util.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * linux/ipc/util.c
  4. * Copyright (C) 1992 Krishna Balasubramanian
  5. *
  6. * Sep 1997 - Call suser() last after "normal" permission checks so we
  7. * get BSD style process accounting right.
  8. * Occurs in several places in the IPC code.
  9. * Chris Evans, <chris@ferret.lmh.ox.ac.uk>
  10. * Nov 1999 - ipc helper functions, unified SMP locking
  11. * Manfred Spraul <manfred@colorfullife.com>
  12. * Oct 2002 - One lock per IPC id. RCU ipc_free for lock-free grow_ary().
  13. * Mingming Cao <cmm@us.ibm.com>
  14. * Mar 2006 - support for audit of ipc object properties
  15. * Dustin Kirkland <dustin.kirkland@us.ibm.com>
  16. * Jun 2006 - namespaces ssupport
  17. * OpenVZ, SWsoft Inc.
  18. * Pavel Emelianov <xemul@openvz.org>
  19. *
  20. * General sysv ipc locking scheme:
  21. * rcu_read_lock()
  22. * obtain the ipc object (kern_ipc_perm) by looking up the id in an idr
  23. * tree.
  24. * - perform initial checks (capabilities, auditing and permission,
  25. * etc).
  26. * - perform read-only operations, such as INFO command, that
  27. * do not demand atomicity
  28. * acquire the ipc lock (kern_ipc_perm.lock) through
  29. * ipc_lock_object()
  30. * - perform read-only operations that demand atomicity,
  31. * such as STAT command.
  32. * - perform data updates, such as SET, RMID commands and
  33. * mechanism-specific operations (semop/semtimedop,
  34. * msgsnd/msgrcv, shmat/shmdt).
  35. * drop the ipc lock, through ipc_unlock_object().
  36. * rcu_read_unlock()
  37. *
  38. * The ids->rwsem must be taken when:
  39. * - creating, removing and iterating the existing entries in ipc
  40. * identifier sets.
  41. * - iterating through files under /proc/sysvipc/
  42. *
  43. * Note that sems have a special fast path that avoids kern_ipc_perm.lock -
  44. * see sem_lock().
  45. */
  46. #include <linux/mm.h>
  47. #include <linux/shm.h>
  48. #include <linux/init.h>
  49. #include <linux/msg.h>
  50. #include <linux/vmalloc.h>
  51. #include <linux/slab.h>
  52. #include <linux/notifier.h>
  53. #include <linux/capability.h>
  54. #include <linux/highuid.h>
  55. #include <linux/security.h>
  56. #include <linux/rcupdate.h>
  57. #include <linux/workqueue.h>
  58. #include <linux/seq_file.h>
  59. #include <linux/proc_fs.h>
  60. #include <linux/audit.h>
  61. #include <linux/nsproxy.h>
  62. #include <linux/rwsem.h>
  63. #include <linux/memory.h>
  64. #include <linux/ipc_namespace.h>
  65. #include <linux/rhashtable.h>
  66. #include <asm/unistd.h>
  67. #include "util.h"
  68. struct ipc_proc_iface {
  69. const char *path;
  70. const char *header;
  71. int ids;
  72. int (*show)(struct seq_file *, void *);
  73. };
  74. /**
  75. * ipc_init - initialise ipc subsystem
  76. *
  77. * The various sysv ipc resources (semaphores, messages and shared
  78. * memory) are initialised.
  79. *
  80. * A callback routine is registered into the memory hotplug notifier
  81. * chain: since msgmni scales to lowmem this callback routine will be
  82. * called upon successful memory add / remove to recompute msmgni.
  83. */
  84. static int __init ipc_init(void)
  85. {
  86. proc_mkdir("sysvipc", NULL);
  87. sem_init();
  88. msg_init();
  89. shm_init();
  90. return 0;
  91. }
  92. device_initcall(ipc_init);
  93. static const struct rhashtable_params ipc_kht_params = {
  94. .head_offset = offsetof(struct kern_ipc_perm, khtnode),
  95. .key_offset = offsetof(struct kern_ipc_perm, key),
  96. .key_len = sizeof_field(struct kern_ipc_perm, key),
  97. .automatic_shrinking = true,
  98. };
  99. /**
  100. * ipc_init_ids - initialise ipc identifiers
  101. * @ids: ipc identifier set
  102. *
  103. * Set up the sequence range to use for the ipc identifier range (limited
  104. * below ipc_mni) then initialise the keys hashtable and ids idr.
  105. */
  106. void ipc_init_ids(struct ipc_ids *ids)
  107. {
  108. ids->in_use = 0;
  109. ids->seq = 0;
  110. init_rwsem(&ids->rwsem);
  111. rhashtable_init(&ids->key_ht, &ipc_kht_params);
  112. idr_init(&ids->ipcs_idr);
  113. ids->max_idx = -1;
  114. ids->last_idx = -1;
  115. #ifdef CONFIG_CHECKPOINT_RESTORE
  116. ids->next_id = -1;
  117. #endif
  118. }
  119. #ifdef CONFIG_PROC_FS
  120. static const struct proc_ops sysvipc_proc_ops;
  121. /**
  122. * ipc_init_proc_interface - create a proc interface for sysipc types using a seq_file interface.
  123. * @path: Path in procfs
  124. * @header: Banner to be printed at the beginning of the file.
  125. * @ids: ipc id table to iterate.
  126. * @show: show routine.
  127. */
  128. void __init ipc_init_proc_interface(const char *path, const char *header,
  129. int ids, int (*show)(struct seq_file *, void *))
  130. {
  131. struct proc_dir_entry *pde;
  132. struct ipc_proc_iface *iface;
  133. iface = kmalloc(sizeof(*iface), GFP_KERNEL);
  134. if (!iface)
  135. return;
  136. iface->path = path;
  137. iface->header = header;
  138. iface->ids = ids;
  139. iface->show = show;
  140. pde = proc_create_data(path,
  141. S_IRUGO, /* world readable */
  142. NULL, /* parent dir */
  143. &sysvipc_proc_ops,
  144. iface);
  145. if (!pde)
  146. kfree(iface);
  147. }
  148. #endif
  149. /**
  150. * ipc_findkey - find a key in an ipc identifier set
  151. * @ids: ipc identifier set
  152. * @key: key to find
  153. *
  154. * Returns the locked pointer to the ipc structure if found or NULL
  155. * otherwise. If key is found ipc points to the owning ipc structure
  156. *
  157. * Called with writer ipc_ids.rwsem held.
  158. */
  159. static struct kern_ipc_perm *ipc_findkey(struct ipc_ids *ids, key_t key)
  160. {
  161. struct kern_ipc_perm *ipcp;
  162. ipcp = rhashtable_lookup_fast(&ids->key_ht, &key,
  163. ipc_kht_params);
  164. if (!ipcp)
  165. return NULL;
  166. rcu_read_lock();
  167. ipc_lock_object(ipcp);
  168. return ipcp;
  169. }
  170. /*
  171. * Insert new IPC object into idr tree, and set sequence number and id
  172. * in the correct order.
  173. * Especially:
  174. * - the sequence number must be set before inserting the object into the idr,
  175. * because the sequence number is accessed without a lock.
  176. * - the id can/must be set after inserting the object into the idr.
  177. * All accesses must be done after getting kern_ipc_perm.lock.
  178. *
  179. * The caller must own kern_ipc_perm.lock.of the new object.
  180. * On error, the function returns a (negative) error code.
  181. *
  182. * To conserve sequence number space, especially with extended ipc_mni,
  183. * the sequence number is incremented only when the returned ID is less than
  184. * the last one.
  185. */
  186. static inline int ipc_idr_alloc(struct ipc_ids *ids, struct kern_ipc_perm *new)
  187. {
  188. int idx, next_id = -1;
  189. #ifdef CONFIG_CHECKPOINT_RESTORE
  190. next_id = ids->next_id;
  191. ids->next_id = -1;
  192. #endif
  193. /*
  194. * As soon as a new object is inserted into the idr,
  195. * ipc_obtain_object_idr() or ipc_obtain_object_check() can find it,
  196. * and the lockless preparations for ipc operations can start.
  197. * This means especially: permission checks, audit calls, allocation
  198. * of undo structures, ...
  199. *
  200. * Thus the object must be fully initialized, and if something fails,
  201. * then the full tear-down sequence must be followed.
  202. * (i.e.: set new->deleted, reduce refcount, call_rcu())
  203. */
  204. if (next_id < 0) { /* !CHECKPOINT_RESTORE or next_id is unset */
  205. int max_idx;
  206. max_idx = max(ids->in_use*3/2, ipc_min_cycle);
  207. max_idx = min(max_idx, ipc_mni);
  208. /* allocate the idx, with a NULL struct kern_ipc_perm */
  209. idx = idr_alloc_cyclic(&ids->ipcs_idr, NULL, 0, max_idx,
  210. GFP_NOWAIT);
  211. if (idx >= 0) {
  212. /*
  213. * idx got allocated successfully.
  214. * Now calculate the sequence number and set the
  215. * pointer for real.
  216. */
  217. if (idx <= ids->last_idx) {
  218. ids->seq++;
  219. if (ids->seq >= ipcid_seq_max())
  220. ids->seq = 0;
  221. }
  222. ids->last_idx = idx;
  223. new->seq = ids->seq;
  224. /* no need for smp_wmb(), this is done
  225. * inside idr_replace, as part of
  226. * rcu_assign_pointer
  227. */
  228. idr_replace(&ids->ipcs_idr, new, idx);
  229. }
  230. } else {
  231. new->seq = ipcid_to_seqx(next_id);
  232. idx = idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id),
  233. 0, GFP_NOWAIT);
  234. }
  235. if (idx >= 0)
  236. new->id = (new->seq << ipcmni_seq_shift()) + idx;
  237. return idx;
  238. }
  239. /**
  240. * ipc_addid - add an ipc identifier
  241. * @ids: ipc identifier set
  242. * @new: new ipc permission set
  243. * @limit: limit for the number of used ids
  244. *
  245. * Add an entry 'new' to the ipc ids idr. The permissions object is
  246. * initialised and the first free entry is set up and the index assigned
  247. * is returned. The 'new' entry is returned in a locked state on success.
  248. *
  249. * On failure the entry is not locked and a negative err-code is returned.
  250. * The caller must use ipc_rcu_putref() to free the identifier.
  251. *
  252. * Called with writer ipc_ids.rwsem held.
  253. */
  254. int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int limit)
  255. {
  256. kuid_t euid;
  257. kgid_t egid;
  258. int idx, err;
  259. /* 1) Initialize the refcount so that ipc_rcu_putref works */
  260. refcount_set(&new->refcount, 1);
  261. if (limit > ipc_mni)
  262. limit = ipc_mni;
  263. if (ids->in_use >= limit)
  264. return -ENOSPC;
  265. idr_preload(GFP_KERNEL);
  266. spin_lock_init(&new->lock);
  267. rcu_read_lock();
  268. spin_lock(&new->lock);
  269. current_euid_egid(&euid, &egid);
  270. new->cuid = new->uid = euid;
  271. new->gid = new->cgid = egid;
  272. new->deleted = false;
  273. idx = ipc_idr_alloc(ids, new);
  274. idr_preload_end();
  275. if (idx >= 0 && new->key != IPC_PRIVATE) {
  276. err = rhashtable_insert_fast(&ids->key_ht, &new->khtnode,
  277. ipc_kht_params);
  278. if (err < 0) {
  279. idr_remove(&ids->ipcs_idr, idx);
  280. idx = err;
  281. }
  282. }
  283. if (idx < 0) {
  284. new->deleted = true;
  285. spin_unlock(&new->lock);
  286. rcu_read_unlock();
  287. return idx;
  288. }
  289. ids->in_use++;
  290. if (idx > ids->max_idx)
  291. ids->max_idx = idx;
  292. return idx;
  293. }
  294. /**
  295. * ipcget_new - create a new ipc object
  296. * @ns: ipc namespace
  297. * @ids: ipc identifier set
  298. * @ops: the actual creation routine to call
  299. * @params: its parameters
  300. *
  301. * This routine is called by sys_msgget, sys_semget() and sys_shmget()
  302. * when the key is IPC_PRIVATE.
  303. */
  304. static int ipcget_new(struct ipc_namespace *ns, struct ipc_ids *ids,
  305. const struct ipc_ops *ops, struct ipc_params *params)
  306. {
  307. int err;
  308. down_write(&ids->rwsem);
  309. err = ops->getnew(ns, params);
  310. up_write(&ids->rwsem);
  311. return err;
  312. }
  313. /**
  314. * ipc_check_perms - check security and permissions for an ipc object
  315. * @ns: ipc namespace
  316. * @ipcp: ipc permission set
  317. * @ops: the actual security routine to call
  318. * @params: its parameters
  319. *
  320. * This routine is called by sys_msgget(), sys_semget() and sys_shmget()
  321. * when the key is not IPC_PRIVATE and that key already exists in the
  322. * ds IDR.
  323. *
  324. * On success, the ipc id is returned.
  325. *
  326. * It is called with ipc_ids.rwsem and ipcp->lock held.
  327. */
  328. static int ipc_check_perms(struct ipc_namespace *ns,
  329. struct kern_ipc_perm *ipcp,
  330. const struct ipc_ops *ops,
  331. struct ipc_params *params)
  332. {
  333. int err;
  334. if (ipcperms(ns, ipcp, params->flg))
  335. err = -EACCES;
  336. else {
  337. err = ops->associate(ipcp, params->flg);
  338. if (!err)
  339. err = ipcp->id;
  340. }
  341. return err;
  342. }
  343. /**
  344. * ipcget_public - get an ipc object or create a new one
  345. * @ns: ipc namespace
  346. * @ids: ipc identifier set
  347. * @ops: the actual creation routine to call
  348. * @params: its parameters
  349. *
  350. * This routine is called by sys_msgget, sys_semget() and sys_shmget()
  351. * when the key is not IPC_PRIVATE.
  352. * It adds a new entry if the key is not found and does some permission
  353. * / security checkings if the key is found.
  354. *
  355. * On success, the ipc id is returned.
  356. */
  357. static int ipcget_public(struct ipc_namespace *ns, struct ipc_ids *ids,
  358. const struct ipc_ops *ops, struct ipc_params *params)
  359. {
  360. struct kern_ipc_perm *ipcp;
  361. int flg = params->flg;
  362. int err;
  363. /*
  364. * Take the lock as a writer since we are potentially going to add
  365. * a new entry + read locks are not "upgradable"
  366. */
  367. down_write(&ids->rwsem);
  368. ipcp = ipc_findkey(ids, params->key);
  369. if (ipcp == NULL) {
  370. /* key not used */
  371. if (!(flg & IPC_CREAT))
  372. err = -ENOENT;
  373. else
  374. err = ops->getnew(ns, params);
  375. } else {
  376. /* ipc object has been locked by ipc_findkey() */
  377. if (flg & IPC_CREAT && flg & IPC_EXCL)
  378. err = -EEXIST;
  379. else {
  380. err = 0;
  381. if (ops->more_checks)
  382. err = ops->more_checks(ipcp, params);
  383. if (!err)
  384. /*
  385. * ipc_check_perms returns the IPC id on
  386. * success
  387. */
  388. err = ipc_check_perms(ns, ipcp, ops, params);
  389. }
  390. ipc_unlock(ipcp);
  391. }
  392. up_write(&ids->rwsem);
  393. return err;
  394. }
  395. /**
  396. * ipc_kht_remove - remove an ipc from the key hashtable
  397. * @ids: ipc identifier set
  398. * @ipcp: ipc perm structure containing the key to remove
  399. *
  400. * ipc_ids.rwsem (as a writer) and the spinlock for this ID are held
  401. * before this function is called, and remain locked on the exit.
  402. */
  403. static void ipc_kht_remove(struct ipc_ids *ids, struct kern_ipc_perm *ipcp)
  404. {
  405. if (ipcp->key != IPC_PRIVATE)
  406. WARN_ON_ONCE(rhashtable_remove_fast(&ids->key_ht, &ipcp->khtnode,
  407. ipc_kht_params));
  408. }
  409. /**
  410. * ipc_rmid - remove an ipc identifier
  411. * @ids: ipc identifier set
  412. * @ipcp: ipc perm structure containing the identifier to remove
  413. *
  414. * ipc_ids.rwsem (as a writer) and the spinlock for this ID are held
  415. * before this function is called, and remain locked on the exit.
  416. */
  417. void ipc_rmid(struct ipc_ids *ids, struct kern_ipc_perm *ipcp)
  418. {
  419. int idx = ipcid_to_idx(ipcp->id);
  420. WARN_ON_ONCE(idr_remove(&ids->ipcs_idr, idx) != ipcp);
  421. ipc_kht_remove(ids, ipcp);
  422. ids->in_use--;
  423. ipcp->deleted = true;
  424. if (unlikely(idx == ids->max_idx)) {
  425. do {
  426. idx--;
  427. if (idx == -1)
  428. break;
  429. } while (!idr_find(&ids->ipcs_idr, idx));
  430. ids->max_idx = idx;
  431. }
  432. }
  433. /**
  434. * ipc_set_key_private - switch the key of an existing ipc to IPC_PRIVATE
  435. * @ids: ipc identifier set
  436. * @ipcp: ipc perm structure containing the key to modify
  437. *
  438. * ipc_ids.rwsem (as a writer) and the spinlock for this ID are held
  439. * before this function is called, and remain locked on the exit.
  440. */
  441. void ipc_set_key_private(struct ipc_ids *ids, struct kern_ipc_perm *ipcp)
  442. {
  443. ipc_kht_remove(ids, ipcp);
  444. ipcp->key = IPC_PRIVATE;
  445. }
  446. bool ipc_rcu_getref(struct kern_ipc_perm *ptr)
  447. {
  448. return refcount_inc_not_zero(&ptr->refcount);
  449. }
  450. void ipc_rcu_putref(struct kern_ipc_perm *ptr,
  451. void (*func)(struct rcu_head *head))
  452. {
  453. if (!refcount_dec_and_test(&ptr->refcount))
  454. return;
  455. call_rcu(&ptr->rcu, func);
  456. }
  457. /**
  458. * ipcperms - check ipc permissions
  459. * @ns: ipc namespace
  460. * @ipcp: ipc permission set
  461. * @flag: desired permission set
  462. *
  463. * Check user, group, other permissions for access
  464. * to ipc resources. return 0 if allowed
  465. *
  466. * @flag will most probably be 0 or ``S_...UGO`` from <linux/stat.h>
  467. */
  468. int ipcperms(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp, short flag)
  469. {
  470. kuid_t euid = current_euid();
  471. int requested_mode, granted_mode;
  472. audit_ipc_obj(ipcp);
  473. requested_mode = (flag >> 6) | (flag >> 3) | flag;
  474. granted_mode = ipcp->mode;
  475. if (uid_eq(euid, ipcp->cuid) ||
  476. uid_eq(euid, ipcp->uid))
  477. granted_mode >>= 6;
  478. else if (in_group_p(ipcp->cgid) || in_group_p(ipcp->gid))
  479. granted_mode >>= 3;
  480. /* is there some bit set in requested_mode but not in granted_mode? */
  481. if ((requested_mode & ~granted_mode & 0007) &&
  482. !ns_capable(ns->user_ns, CAP_IPC_OWNER))
  483. return -1;
  484. return security_ipc_permission(ipcp, flag);
  485. }
  486. /*
  487. * Functions to convert between the kern_ipc_perm structure and the
  488. * old/new ipc_perm structures
  489. */
  490. /**
  491. * kernel_to_ipc64_perm - convert kernel ipc permissions to user
  492. * @in: kernel permissions
  493. * @out: new style ipc permissions
  494. *
  495. * Turn the kernel object @in into a set of permissions descriptions
  496. * for returning to userspace (@out).
  497. */
  498. void kernel_to_ipc64_perm(struct kern_ipc_perm *in, struct ipc64_perm *out)
  499. {
  500. out->key = in->key;
  501. out->uid = from_kuid_munged(current_user_ns(), in->uid);
  502. out->gid = from_kgid_munged(current_user_ns(), in->gid);
  503. out->cuid = from_kuid_munged(current_user_ns(), in->cuid);
  504. out->cgid = from_kgid_munged(current_user_ns(), in->cgid);
  505. out->mode = in->mode;
  506. out->seq = in->seq;
  507. }
  508. /**
  509. * ipc64_perm_to_ipc_perm - convert new ipc permissions to old
  510. * @in: new style ipc permissions
  511. * @out: old style ipc permissions
  512. *
  513. * Turn the new style permissions object @in into a compatibility
  514. * object and store it into the @out pointer.
  515. */
  516. void ipc64_perm_to_ipc_perm(struct ipc64_perm *in, struct ipc_perm *out)
  517. {
  518. out->key = in->key;
  519. SET_UID(out->uid, in->uid);
  520. SET_GID(out->gid, in->gid);
  521. SET_UID(out->cuid, in->cuid);
  522. SET_GID(out->cgid, in->cgid);
  523. out->mode = in->mode;
  524. out->seq = in->seq;
  525. }
  526. /**
  527. * ipc_obtain_object_idr
  528. * @ids: ipc identifier set
  529. * @id: ipc id to look for
  530. *
  531. * Look for an id in the ipc ids idr and return associated ipc object.
  532. *
  533. * Call inside the RCU critical section.
  534. * The ipc object is *not* locked on exit.
  535. */
  536. struct kern_ipc_perm *ipc_obtain_object_idr(struct ipc_ids *ids, int id)
  537. {
  538. struct kern_ipc_perm *out;
  539. int idx = ipcid_to_idx(id);
  540. out = idr_find(&ids->ipcs_idr, idx);
  541. if (!out)
  542. return ERR_PTR(-EINVAL);
  543. return out;
  544. }
  545. /**
  546. * ipc_obtain_object_check
  547. * @ids: ipc identifier set
  548. * @id: ipc id to look for
  549. *
  550. * Similar to ipc_obtain_object_idr() but also checks the ipc object
  551. * sequence number.
  552. *
  553. * Call inside the RCU critical section.
  554. * The ipc object is *not* locked on exit.
  555. */
  556. struct kern_ipc_perm *ipc_obtain_object_check(struct ipc_ids *ids, int id)
  557. {
  558. struct kern_ipc_perm *out = ipc_obtain_object_idr(ids, id);
  559. if (IS_ERR(out))
  560. goto out;
  561. if (ipc_checkid(out, id))
  562. return ERR_PTR(-EINVAL);
  563. out:
  564. return out;
  565. }
  566. /**
  567. * ipcget - Common sys_*get() code
  568. * @ns: namespace
  569. * @ids: ipc identifier set
  570. * @ops: operations to be called on ipc object creation, permission checks
  571. * and further checks
  572. * @params: the parameters needed by the previous operations.
  573. *
  574. * Common routine called by sys_msgget(), sys_semget() and sys_shmget().
  575. */
  576. int ipcget(struct ipc_namespace *ns, struct ipc_ids *ids,
  577. const struct ipc_ops *ops, struct ipc_params *params)
  578. {
  579. if (params->key == IPC_PRIVATE)
  580. return ipcget_new(ns, ids, ops, params);
  581. else
  582. return ipcget_public(ns, ids, ops, params);
  583. }
  584. /**
  585. * ipc_update_perm - update the permissions of an ipc object
  586. * @in: the permission given as input.
  587. * @out: the permission of the ipc to set.
  588. */
  589. int ipc_update_perm(struct ipc64_perm *in, struct kern_ipc_perm *out)
  590. {
  591. kuid_t uid = make_kuid(current_user_ns(), in->uid);
  592. kgid_t gid = make_kgid(current_user_ns(), in->gid);
  593. if (!uid_valid(uid) || !gid_valid(gid))
  594. return -EINVAL;
  595. out->uid = uid;
  596. out->gid = gid;
  597. out->mode = (out->mode & ~S_IRWXUGO)
  598. | (in->mode & S_IRWXUGO);
  599. return 0;
  600. }
  601. /**
  602. * ipcctl_obtain_check - retrieve an ipc object and check permissions
  603. * @ns: ipc namespace
  604. * @ids: the table of ids where to look for the ipc
  605. * @id: the id of the ipc to retrieve
  606. * @cmd: the cmd to check
  607. * @perm: the permission to set
  608. * @extra_perm: one extra permission parameter used by msq
  609. *
  610. * This function does some common audit and permissions check for some IPC_XXX
  611. * cmd and is called from semctl_down, shmctl_down and msgctl_down.
  612. *
  613. * It:
  614. * - retrieves the ipc object with the given id in the given table.
  615. * - performs some audit and permission check, depending on the given cmd
  616. * - returns a pointer to the ipc object or otherwise, the corresponding
  617. * error.
  618. *
  619. * Call holding the both the rwsem and the rcu read lock.
  620. */
  621. struct kern_ipc_perm *ipcctl_obtain_check(struct ipc_namespace *ns,
  622. struct ipc_ids *ids, int id, int cmd,
  623. struct ipc64_perm *perm, int extra_perm)
  624. {
  625. kuid_t euid;
  626. int err = -EPERM;
  627. struct kern_ipc_perm *ipcp;
  628. ipcp = ipc_obtain_object_check(ids, id);
  629. if (IS_ERR(ipcp)) {
  630. err = PTR_ERR(ipcp);
  631. goto err;
  632. }
  633. audit_ipc_obj(ipcp);
  634. if (cmd == IPC_SET)
  635. audit_ipc_set_perm(extra_perm, perm->uid,
  636. perm->gid, perm->mode);
  637. euid = current_euid();
  638. if (uid_eq(euid, ipcp->cuid) || uid_eq(euid, ipcp->uid) ||
  639. ns_capable(ns->user_ns, CAP_SYS_ADMIN))
  640. return ipcp; /* successful lookup */
  641. err:
  642. return ERR_PTR(err);
  643. }
  644. #ifdef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
  645. /**
  646. * ipc_parse_version - ipc call version
  647. * @cmd: pointer to command
  648. *
  649. * Return IPC_64 for new style IPC and IPC_OLD for old style IPC.
  650. * The @cmd value is turned from an encoding command and version into
  651. * just the command code.
  652. */
  653. int ipc_parse_version(int *cmd)
  654. {
  655. if (*cmd & IPC_64) {
  656. *cmd ^= IPC_64;
  657. return IPC_64;
  658. } else {
  659. return IPC_OLD;
  660. }
  661. }
  662. #endif /* CONFIG_ARCH_WANT_IPC_PARSE_VERSION */
  663. #ifdef CONFIG_PROC_FS
  664. struct ipc_proc_iter {
  665. struct ipc_namespace *ns;
  666. struct pid_namespace *pid_ns;
  667. struct ipc_proc_iface *iface;
  668. };
  669. struct pid_namespace *ipc_seq_pid_ns(struct seq_file *s)
  670. {
  671. struct ipc_proc_iter *iter = s->private;
  672. return iter->pid_ns;
  673. }
  674. /*
  675. * This routine locks the ipc structure found at least at position pos.
  676. */
  677. static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos,
  678. loff_t *new_pos)
  679. {
  680. struct kern_ipc_perm *ipc;
  681. int total, id;
  682. total = 0;
  683. for (id = 0; id < pos && total < ids->in_use; id++) {
  684. ipc = idr_find(&ids->ipcs_idr, id);
  685. if (ipc != NULL)
  686. total++;
  687. }
  688. ipc = NULL;
  689. if (total >= ids->in_use)
  690. goto out;
  691. for (; pos < ipc_mni; pos++) {
  692. ipc = idr_find(&ids->ipcs_idr, pos);
  693. if (ipc != NULL) {
  694. rcu_read_lock();
  695. ipc_lock_object(ipc);
  696. break;
  697. }
  698. }
  699. out:
  700. *new_pos = pos + 1;
  701. return ipc;
  702. }
  703. static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos)
  704. {
  705. struct ipc_proc_iter *iter = s->private;
  706. struct ipc_proc_iface *iface = iter->iface;
  707. struct kern_ipc_perm *ipc = it;
  708. /* If we had an ipc id locked before, unlock it */
  709. if (ipc && ipc != SEQ_START_TOKEN)
  710. ipc_unlock(ipc);
  711. return sysvipc_find_ipc(&iter->ns->ids[iface->ids], *pos, pos);
  712. }
  713. /*
  714. * File positions: pos 0 -> header, pos n -> ipc id = n - 1.
  715. * SeqFile iterator: iterator value locked ipc pointer or SEQ_TOKEN_START.
  716. */
  717. static void *sysvipc_proc_start(struct seq_file *s, loff_t *pos)
  718. {
  719. struct ipc_proc_iter *iter = s->private;
  720. struct ipc_proc_iface *iface = iter->iface;
  721. struct ipc_ids *ids;
  722. ids = &iter->ns->ids[iface->ids];
  723. /*
  724. * Take the lock - this will be released by the corresponding
  725. * call to stop().
  726. */
  727. down_read(&ids->rwsem);
  728. /* pos < 0 is invalid */
  729. if (*pos < 0)
  730. return NULL;
  731. /* pos == 0 means header */
  732. if (*pos == 0)
  733. return SEQ_START_TOKEN;
  734. /* Find the (pos-1)th ipc */
  735. return sysvipc_find_ipc(ids, *pos - 1, pos);
  736. }
  737. static void sysvipc_proc_stop(struct seq_file *s, void *it)
  738. {
  739. struct kern_ipc_perm *ipc = it;
  740. struct ipc_proc_iter *iter = s->private;
  741. struct ipc_proc_iface *iface = iter->iface;
  742. struct ipc_ids *ids;
  743. /* If we had a locked structure, release it */
  744. if (ipc && ipc != SEQ_START_TOKEN)
  745. ipc_unlock(ipc);
  746. ids = &iter->ns->ids[iface->ids];
  747. /* Release the lock we took in start() */
  748. up_read(&ids->rwsem);
  749. }
  750. static int sysvipc_proc_show(struct seq_file *s, void *it)
  751. {
  752. struct ipc_proc_iter *iter = s->private;
  753. struct ipc_proc_iface *iface = iter->iface;
  754. if (it == SEQ_START_TOKEN) {
  755. seq_puts(s, iface->header);
  756. return 0;
  757. }
  758. return iface->show(s, it);
  759. }
  760. static const struct seq_operations sysvipc_proc_seqops = {
  761. .start = sysvipc_proc_start,
  762. .stop = sysvipc_proc_stop,
  763. .next = sysvipc_proc_next,
  764. .show = sysvipc_proc_show,
  765. };
  766. static int sysvipc_proc_open(struct inode *inode, struct file *file)
  767. {
  768. struct ipc_proc_iter *iter;
  769. iter = __seq_open_private(file, &sysvipc_proc_seqops, sizeof(*iter));
  770. if (!iter)
  771. return -ENOMEM;
  772. iter->iface = PDE_DATA(inode);
  773. iter->ns = get_ipc_ns(current->nsproxy->ipc_ns);
  774. iter->pid_ns = get_pid_ns(task_active_pid_ns(current));
  775. return 0;
  776. }
  777. static int sysvipc_proc_release(struct inode *inode, struct file *file)
  778. {
  779. struct seq_file *seq = file->private_data;
  780. struct ipc_proc_iter *iter = seq->private;
  781. put_ipc_ns(iter->ns);
  782. put_pid_ns(iter->pid_ns);
  783. return seq_release_private(inode, file);
  784. }
  785. static const struct proc_ops sysvipc_proc_ops = {
  786. .proc_flags = PROC_ENTRY_PERMANENT,
  787. .proc_open = sysvipc_proc_open,
  788. .proc_read = seq_read,
  789. .proc_lseek = seq_lseek,
  790. .proc_release = sysvipc_proc_release,
  791. };
  792. #endif /* CONFIG_PROC_FS */