| 1 | // SPDX-License-Identifier: GPL-2.0 |
| 2 | #include <linux/mount.h> |
| 3 | #include <linux/pseudo_fs.h> |
| 4 | #include <linux/file.h> |
| 5 | #include <linux/fs.h> |
| 6 | #include <linux/proc_fs.h> |
| 7 | #include <linux/proc_ns.h> |
| 8 | #include <linux/magic.h> |
| 9 | #include <linux/ktime.h> |
| 10 | #include <linux/seq_file.h> |
| 11 | #include <linux/user_namespace.h> |
| 12 | #include <linux/nsfs.h> |
| 13 | #include <linux/uaccess.h> |
| 14 | |
| 15 | #include "internal.h" |
| 16 | |
| 17 | static struct vfsmount *nsfs_mnt; |
| 18 | |
| 19 | static long ns_ioctl(struct file *filp, unsigned int ioctl, |
| 20 | unsigned long arg); |
| 21 | static const struct file_operations ns_file_operations = { |
| 22 | .llseek = no_llseek, |
| 23 | .unlocked_ioctl = ns_ioctl, |
| 24 | .compat_ioctl = compat_ptr_ioctl, |
| 25 | }; |
| 26 | |
| 27 | static char *ns_dname(struct dentry *dentry, char *buffer, int buflen) |
| 28 | { |
| 29 | struct inode *inode = d_inode(dentry); |
| 30 | const struct proc_ns_operations *ns_ops = dentry->d_fsdata; |
| 31 | |
| 32 | return dynamic_dname(buffer, buflen, "%s:[%lu]", |
| 33 | ns_ops->name, inode->i_ino); |
| 34 | } |
| 35 | |
| 36 | static void ns_prune_dentry(struct dentry *dentry) |
| 37 | { |
| 38 | struct inode *inode = d_inode(dentry); |
| 39 | if (inode) { |
| 40 | struct ns_common *ns = inode->i_private; |
| 41 | atomic_long_set(&ns->stashed, 0); |
| 42 | } |
| 43 | } |
| 44 | |
| 45 | const struct dentry_operations ns_dentry_operations = |
| 46 | { |
| 47 | .d_prune = ns_prune_dentry, |
| 48 | .d_delete = always_delete_dentry, |
| 49 | .d_dname = ns_dname, |
| 50 | }; |
| 51 | |
| 52 | static void nsfs_evict(struct inode *inode) |
| 53 | { |
| 54 | struct ns_common *ns = inode->i_private; |
| 55 | clear_inode(inode); |
| 56 | ns->ops->put(ns); |
| 57 | } |
| 58 | |
| 59 | static int __ns_get_path(struct path *path, struct ns_common *ns) |
| 60 | { |
| 61 | struct vfsmount *mnt = nsfs_mnt; |
| 62 | struct dentry *dentry; |
| 63 | struct inode *inode; |
| 64 | unsigned long d; |
| 65 | |
| 66 | rcu_read_lock(); |
| 67 | d = atomic_long_read(&ns->stashed); |
| 68 | if (!d) |
| 69 | goto slow; |
| 70 | dentry = (struct dentry *)d; |
| 71 | if (!lockref_get_not_dead(&dentry->d_lockref)) |
| 72 | goto slow; |
| 73 | rcu_read_unlock(); |
| 74 | ns->ops->put(ns); |
| 75 | got_it: |
| 76 | path->mnt = mntget(mnt); |
| 77 | path->dentry = dentry; |
| 78 | return 0; |
| 79 | slow: |
| 80 | rcu_read_unlock(); |
| 81 | inode = new_inode_pseudo(mnt->mnt_sb); |
| 82 | if (!inode) { |
| 83 | ns->ops->put(ns); |
| 84 | return -ENOMEM; |
| 85 | } |
| 86 | inode->i_ino = ns->inum; |
| 87 | simple_inode_init_ts(inode); |
| 88 | inode->i_flags |= S_IMMUTABLE; |
| 89 | inode->i_mode = S_IFREG | S_IRUGO; |
| 90 | inode->i_fop = &ns_file_operations; |
| 91 | inode->i_private = ns; |
| 92 | |
| 93 | dentry = d_make_root(inode); /* not the normal use, but... */ |
| 94 | if (!dentry) |
| 95 | return -ENOMEM; |
| 96 | dentry->d_fsdata = (void *)ns->ops; |
| 97 | d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry); |
| 98 | if (d) { |
| 99 | d_delete(dentry); /* make sure ->d_prune() does nothing */ |
| 100 | dput(dentry); |
| 101 | cpu_relax(); |
| 102 | return -EAGAIN; |
| 103 | } |
| 104 | goto got_it; |
| 105 | } |
| 106 | |
| 107 | int ns_get_path_cb(struct path *path, ns_get_path_helper_t *ns_get_cb, |
| 108 | void *private_data) |
| 109 | { |
| 110 | int ret; |
| 111 | |
| 112 | do { |
| 113 | struct ns_common *ns = ns_get_cb(private_data); |
| 114 | if (!ns) |
| 115 | return -ENOENT; |
| 116 | ret = __ns_get_path(path, ns); |
| 117 | } while (ret == -EAGAIN); |
| 118 | |
| 119 | return ret; |
| 120 | } |
| 121 | |
| 122 | struct ns_get_path_task_args { |
| 123 | const struct proc_ns_operations *ns_ops; |
| 124 | struct task_struct *task; |
| 125 | }; |
| 126 | |
| 127 | static struct ns_common *ns_get_path_task(void *private_data) |
| 128 | { |
| 129 | struct ns_get_path_task_args *args = private_data; |
| 130 | |
| 131 | return args->ns_ops->get(args->task); |
| 132 | } |
| 133 | |
| 134 | int ns_get_path(struct path *path, struct task_struct *task, |
| 135 | const struct proc_ns_operations *ns_ops) |
| 136 | { |
| 137 | struct ns_get_path_task_args args = { |
| 138 | .ns_ops = ns_ops, |
| 139 | .task = task, |
| 140 | }; |
| 141 | |
| 142 | return ns_get_path_cb(path, ns_get_path_task, &args); |
| 143 | } |
| 144 | |
| 145 | int open_related_ns(struct ns_common *ns, |
| 146 | struct ns_common *(*get_ns)(struct ns_common *ns)) |
| 147 | { |
| 148 | struct path path = {}; |
| 149 | struct file *f; |
| 150 | int err; |
| 151 | int fd; |
| 152 | |
| 153 | fd = get_unused_fd_flags(O_CLOEXEC); |
| 154 | if (fd < 0) |
| 155 | return fd; |
| 156 | |
| 157 | do { |
| 158 | struct ns_common *relative; |
| 159 | |
| 160 | relative = get_ns(ns); |
| 161 | if (IS_ERR(relative)) { |
| 162 | put_unused_fd(fd); |
| 163 | return PTR_ERR(relative); |
| 164 | } |
| 165 | |
| 166 | err = __ns_get_path(&path, relative); |
| 167 | } while (err == -EAGAIN); |
| 168 | |
| 169 | if (err) { |
| 170 | put_unused_fd(fd); |
| 171 | return err; |
| 172 | } |
| 173 | |
| 174 | f = dentry_open(&path, O_RDONLY, current_cred()); |
| 175 | path_put(&path); |
| 176 | if (IS_ERR(f)) { |
| 177 | put_unused_fd(fd); |
| 178 | fd = PTR_ERR(f); |
| 179 | } else |
| 180 | fd_install(fd, f); |
| 181 | |
| 182 | return fd; |
| 183 | } |
| 184 | EXPORT_SYMBOL_GPL(open_related_ns); |
| 185 | |
| 186 | static long ns_ioctl(struct file *filp, unsigned int ioctl, |
| 187 | unsigned long arg) |
| 188 | { |
| 189 | struct user_namespace *user_ns; |
| 190 | struct ns_common *ns = get_proc_ns(file_inode(filp)); |
| 191 | uid_t __user *argp; |
| 192 | uid_t uid; |
| 193 | |
| 194 | switch (ioctl) { |
| 195 | case NS_GET_USERNS: |
| 196 | return open_related_ns(ns, ns_get_owner); |
| 197 | case NS_GET_PARENT: |
| 198 | if (!ns->ops->get_parent) |
| 199 | return -EINVAL; |
| 200 | return open_related_ns(ns, ns->ops->get_parent); |
| 201 | case NS_GET_NSTYPE: |
| 202 | return ns->ops->type; |
| 203 | case NS_GET_OWNER_UID: |
| 204 | if (ns->ops->type != CLONE_NEWUSER) |
| 205 | return -EINVAL; |
| 206 | user_ns = container_of(ns, struct user_namespace, ns); |
| 207 | argp = (uid_t __user *) arg; |
| 208 | uid = from_kuid_munged(current_user_ns(), user_ns->owner); |
| 209 | return put_user(uid, argp); |
| 210 | default: |
| 211 | return -ENOTTY; |
| 212 | } |
| 213 | } |
| 214 | |
| 215 | int ns_get_name(char *buf, size_t size, struct task_struct *task, |
| 216 | const struct proc_ns_operations *ns_ops) |
| 217 | { |
| 218 | struct ns_common *ns; |
| 219 | int res = -ENOENT; |
| 220 | const char *name; |
| 221 | ns = ns_ops->get(task); |
| 222 | if (ns) { |
| 223 | name = ns_ops->real_ns_name ? : ns_ops->name; |
| 224 | res = snprintf(buf, size, "%s:[%u]", name, ns->inum); |
| 225 | ns_ops->put(ns); |
| 226 | } |
| 227 | return res; |
| 228 | } |
| 229 | |
| 230 | bool proc_ns_file(const struct file *file) |
| 231 | { |
| 232 | return file->f_op == &ns_file_operations; |
| 233 | } |
| 234 | |
| 235 | /** |
| 236 | * ns_match() - Returns true if current namespace matches dev/ino provided. |
| 237 | * @ns: current namespace |
| 238 | * @dev: dev_t from nsfs that will be matched against current nsfs |
| 239 | * @ino: ino_t from nsfs that will be matched against current nsfs |
| 240 | * |
| 241 | * Return: true if dev and ino matches the current nsfs. |
| 242 | */ |
| 243 | bool ns_match(const struct ns_common *ns, dev_t dev, ino_t ino) |
| 244 | { |
| 245 | return (ns->inum == ino) && (nsfs_mnt->mnt_sb->s_dev == dev); |
| 246 | } |
| 247 | |
| 248 | |
| 249 | static int nsfs_show_path(struct seq_file *seq, struct dentry *dentry) |
| 250 | { |
| 251 | struct inode *inode = d_inode(dentry); |
| 252 | const struct proc_ns_operations *ns_ops = dentry->d_fsdata; |
| 253 | |
| 254 | seq_printf(seq, "%s:[%lu]", ns_ops->name, inode->i_ino); |
| 255 | return 0; |
| 256 | } |
| 257 | |
| 258 | static const struct super_operations nsfs_ops = { |
| 259 | .statfs = simple_statfs, |
| 260 | .evict_inode = nsfs_evict, |
| 261 | .show_path = nsfs_show_path, |
| 262 | }; |
| 263 | |
| 264 | static int nsfs_init_fs_context(struct fs_context *fc) |
| 265 | { |
| 266 | struct pseudo_fs_context *ctx = init_pseudo(fc, NSFS_MAGIC); |
| 267 | if (!ctx) |
| 268 | return -ENOMEM; |
| 269 | ctx->ops = &nsfs_ops; |
| 270 | ctx->dops = &ns_dentry_operations; |
| 271 | return 0; |
| 272 | } |
| 273 | |
| 274 | static struct file_system_type nsfs = { |
| 275 | .name = "nsfs", |
| 276 | .init_fs_context = nsfs_init_fs_context, |
| 277 | .kill_sb = kill_anon_super, |
| 278 | }; |
| 279 | |
| 280 | void __init nsfs_init(void) |
| 281 | { |
| 282 | nsfs_mnt = kern_mount(&nsfs); |
| 283 | if (IS_ERR(nsfs_mnt)) |
| 284 | panic("can't set nsfs up\n"); |
| 285 | nsfs_mnt->mnt_sb->s_flags &= ~SB_NOUSER; |
| 286 | } |