; 642 643 file = proc_ns_fget(fd); 644 if (IS_ERR(file)) 645 return ERR_CAST(file); 646 647 ns = get_proc_ns(file_inode(file)); 648 if (ns->ops == &netns_operations) 649 net = get_net(container_of(ns, struct net, ns)); 650 else 651 net = ERR_PTR(-EINVAL); 652 653 fput(file); 654 return net; 655 } 656 657 #else 658 struct net *get_net_ns_by_fd(int fd) 659 { 660 return ERR_PTR(-EINVAL); 661 } 662 #endif 663 EXPORT_SYMBOL_GPL(get_net_ns_by_fd); 664 665 struct net *get_net_ns_by_pid(pid_t pid) 666 { 667 struct task_struct *tsk; 668 struct net *net; 669 670 /* Lookup the network namespace */ 671 net = ERR_PTR(-ESRCH); 672 rcu_read_lock(); 673 tsk = find_task_by_vpid(pid); 674 if (tsk) { 675 struct nsproxy *nsproxy; 676 task_lock(tsk); 677 nsproxy = tsk->nsproxy; 678 if (nsproxy) 679 net = get_net(nsproxy->net_ns); 680 task_unlock(tsk); 681 } 682 rcu_read_unlock(); 683 return net; 684 } 685 EXPORT_SYMBOL_GPL(get_net_ns_by_pid); 686 687 static __net_init int net_ns_net_init(struct net *net) 688 { 689 #ifdef CONFIG_NET_NS 690 net->ns.ops = &netns_operations; 691 #endif 692 return ns_alloc_inum(&net->ns); 693 } 694 695 static __net_exit void net_ns_net_exit(struct net *net) 696 { 697 ns_free_inum(&net->ns); 698 } 699 700 static struct pernet_operations __net_initdata net_ns_ops = { 701 .init = net_ns_net_init, 702 .exit = net_ns_net_exit, 703 }; 704 705 static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = { 706 [NETNSA_NONE] = { .type = NLA_UNSPEC }, 707 [NETNSA_NSID] = { .type = NLA_S32 }, 708 [NETNSA_PID] = { .type = NLA_U32 }, 709 [NETNSA_FD] = { .type = NLA_U32 }, 710 [NETNSA_TARGET_NSID] = { .type = NLA_S32 }, 711 }; 712 713 static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh, 714 struct netlink_ext_ack *extack) 715 { 716 struct net *net = sock_net(skb->sk); 717 struct nlattr *tb[NETNSA_MAX + 1]; 718 struct nlattr *nla; 719 struct net *peer; 720 int nsid, err; 721 722 err = nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), tb, 723 NETNSA_MAX, rtnl_net_policy, extack); 724 if (err < 0) 725 return err; 726 if (!tb[NETNSA_NSID]) { 727 NL_SET_ERR_MSG(extack, "nsid is missing"); 728 return -EINVAL; 729 } 730 nsid = nla_get_s32(tb[NETNSA_NSID]); 731 732 if (tb[NETNSA_PID]) { 733 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID])); 734 nla = tb[NETNSA_PID]; 735 } else if (tb[NETNSA_FD]) { 736 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD])); 737 nla = tb[NETNSA_FD]; 738 } else { 739 NL_SET_ERR_MSG(extack, "Peer netns reference is missing"); 740 return -EINVAL; 741 } 742 if (IS_ERR(peer)) { 743 NL_SET_BAD_ATTR(extack, nla); 744 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid"); 745 return PTR_ERR(peer); 746 } 747 748 spin_lock_bh(&net->nsid_lock); 749 if (__peernet2id(net, peer) >= 0) { 750 spin_unlock_bh(&net->nsid_lock); 751 err = -EEXIST; 752 NL_SET_BAD_ATTR(extack, nla); 753 NL_SET_ERR_MSG(extack, 754 "Peer netns already has a nsid assigned"); 755 goto out; 756 } 757 758 err = alloc_netid(net, peer, nsid); 759 spin_unlock_bh(&net->nsid_lock); 760 if (err >= 0) { 761 rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid, 762 nlh, GFP_KERNEL); 763 err = 0; 764 } else if (err == -ENOSPC && nsid >= 0) { 765 err = -EEXIST; 766 NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]); 767 NL_SET_ERR_MSG(extack, "The specified nsid is already used"); 768 } 769 out: 770 put_net(peer); 771 return err; 772 } 773 774 static int rtnl_net_get_size(void) 775 { 776 return NLMSG_ALIGN(sizeof(struct rtgenmsg)) 777 + nla_total_size(sizeof(s32)) /* NETNSA_NSID */ 778 + nla_total_size(sizeof(s32)) /* NETNSA_CURRENT_NSID */ 779 ; 780 } 781 782 struct net_fill_args { 783 u32 portid; 784 u32 seq; 785 int flags; 786 int cmd; 787 int nsid; 788 bool add_ref; 789 int ref_nsid; 790 }; 791 792 static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args) 793 { 794 struct nlmsghdr *nlh; 795 struct rtgenmsg *rth; 796 797 nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth), 798 args->flags); 799 if (!nlh) 800 return -EMSGSIZE; 801 802 rth = nlmsg_data(nlh); 803 rth->rtgen_family = AF_UNSPEC; 804 805 if (nla_put_s32(skb, NETNSA_NSID, args->nsid)) 806 goto nla_put_failure; 807 808 if (args->add_ref && 809 nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid)) 810 goto nla_put_failure; 811 812 nlmsg_end(skb, nlh); 813 return 0; 814 815 nla_put_failure: 816 nlmsg_cancel(skb, nlh); 817 return -EMSGSIZE; 818 } 819 820 static int rtnl_net_valid_getid_req(struct sk_buff *skb, 821 const struct nlmsghdr *nlh, 822 struct nlattr **tb, 823 struct netlink_ext_ack *extack) 824 { 825 int i, err; 826 827 if (!netlink_strict_get_check(skb)) 828 return nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), 829 tb, NETNSA_MAX, rtnl_net_policy, 830 extack); 831 832 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb, 833 NETNSA_MAX, rtnl_net_policy, 834 extack); 835 if (err) 836 return err; 837 838 for (i = 0; i <= NETNSA_MAX; i++) { 839 if (!tb[i]) 840 continue; 841 842 switch (i) { 843 case NETNSA_PID: 844 case NETNSA_FD: 845 case NETNSA_NSID: 846 case NETNSA_TARGET_NSID: 847 break; 848 default: 849 NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request"); 850 return -EINVAL; 851 } 852 } 853 854 return 0; 855 } 856 857 static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh, 858 struct netlink_ext_ack *extack) 859 { 860 struct net *net = sock_net(skb->sk); 861 struct nlattr *tb[NETNSA_MAX + 1]; 862 struct net_fill_args fillargs = { 863 .portid = NETLINK_CB(skb).portid, 864 .seq = nlh->nlmsg_seq, 865 .cmd = RTM_NEWNSID, 866 }; 867 struct net *peer, *target = net; 868 struct nlattr *nla; 869 struct sk_buff *msg; 870 int err; 871 872 err = rtnl_net_valid_getid_req(skb, nlh, tb, extack); 873 if (err < 0) 874 return err; 875 if (tb[NETNSA_PID]) { 876 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID])); 877 nla = tb[NETNSA_PID]; 878 } else if (tb[NETNSA_FD]) { 879 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD])); 880 nla = tb[NETNSA_FD]; 881 } else if (tb[NETNSA_NSID]) { 882 peer = get_net_ns_by_id(net, nla_get_s32(tb[NETNSA_NSID])); 883 if (!peer) 884 peer = ERR_PTR(-ENOENT); 885 nla = tb[NETNSA_NSID]; 886 } else { 887 NL_SET_ERR_MSG(extack, "Peer netns reference is missing"); 888 return -EINVAL; 889 } 890 891 if (IS_ERR(peer)) { 892 NL_SET_BAD_ATTR(extack, nla); 893 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid"); 894 return PTR_ERR(peer); 895 } 896 897 if (tb[NETNSA_TARGET_NSID]) { 898 int id = nla_get_s32(tb[NETNSA_TARGET_NSID]); 899 900 target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id); 901 if (IS_ERR(target)) { 902 NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]); 903 NL_SET_ERR_MSG(extack, 904 "Target netns reference is invalid"); 905 err = PTR_ERR(target); 906 goto out; 907 } 908 fillargs.add_ref = true; 909 fillargs.ref_nsid = peernet2id(net, peer); 910 } 911 912 msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL); 913 if (!msg) { 914 err = -ENOMEM; 915 goto out; 916 } 917 918 fillargs.nsid = peernet2id(target, peer); 919 err = rtnl_net_fill(msg, &fillargs); 920 if (err < 0) 921 goto err_out; 922 923 err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid); 924 goto out; 925 926 err_out: 927 nlmsg_free(msg); 928 out: 929 if (fillargs.add_ref) 930 put_net(target); 931 put_net(peer); 932 return err; 933 } 934 935 struct rtnl_net_dump_cb { 936 struct net *tgt_net; 937 struct net *ref_net; 938 struct sk_buff *skb; 939 struct net_fill_args fillargs; 940 int idx; 941 int s_idx; 942 }; 943 944 static int rtnl_net_dumpid_one(int id, void *peer, void *data) 945 { 946 struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data; 947 int ret; 948 949 if (net_cb->idx < net_cb->s_idx) 950 goto cont; 951 952 net_cb->fillargs.nsid = id; 953 if (net_cb->fillargs.add_ref) 954 net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer); 955 ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs); 956 if (ret < 0) 957 return ret; 958 959 cont: 960 net_cb->idx++; 961 return 0; 962 } 963 964 static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk, 965 struct rtnl_net_dump_cb *net_cb, 966 struct netlink_callback *cb) 967 { 968 struct netlink_ext_ack *extack = cb->extack; 969 struct nlattr *tb[NETNSA_MAX + 1]; 970 int err, i; 971 972 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb, 973 NETNSA_MAX, rtnl_net_policy, 974 extack); 975 if (err < 0) 976 return err; 977 978 for (i = 0; i <= NETNSA_MAX; i++) { 979 if (!tb[i]) 980 continue; 981 982 if (i == NETNSA_TARGET_NSID) { 983 struct net *net; 984 985 net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i])); 986 if (IS_ERR(net)) { 987 NL_SET_BAD_ATTR(extack, tb[i]); 988 NL_SET_ERR_MSG(extack, 989 "Invalid target network namespace id"); 990 return PTR_ERR(net); 991 } 992 net_cb->fillargs.add_ref = true; 993 net_cb->ref_net = net_cb->tgt_net; 994 net_cb->tgt_net = net; 995 } else { 996 NL_SET_BAD_ATTR(extack, tb[i]); 997 NL_SET_ERR_MSG(extack, 998 "Unsupported attribute in dump request"); 999 return -EINVAL; 1000 } 1001 } 1002 1003 return 0; 1004 } 1005 1006 static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb) 1007 { 1008 struct rtnl_net_dump_cb net_cb = { 1009 .tgt_net = sock_net(skb->sk), 1010 .skb = skb, 1011 .fillargs = { 1012 .portid = NETLINK_CB(cb->skb).portid, 1013 .seq = cb->nlh->nlmsg_seq, 1014 .flags = NLM_F_MULTI, 1015 .cmd = RTM_NEWNSID, 1016 }, 1017 .idx = 0, 1018 .s_idx = cb->args[0], 1019 }; 1020 int err = 0; 1021 1022 if (cb->strict_check) { 1023 err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb); 1024 if (err < 0) 1025 goto end; 1026 } 1027 1028 spin_lock_bh(&net_cb.tgt_net->nsid_lock); 1029 if (net_cb.fillargs.add_ref && 1030 !net_eq(net_cb.ref_net, net_cb.tgt_net) && 1031 !spin_trylock_bh(&net_cb.ref_net->nsid_lock)) { 1032 spin_unlock_bh(&net_cb.tgt_net->nsid_lock); 1033 err = -EAGAIN; 1034 goto end; 1035 } 1036 idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb); 1037 if (net_cb.fillargs.add_ref && 1038 !net_eq(net_cb.ref_net, net_cb.tgt_net)) 1039 spin_unlock_bh(&net_cb.ref_net->nsid_lock); 1040 spin_unlock_bh(&net_cb.tgt_net->nsid_lock); 1041 1042 cb->args[0] = net_cb.idx; 1043 end: 1044 if (net_cb.fillargs.add_ref) 1045 put_net(net_cb.tgt_net); 1046 return err < 0 ? err : skb->len; 1047 } 1048 1049 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid, 1050 struct nlmsghdr *nlh, gfp_t gfp) 1051 { 1052 struct net_fill_args fillargs = { 1053 .portid = portid, 1054 .seq = nlh ? nlh->nlmsg_seq : 0, 1055 .cmd = cmd, 1056 .nsid = id, 1057 }; 1058 struct sk_buff *msg; 1059 int err = -ENOMEM; 1060 1061 msg = nlmsg_new(rtnl_net_get_size(), gfp); 1062 if (!msg) 1063 goto out; 1064 1065 err = rtnl_net_fill(msg, &fillargs); 1066 if (err < 0) 1067 goto err_out; 1068 1069 rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp); 1070 return; 1071 1072 err_out: 1073 nlmsg_free(msg); 1074 out: 1075 rtnl_set_sk_err(net, RTNLGRP_NSID, err); 1076 } 1077 1078 static int __init net_ns_init(void) 1079 { 1080 struct net_generic *ng; 1081 1082 #ifdef CONFIG_NET_NS 1083 net_cachep = kmem_cache_create("net_namespace", sizeof(struct net), 1084 SMP_CACHE_BYTES, 1085 SLAB_PANIC|SLAB_ACCOUNT, NULL); 1086 1087 /* Create workqueue for cleanup */ 1088 netns_wq = create_singlethread_workqueue("netns"); 1089 if (!netns_wq) 1090 panic("Could not create netns workq"); 1091 #endif 1092 1093 ng = net_alloc_generic(); 1094 if (!ng) 1095 panic("Could not allocate generic netns"); 1096 1097 rcu_assign_pointer(init_net.gen, ng); 1098 1099 down_write(&pernet_ops_rwsem); 1100 if (setup_net(&init_net, &init_user_ns)) 1101 panic("Could not setup the initial network namespace"); 1102 1103 init_net_initialized = true; 1104 up_write(&pernet_ops_rwsem); 1105 1106 if (register_pernet_subsys(&net_ns_ops)) 1107 panic("Could not register network namespace subsystems"); 1108 1109 rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL, 1110 RTNL_FLAG_DOIT_UNLOCKED); 1111 rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid, 1112 RTNL_FLAG_DOIT_UNLOCKED); 1113 1114 return 0; 1115 } 1116 1117 pure_initcall(net_ns_init); 1118 1119 #ifdef CONFIG_NET_NS 1120 static int __register_pernet_operations(struct list_head *list, 1121 struct pernet_operations *ops) 1122 { 1123 struct net *net; 1124 int error; 1125 LIST_HEAD(net_exit_list); 1126 1127 list_add_tail(&ops->list, list); 1128 if (ops->init || (ops->id && ops->size)) { 1129 /* We held write locked pernet_ops_rwsem, and parallel 1130 * setup_net() and cleanup_net() are not possible. 1131 */ 1132 for_each_net(net) { 1133 error = ops_init(ops, net); 1134 if (error) 1135 goto out_undo; 1136 list_add_tail(&net->exit_list, &net_exit_list); 1137 } 1138 } 1139 return 0; 1140 1141 out_undo: 1142 /* If I have an error cleanup all namespaces I initialized */ 1143 list_del(&ops->list); 1144 ops_pre_exit_list(ops, &net_exit_list); 1145 synchronize_rcu(); 1146 ops_exit_list(ops, &net_exit_list); 1147 ops_free_list(ops, &net_exit_list); 1148 return error; 1149 } 1150 1151 static void __unregister_pernet_operations(struct pernet_operations *ops) 1152 { 1153 struct net *net; 1154 LIST_HEAD(net_exit_list); 1155 1156 list_del(&ops->list); 1157 /* See comment in __register_pernet_operations() */ 1158 for_each_net(net) 1159 list_add_tail(&net->exit_list, &net_exit_list); 1160 ops_pre_exit_list(ops, &net_exit_list); 1161 synchronize_rcu(); 1162 ops_exit_list(ops, &net_exit_list); 1163 ops_free_list(ops, &net_exit_list); 1164 } 1165 1166 #else 1167 1168 static int __register_pernet_operations(struct list_head *list, 1169 struct pernet_operations *ops) 1170 { 1171 if (!init_net_initialized) { 1172 list_add_tail(&ops->list, list); 1173 return 0; 1174 } 1175 1176 return ops_init(ops, &init_net); 1177 } 1178 1179 static void __unregister_pernet_operations(struct pernet_operations *ops) 1180 { 1181 if (!init_net_initialized) { 1182 list_del(&ops->list); 1183 } else { 1184 LIST_HEAD(net_exit_list); 1185 list_add(&init_net.exit_list, &net_exit_list); 1186 ops_pre_exit_list(ops, &net_exit_list); 1187 synchronize_rcu(); 1188 ops_exit_list(ops, &net_exit_list); 1189 ops_free_list(ops, &net_exit_list); 1190 } 1191 } 1192 1193 #endif /* CONFIG_NET_NS */ 1194 1195 static DEFINE_IDA(net_generic_ids); 1196 1197 static int register_pernet_operations(struct list_head *list, 1198 struct pernet_operations *ops) 1199 { 1200 int error; 1201 1202 if (ops->id) { 1203 error = ida_alloc_min(&net_generic_ids, MIN_PERNET_OPS_ID, 1204 GFP_KERNEL); 1205 if (error < 0) 1206 return error; 1207 *ops->id = error; 1208 max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1); 1209 } 1210 error = __register_pernet_operations(list, ops); 1211 if (error) { 1212 rcu_barrier(); 1213 if (ops->id) 1214 ida_free(&net_generic_ids, *ops->id); 1215 } 1216 1217 return error; 1218 } 1219 1220 static void unregister_pernet_operations(struct pernet_operations *ops) 1221 { 1222 __unregister_pernet_operations(ops); 1223 rcu_barrier(); 1224 if (ops->id) 1225 ida_free(&net_generic_ids, *ops->id); 1226 } 1227 1228 /** 1229 * register_pernet_subsys - register a network namespace subsystem 1230 * @ops: pernet operations structure for the subsystem 1231 * 1232 * Register a subsystem which has init and exit functions 1233 * that are called when network namespaces are created and 1234 * destroyed respectively. 1235 * 1236 * When registered all network namespace init functions are 1237 * called for every existing network namespace. Allowing kernel 1238 * modules to have a race free view of the set of network namespaces. 1239 * 1240 * When a new network namespace is created all of the init 1241 * methods are called in the order in which they were registered. 1242 * 1243 * When a network namespace is destroyed all of the exit methods 1244 * are called in the reverse of the order with which they were 1245 * registered. 1246 */ 1247 int register_pernet_subsys(struct pernet_operations *ops) 1248 { 1249 int error; 1250 down_write(&pernet_ops_rwsem); 1251 error = register_pernet_operations(first_device, ops); 1252 up_write(&pernet_ops_rwsem); 1253 return error; 1254 } 1255 EXPORT_SYMBOL_GPL(register_pernet_subsys); 1256 1257 /** 1258 * unregister_pernet_subsys - unregister a network namespace subsystem 1259 * @ops: pernet operations structure to manipulate 1260 * 1261 * Remove the pernet operations structure from the list to be 1262 * used when network namespaces are created or destroyed. In 1263 * addition run the exit method for all existing network 1264 * namespaces. 1265 */ 1266 void unregister_pernet_subsys(struct pernet_operations *ops) 1267 { 1268 down_write(&pernet_ops_rwsem); 1269 unregister_pernet_operations(ops); 1270 up_write(&pernet_ops_rwsem); 1271 } 1272 EXPORT_SYMBOL_GPL(unregister_pernet_subsys); 1273 1274 /** 1275 * register_pernet_device - register a network namespace device 1276 * @ops: pernet operations structure for the subsystem 1277 * 1278 * Register a device which has init and exit functions 1279 * that are called when network namespaces are created and 1280 * destroyed respectively. 1281 * 1282 * When registered all network namespace init functions are 1283 * called for every existing network namespace. Allowing kernel 1284 * modules to have a race free view of the set of network namespaces. 1285 * 1286 * When a new network namespace is created all of the init 1287 * methods are called in the order in which they were registered. 1288 * 1289 * When a network namespace is destroyed all of the exit methods 1290 * are called in the reverse of the order with which they were 1291 * registered. 1292 */ 1293 int register_pernet_device(struct pernet_operations *ops) 1294 { 1295 int error; 1296 down_write(&pernet_ops_rwsem); 1297 error = register_pernet_operations(&pernet_list, ops); 1298 if (!error && (first_device == &pernet_list)) 1299 first_device = &ops->list; 1300 up_write(&pernet_ops_rwsem); 1301 return error; 1302 } 1303 EXPORT_SYMBOL_GPL(register_pernet_device); 1304 1305 /** 1306 * unregister_pernet_device - unregister a network namespace netdevice 1307 * @ops: pernet operations structure to manipulate 1308 * 1309 * Remove the pernet operations structure from the list to be 1310 * used when network namespaces are created or destroyed. In 1311 * addition run the exit method for all existing network 1312 * namespaces. 1313 */ 1314 void unregister_pernet_device(struct pernet_operations *ops) 1315 { 1316 down_write(&pernet_ops_rwsem); 1317 if (&ops->list == first_device) 1318 first_device = first_device->next; 1319 unregister_pernet_operations(ops); 1320 up_write(&pernet_ops_rwsem); 1321 } 1322 EXPORT_SYMBOL_GPL(unregister_pernet_device); 1323 1324 #ifdef CONFIG_NET_NS 1325 static struct ns_common *netns_get(struct task_struct *task) 1326 { 1327 struct net *net = NULL; 1328 struct nsproxy *nsproxy; 1329 1330 task_lock(task); 1331 nsproxy = task->nsproxy; 1332 if (nsproxy) 1333 net = get_net(nsproxy->net_ns); 1334 task_unlock(task); 1335 1336 return net ? &net->ns : NULL; 1337 } 1338 1339 static inline struct net *to_net_ns(struct ns_common *ns) 1340 { 1341 return container_of(ns, struct net, ns); 1342 } 1343 1344 static void netns_put(struct ns_common *ns) 1345 { 1346 put_net(to_net_ns(ns)); 1347 } 1348 1349 static int netns_install(struct nsproxy *nsproxy, struct ns_common *ns) 1350 { 1351 struct net *net = to_net_ns(ns); 1352 1353 if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) || 1354 !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) 1355 return -EPERM; 1356 1357 put_net(nsproxy->net_ns); 1358 nsproxy->net_ns = get_net(net); 1359 return 0; 1360 } 1361 1362 static struct user_namespace *netns_owner(struct ns_common *ns) 1363 { 1364 return to_net_ns(ns)->user_ns; 1365 } 1366 1367 const struct proc_ns_operations netns_operations = { 1368 .name = "net", 1369 .type = CLONE_NEWNET, 1370 .get = netns_get, 1371 .put = netns_put, 1372 .install = netns_install, 1373 .owner = netns_owner, 1374 }; 1375 #endif 1376