nsproxy.c 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Copyright (C) 2006 IBM Corporation
  4. *
  5. * Author: Serge Hallyn <serue@us.ibm.com>
  6. *
  7. * Jun 2006 - namespaces support
  8. * OpenVZ, SWsoft Inc.
  9. * Pavel Emelianov <xemul@openvz.org>
  10. */
  11. #include <linux/slab.h>
  12. #include <linux/export.h>
  13. #include <linux/nsproxy.h>
  14. #include <linux/init_task.h>
  15. #include <linux/mnt_namespace.h>
  16. #include <linux/utsname.h>
  17. #include <linux/pid_namespace.h>
  18. #include <net/net_namespace.h>
  19. #include <linux/ipc_namespace.h>
  20. #include <linux/time_namespace.h>
  21. #include <linux/fs_struct.h>
  22. #include <linux/proc_fs.h>
  23. #include <linux/proc_ns.h>
  24. #include <linux/file.h>
  25. #include <linux/syscalls.h>
  26. #include <linux/cgroup.h>
  27. #include <linux/perf_event.h>
  28. static struct kmem_cache *nsproxy_cachep;
  29. struct nsproxy init_nsproxy = {
  30. .count = ATOMIC_INIT(1),
  31. .uts_ns = &init_uts_ns,
  32. #if defined(CONFIG_POSIX_MQUEUE) || defined(CONFIG_SYSVIPC)
  33. .ipc_ns = &init_ipc_ns,
  34. #endif
  35. .mnt_ns = NULL,
  36. .pid_ns_for_children = &init_pid_ns,
  37. #ifdef CONFIG_NET
  38. .net_ns = &init_net,
  39. #endif
  40. #ifdef CONFIG_CGROUPS
  41. .cgroup_ns = &init_cgroup_ns,
  42. #endif
  43. #ifdef CONFIG_TIME_NS
  44. .time_ns = &init_time_ns,
  45. .time_ns_for_children = &init_time_ns,
  46. #endif
  47. };
  48. static inline struct nsproxy *create_nsproxy(void)
  49. {
  50. struct nsproxy *nsproxy;
  51. nsproxy = kmem_cache_alloc(nsproxy_cachep, GFP_KERNEL);
  52. if (nsproxy)
  53. atomic_set(&nsproxy->count, 1);
  54. return nsproxy;
  55. }
  56. /*
  57. * Create new nsproxy and all of its the associated namespaces.
  58. * Return the newly created nsproxy. Do not attach this to the task,
  59. * leave it to the caller to do proper locking and attach it to task.
  60. */
  61. static struct nsproxy *create_new_namespaces(unsigned long flags,
  62. struct task_struct *tsk, struct user_namespace *user_ns,
  63. struct fs_struct *new_fs)
  64. {
  65. struct nsproxy *new_nsp;
  66. int err;
  67. new_nsp = create_nsproxy();
  68. if (!new_nsp)
  69. return ERR_PTR(-ENOMEM);
  70. new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, user_ns, new_fs);
  71. if (IS_ERR(new_nsp->mnt_ns)) {
  72. err = PTR_ERR(new_nsp->mnt_ns);
  73. goto out_ns;
  74. }
  75. new_nsp->uts_ns = copy_utsname(flags, user_ns, tsk->nsproxy->uts_ns);
  76. if (IS_ERR(new_nsp->uts_ns)) {
  77. err = PTR_ERR(new_nsp->uts_ns);
  78. goto out_uts;
  79. }
  80. new_nsp->ipc_ns = copy_ipcs(flags, user_ns, tsk->nsproxy->ipc_ns);
  81. if (IS_ERR(new_nsp->ipc_ns)) {
  82. err = PTR_ERR(new_nsp->ipc_ns);
  83. goto out_ipc;
  84. }
  85. new_nsp->pid_ns_for_children =
  86. copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns_for_children);
  87. if (IS_ERR(new_nsp->pid_ns_for_children)) {
  88. err = PTR_ERR(new_nsp->pid_ns_for_children);
  89. goto out_pid;
  90. }
  91. new_nsp->cgroup_ns = copy_cgroup_ns(flags, user_ns,
  92. tsk->nsproxy->cgroup_ns);
  93. if (IS_ERR(new_nsp->cgroup_ns)) {
  94. err = PTR_ERR(new_nsp->cgroup_ns);
  95. goto out_cgroup;
  96. }
  97. new_nsp->net_ns = copy_net_ns(flags, user_ns, tsk->nsproxy->net_ns);
  98. if (IS_ERR(new_nsp->net_ns)) {
  99. err = PTR_ERR(new_nsp->net_ns);
  100. goto out_net;
  101. }
  102. new_nsp->time_ns_for_children = copy_time_ns(flags, user_ns,
  103. tsk->nsproxy->time_ns_for_children);
  104. if (IS_ERR(new_nsp->time_ns_for_children)) {
  105. err = PTR_ERR(new_nsp->time_ns_for_children);
  106. goto out_time;
  107. }
  108. new_nsp->time_ns = get_time_ns(tsk->nsproxy->time_ns);
  109. return new_nsp;
  110. out_time:
  111. put_net(new_nsp->net_ns);
  112. out_net:
  113. put_cgroup_ns(new_nsp->cgroup_ns);
  114. out_cgroup:
  115. if (new_nsp->pid_ns_for_children)
  116. put_pid_ns(new_nsp->pid_ns_for_children);
  117. out_pid:
  118. if (new_nsp->ipc_ns)
  119. put_ipc_ns(new_nsp->ipc_ns);
  120. out_ipc:
  121. if (new_nsp->uts_ns)
  122. put_uts_ns(new_nsp->uts_ns);
  123. out_uts:
  124. if (new_nsp->mnt_ns)
  125. put_mnt_ns(new_nsp->mnt_ns);
  126. out_ns:
  127. kmem_cache_free(nsproxy_cachep, new_nsp);
  128. return ERR_PTR(err);
  129. }
  130. /*
  131. * called from clone. This now handles copy for nsproxy and all
  132. * namespaces therein.
  133. */
  134. int copy_namespaces(unsigned long flags, struct task_struct *tsk)
  135. {
  136. struct nsproxy *old_ns = tsk->nsproxy;
  137. struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns);
  138. struct nsproxy *new_ns;
  139. int ret;
  140. if (likely(!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
  141. CLONE_NEWPID | CLONE_NEWNET |
  142. CLONE_NEWCGROUP | CLONE_NEWTIME)))) {
  143. if (likely(old_ns->time_ns_for_children == old_ns->time_ns)) {
  144. get_nsproxy(old_ns);
  145. return 0;
  146. }
  147. } else if (!ns_capable(user_ns, CAP_SYS_ADMIN))
  148. return -EPERM;
  149. /*
  150. * CLONE_NEWIPC must detach from the undolist: after switching
  151. * to a new ipc namespace, the semaphore arrays from the old
  152. * namespace are unreachable. In clone parlance, CLONE_SYSVSEM
  153. * means share undolist with parent, so we must forbid using
  154. * it along with CLONE_NEWIPC.
  155. */
  156. if ((flags & (CLONE_NEWIPC | CLONE_SYSVSEM)) ==
  157. (CLONE_NEWIPC | CLONE_SYSVSEM))
  158. return -EINVAL;
  159. new_ns = create_new_namespaces(flags, tsk, user_ns, tsk->fs);
  160. if (IS_ERR(new_ns))
  161. return PTR_ERR(new_ns);
  162. ret = timens_on_fork(new_ns, tsk);
  163. if (ret) {
  164. free_nsproxy(new_ns);
  165. return ret;
  166. }
  167. tsk->nsproxy = new_ns;
  168. return 0;
  169. }
  170. void free_nsproxy(struct nsproxy *ns)
  171. {
  172. if (ns->mnt_ns)
  173. put_mnt_ns(ns->mnt_ns);
  174. if (ns->uts_ns)
  175. put_uts_ns(ns->uts_ns);
  176. if (ns->ipc_ns)
  177. put_ipc_ns(ns->ipc_ns);
  178. if (ns->pid_ns_for_children)
  179. put_pid_ns(ns->pid_ns_for_children);
  180. if (ns->time_ns)
  181. put_time_ns(ns->time_ns);
  182. if (ns->time_ns_for_children)
  183. put_time_ns(ns->time_ns_for_children);
  184. put_cgroup_ns(ns->cgroup_ns);
  185. put_net(ns->net_ns);
  186. kmem_cache_free(nsproxy_cachep, ns);
  187. }
  188. /*
  189. * Called from unshare. Unshare all the namespaces part of nsproxy.
  190. * On success, returns the new nsproxy.
  191. */
  192. int unshare_nsproxy_namespaces(unsigned long unshare_flags,
  193. struct nsproxy **new_nsp, struct cred *new_cred, struct fs_struct *new_fs)
  194. {
  195. struct user_namespace *user_ns;
  196. int err = 0;
  197. if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
  198. CLONE_NEWNET | CLONE_NEWPID | CLONE_NEWCGROUP |
  199. CLONE_NEWTIME)))
  200. return 0;
  201. user_ns = new_cred ? new_cred->user_ns : current_user_ns();
  202. if (!ns_capable(user_ns, CAP_SYS_ADMIN))
  203. return -EPERM;
  204. *new_nsp = create_new_namespaces(unshare_flags, current, user_ns,
  205. new_fs ? new_fs : current->fs);
  206. if (IS_ERR(*new_nsp)) {
  207. err = PTR_ERR(*new_nsp);
  208. goto out;
  209. }
  210. out:
  211. return err;
  212. }
  213. void switch_task_namespaces(struct task_struct *p, struct nsproxy *new)
  214. {
  215. struct nsproxy *ns;
  216. might_sleep();
  217. task_lock(p);
  218. ns = p->nsproxy;
  219. p->nsproxy = new;
  220. task_unlock(p);
  221. if (ns && atomic_dec_and_test(&ns->count))
  222. free_nsproxy(ns);
  223. }
  224. void exit_task_namespaces(struct task_struct *p)
  225. {
  226. switch_task_namespaces(p, NULL);
  227. }
  228. static int check_setns_flags(unsigned long flags)
  229. {
  230. if (!flags || (flags & ~(CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
  231. CLONE_NEWNET | CLONE_NEWTIME | CLONE_NEWUSER |
  232. CLONE_NEWPID | CLONE_NEWCGROUP)))
  233. return -EINVAL;
  234. #ifndef CONFIG_USER_NS
  235. if (flags & CLONE_NEWUSER)
  236. return -EINVAL;
  237. #endif
  238. #ifndef CONFIG_PID_NS
  239. if (flags & CLONE_NEWPID)
  240. return -EINVAL;
  241. #endif
  242. #ifndef CONFIG_UTS_NS
  243. if (flags & CLONE_NEWUTS)
  244. return -EINVAL;
  245. #endif
  246. #ifndef CONFIG_IPC_NS
  247. if (flags & CLONE_NEWIPC)
  248. return -EINVAL;
  249. #endif
  250. #ifndef CONFIG_CGROUPS
  251. if (flags & CLONE_NEWCGROUP)
  252. return -EINVAL;
  253. #endif
  254. #ifndef CONFIG_NET_NS
  255. if (flags & CLONE_NEWNET)
  256. return -EINVAL;
  257. #endif
  258. #ifndef CONFIG_TIME_NS
  259. if (flags & CLONE_NEWTIME)
  260. return -EINVAL;
  261. #endif
  262. return 0;
  263. }
  264. static void put_nsset(struct nsset *nsset)
  265. {
  266. unsigned flags = nsset->flags;
  267. if (flags & CLONE_NEWUSER)
  268. put_cred(nsset_cred(nsset));
  269. /*
  270. * We only created a temporary copy if we attached to more than just
  271. * the mount namespace.
  272. */
  273. if (nsset->fs && (flags & CLONE_NEWNS) && (flags & ~CLONE_NEWNS))
  274. free_fs_struct(nsset->fs);
  275. if (nsset->nsproxy)
  276. free_nsproxy(nsset->nsproxy);
  277. }
  278. static int prepare_nsset(unsigned flags, struct nsset *nsset)
  279. {
  280. struct task_struct *me = current;
  281. nsset->nsproxy = create_new_namespaces(0, me, current_user_ns(), me->fs);
  282. if (IS_ERR(nsset->nsproxy))
  283. return PTR_ERR(nsset->nsproxy);
  284. if (flags & CLONE_NEWUSER)
  285. nsset->cred = prepare_creds();
  286. else
  287. nsset->cred = current_cred();
  288. if (!nsset->cred)
  289. goto out;
  290. /* Only create a temporary copy of fs_struct if we really need to. */
  291. if (flags == CLONE_NEWNS) {
  292. nsset->fs = me->fs;
  293. } else if (flags & CLONE_NEWNS) {
  294. nsset->fs = copy_fs_struct(me->fs);
  295. if (!nsset->fs)
  296. goto out;
  297. }
  298. nsset->flags = flags;
  299. return 0;
  300. out:
  301. put_nsset(nsset);
  302. return -ENOMEM;
  303. }
  304. static inline int validate_ns(struct nsset *nsset, struct ns_common *ns)
  305. {
  306. return ns->ops->install(nsset, ns);
  307. }
  308. /*
  309. * This is the inverse operation to unshare().
  310. * Ordering is equivalent to the standard ordering used everywhere else
  311. * during unshare and process creation. The switch to the new set of
  312. * namespaces occurs at the point of no return after installation of
  313. * all requested namespaces was successful in commit_nsset().
  314. */
  315. static int validate_nsset(struct nsset *nsset, struct pid *pid)
  316. {
  317. int ret = 0;
  318. unsigned flags = nsset->flags;
  319. struct user_namespace *user_ns = NULL;
  320. struct pid_namespace *pid_ns = NULL;
  321. struct nsproxy *nsp;
  322. struct task_struct *tsk;
  323. /* Take a "snapshot" of the target task's namespaces. */
  324. rcu_read_lock();
  325. tsk = pid_task(pid, PIDTYPE_PID);
  326. if (!tsk) {
  327. rcu_read_unlock();
  328. return -ESRCH;
  329. }
  330. if (!ptrace_may_access(tsk, PTRACE_MODE_READ_REALCREDS)) {
  331. rcu_read_unlock();
  332. return -EPERM;
  333. }
  334. task_lock(tsk);
  335. nsp = tsk->nsproxy;
  336. if (nsp)
  337. get_nsproxy(nsp);
  338. task_unlock(tsk);
  339. if (!nsp) {
  340. rcu_read_unlock();
  341. return -ESRCH;
  342. }
  343. #ifdef CONFIG_PID_NS
  344. if (flags & CLONE_NEWPID) {
  345. pid_ns = task_active_pid_ns(tsk);
  346. if (unlikely(!pid_ns)) {
  347. rcu_read_unlock();
  348. ret = -ESRCH;
  349. goto out;
  350. }
  351. get_pid_ns(pid_ns);
  352. }
  353. #endif
  354. #ifdef CONFIG_USER_NS
  355. if (flags & CLONE_NEWUSER)
  356. user_ns = get_user_ns(__task_cred(tsk)->user_ns);
  357. #endif
  358. rcu_read_unlock();
  359. /*
  360. * Install requested namespaces. The caller will have
  361. * verified earlier that the requested namespaces are
  362. * supported on this kernel. We don't report errors here
  363. * if a namespace is requested that isn't supported.
  364. */
  365. #ifdef CONFIG_USER_NS
  366. if (flags & CLONE_NEWUSER) {
  367. ret = validate_ns(nsset, &user_ns->ns);
  368. if (ret)
  369. goto out;
  370. }
  371. #endif
  372. if (flags & CLONE_NEWNS) {
  373. ret = validate_ns(nsset, from_mnt_ns(nsp->mnt_ns));
  374. if (ret)
  375. goto out;
  376. }
  377. #ifdef CONFIG_UTS_NS
  378. if (flags & CLONE_NEWUTS) {
  379. ret = validate_ns(nsset, &nsp->uts_ns->ns);
  380. if (ret)
  381. goto out;
  382. }
  383. #endif
  384. #ifdef CONFIG_IPC_NS
  385. if (flags & CLONE_NEWIPC) {
  386. ret = validate_ns(nsset, &nsp->ipc_ns->ns);
  387. if (ret)
  388. goto out;
  389. }
  390. #endif
  391. #ifdef CONFIG_PID_NS
  392. if (flags & CLONE_NEWPID) {
  393. ret = validate_ns(nsset, &pid_ns->ns);
  394. if (ret)
  395. goto out;
  396. }
  397. #endif
  398. #ifdef CONFIG_CGROUPS
  399. if (flags & CLONE_NEWCGROUP) {
  400. ret = validate_ns(nsset, &nsp->cgroup_ns->ns);
  401. if (ret)
  402. goto out;
  403. }
  404. #endif
  405. #ifdef CONFIG_NET_NS
  406. if (flags & CLONE_NEWNET) {
  407. ret = validate_ns(nsset, &nsp->net_ns->ns);
  408. if (ret)
  409. goto out;
  410. }
  411. #endif
  412. #ifdef CONFIG_TIME_NS
  413. if (flags & CLONE_NEWTIME) {
  414. ret = validate_ns(nsset, &nsp->time_ns->ns);
  415. if (ret)
  416. goto out;
  417. }
  418. #endif
  419. out:
  420. if (pid_ns)
  421. put_pid_ns(pid_ns);
  422. if (nsp)
  423. put_nsproxy(nsp);
  424. put_user_ns(user_ns);
  425. return ret;
  426. }
  427. /*
  428. * This is the point of no return. There are just a few namespaces
  429. * that do some actual work here and it's sufficiently minimal that
  430. * a separate ns_common operation seems unnecessary for now.
  431. * Unshare is doing the same thing. If we'll end up needing to do
  432. * more in a given namespace or a helper here is ultimately not
  433. * exported anymore a simple commit handler for each namespace
  434. * should be added to ns_common.
  435. */
  436. static void commit_nsset(struct nsset *nsset)
  437. {
  438. unsigned flags = nsset->flags;
  439. struct task_struct *me = current;
  440. #ifdef CONFIG_USER_NS
  441. if (flags & CLONE_NEWUSER) {
  442. /* transfer ownership */
  443. commit_creds(nsset_cred(nsset));
  444. nsset->cred = NULL;
  445. }
  446. #endif
  447. /* We only need to commit if we have used a temporary fs_struct. */
  448. if ((flags & CLONE_NEWNS) && (flags & ~CLONE_NEWNS)) {
  449. set_fs_root(me->fs, &nsset->fs->root);
  450. set_fs_pwd(me->fs, &nsset->fs->pwd);
  451. }
  452. #ifdef CONFIG_IPC_NS
  453. if (flags & CLONE_NEWIPC)
  454. exit_sem(me);
  455. #endif
  456. #ifdef CONFIG_TIME_NS
  457. if (flags & CLONE_NEWTIME)
  458. timens_commit(me, nsset->nsproxy->time_ns);
  459. #endif
  460. /* transfer ownership */
  461. switch_task_namespaces(me, nsset->nsproxy);
  462. nsset->nsproxy = NULL;
  463. }
  464. SYSCALL_DEFINE2(setns, int, fd, int, flags)
  465. {
  466. struct file *file;
  467. struct ns_common *ns = NULL;
  468. struct nsset nsset = {};
  469. int err = 0;
  470. file = fget(fd);
  471. if (!file)
  472. return -EBADF;
  473. if (proc_ns_file(file)) {
  474. ns = get_proc_ns(file_inode(file));
  475. if (flags && (ns->ops->type != flags))
  476. err = -EINVAL;
  477. flags = ns->ops->type;
  478. } else if (!IS_ERR(pidfd_pid(file))) {
  479. err = check_setns_flags(flags);
  480. } else {
  481. err = -EINVAL;
  482. }
  483. if (err)
  484. goto out;
  485. err = prepare_nsset(flags, &nsset);
  486. if (err)
  487. goto out;
  488. if (proc_ns_file(file))
  489. err = validate_ns(&nsset, ns);
  490. else
  491. err = validate_nsset(&nsset, file->private_data);
  492. if (!err) {
  493. commit_nsset(&nsset);
  494. perf_event_namespaces(current);
  495. }
  496. put_nsset(&nsset);
  497. out:
  498. fput(file);
  499. return err;
  500. }
  501. int __init nsproxy_cache_init(void)
  502. {
  503. nsproxy_cachep = KMEM_CACHE(nsproxy, SLAB_PANIC);
  504. return 0;
  505. }