net_namespace.c 33 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  3. #include <linux/workqueue.h>
  4. #include <linux/rtnetlink.h>
  5. #include <linux/cache.h>
  6. #include <linux/slab.h>
  7. #include <linux/list.h>
  8. #include <linux/delay.h>
  9. #include <linux/sched.h>
  10. #include <linux/idr.h>
  11. #include <linux/rculist.h>
  12. #include <linux/nsproxy.h>
  13. #include <linux/fs.h>
  14. #include <linux/proc_ns.h>
  15. #include <linux/file.h>
  16. #include <linux/export.h>
  17. #include <linux/user_namespace.h>
  18. #include <linux/net_namespace.h>
  19. #include <linux/sched/task.h>
  20. #include <linux/uidgid.h>
  21. #include <linux/cookie.h>
  22. #include <net/sock.h>
  23. #include <net/netlink.h>
  24. #include <net/net_namespace.h>
  25. #include <net/netns/generic.h>
  26. /*
  27. * Our network namespace constructor/destructor lists
  28. */
  29. static LIST_HEAD(pernet_list);
  30. static struct list_head *first_device = &pernet_list;
  31. LIST_HEAD(net_namespace_list);
  32. EXPORT_SYMBOL_GPL(net_namespace_list);
  33. /* Protects net_namespace_list. Nests iside rtnl_lock() */
  34. DECLARE_RWSEM(net_rwsem);
  35. EXPORT_SYMBOL_GPL(net_rwsem);
  36. #ifdef CONFIG_KEYS
  37. static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) };
  38. #endif
  39. struct net init_net = {
  40. .count = REFCOUNT_INIT(1),
  41. .dev_base_head = LIST_HEAD_INIT(init_net.dev_base_head),
  42. #ifdef CONFIG_KEYS
  43. .key_domain = &init_net_key_domain,
  44. #endif
  45. };
  46. EXPORT_SYMBOL(init_net);
  47. static bool init_net_initialized;
  48. /*
  49. * pernet_ops_rwsem: protects: pernet_list, net_generic_ids,
  50. * init_net_initialized and first_device pointer.
  51. * This is internal net namespace object. Please, don't use it
  52. * outside.
  53. */
  54. DECLARE_RWSEM(pernet_ops_rwsem);
  55. EXPORT_SYMBOL_GPL(pernet_ops_rwsem);
  56. #define MIN_PERNET_OPS_ID \
  57. ((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *))
  58. #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */
  59. static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
  60. DEFINE_COOKIE(net_cookie);
  61. u64 __net_gen_cookie(struct net *net)
  62. {
  63. while (1) {
  64. u64 res = atomic64_read(&net->net_cookie);
  65. if (res)
  66. return res;
  67. res = gen_cookie_next(&net_cookie);
  68. atomic64_cmpxchg(&net->net_cookie, 0, res);
  69. }
  70. }
  71. static struct net_generic *net_alloc_generic(void)
  72. {
  73. struct net_generic *ng;
  74. unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
  75. ng = kzalloc(generic_size, GFP_KERNEL);
  76. if (ng)
  77. ng->s.len = max_gen_ptrs;
  78. return ng;
  79. }
  80. static int net_assign_generic(struct net *net, unsigned int id, void *data)
  81. {
  82. struct net_generic *ng, *old_ng;
  83. BUG_ON(id < MIN_PERNET_OPS_ID);
  84. old_ng = rcu_dereference_protected(net->gen,
  85. lockdep_is_held(&pernet_ops_rwsem));
  86. if (old_ng->s.len > id) {
  87. old_ng->ptr[id] = data;
  88. return 0;
  89. }
  90. ng = net_alloc_generic();
  91. if (ng == NULL)
  92. return -ENOMEM;
  93. /*
  94. * Some synchronisation notes:
  95. *
  96. * The net_generic explores the net->gen array inside rcu
  97. * read section. Besides once set the net->gen->ptr[x]
  98. * pointer never changes (see rules in netns/generic.h).
  99. *
  100. * That said, we simply duplicate this array and schedule
  101. * the old copy for kfree after a grace period.
  102. */
  103. memcpy(&ng->ptr[MIN_PERNET_OPS_ID], &old_ng->ptr[MIN_PERNET_OPS_ID],
  104. (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *));
  105. ng->ptr[id] = data;
  106. rcu_assign_pointer(net->gen, ng);
  107. kfree_rcu(old_ng, s.rcu);
  108. return 0;
  109. }
  110. static int ops_init(const struct pernet_operations *ops, struct net *net)
  111. {
  112. int err = -ENOMEM;
  113. void *data = NULL;
  114. if (ops->id && ops->size) {
  115. data = kzalloc(ops->size, GFP_KERNEL);
  116. if (!data)
  117. goto out;
  118. err = net_assign_generic(net, *ops->id, data);
  119. if (err)
  120. goto cleanup;
  121. }
  122. err = 0;
  123. if (ops->init)
  124. err = ops->init(net);
  125. if (!err)
  126. return 0;
  127. cleanup:
  128. kfree(data);
  129. out:
  130. return err;
  131. }
  132. static void ops_free(const struct pernet_operations *ops, struct net *net)
  133. {
  134. if (ops->id && ops->size) {
  135. kfree(net_generic(net, *ops->id));
  136. }
  137. }
  138. static void ops_pre_exit_list(const struct pernet_operations *ops,
  139. struct list_head *net_exit_list)
  140. {
  141. struct net *net;
  142. if (ops->pre_exit) {
  143. list_for_each_entry(net, net_exit_list, exit_list)
  144. ops->pre_exit(net);
  145. }
  146. }
  147. static void ops_exit_list(const struct pernet_operations *ops,
  148. struct list_head *net_exit_list)
  149. {
  150. struct net *net;
  151. if (ops->exit) {
  152. list_for_each_entry(net, net_exit_list, exit_list) {
  153. ops->exit(net);
  154. cond_resched();
  155. }
  156. }
  157. if (ops->exit_batch)
  158. ops->exit_batch(net_exit_list);
  159. }
  160. static void ops_free_list(const struct pernet_operations *ops,
  161. struct list_head *net_exit_list)
  162. {
  163. struct net *net;
  164. if (ops->size && ops->id) {
  165. list_for_each_entry(net, net_exit_list, exit_list)
  166. ops_free(ops, net);
  167. }
  168. }
  169. /* should be called with nsid_lock held */
  170. static int alloc_netid(struct net *net, struct net *peer, int reqid)
  171. {
  172. int min = 0, max = 0;
  173. if (reqid >= 0) {
  174. min = reqid;
  175. max = reqid + 1;
  176. }
  177. return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC);
  178. }
  179. /* This function is used by idr_for_each(). If net is equal to peer, the
  180. * function returns the id so that idr_for_each() stops. Because we cannot
  181. * returns the id 0 (idr_for_each() will not stop), we return the magic value
  182. * NET_ID_ZERO (-1) for it.
  183. */
  184. #define NET_ID_ZERO -1
  185. static int net_eq_idr(int id, void *net, void *peer)
  186. {
  187. if (net_eq(net, peer))
  188. return id ? : NET_ID_ZERO;
  189. return 0;
  190. }
  191. /* Must be called from RCU-critical section or with nsid_lock held */
  192. static int __peernet2id(const struct net *net, struct net *peer)
  193. {
  194. int id = idr_for_each(&net->netns_ids, net_eq_idr, peer);
  195. /* Magic value for id 0. */
  196. if (id == NET_ID_ZERO)
  197. return 0;
  198. if (id > 0)
  199. return id;
  200. return NETNSA_NSID_NOT_ASSIGNED;
  201. }
  202. static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
  203. struct nlmsghdr *nlh, gfp_t gfp);
  204. /* This function returns the id of a peer netns. If no id is assigned, one will
  205. * be allocated and returned.
  206. */
  207. int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp)
  208. {
  209. int id;
  210. if (refcount_read(&net->count) == 0)
  211. return NETNSA_NSID_NOT_ASSIGNED;
  212. spin_lock_bh(&net->nsid_lock);
  213. id = __peernet2id(net, peer);
  214. if (id >= 0) {
  215. spin_unlock_bh(&net->nsid_lock);
  216. return id;
  217. }
  218. /* When peer is obtained from RCU lists, we may race with
  219. * its cleanup. Check whether it's alive, and this guarantees
  220. * we never hash a peer back to net->netns_ids, after it has
  221. * just been idr_remove()'d from there in cleanup_net().
  222. */
  223. if (!maybe_get_net(peer)) {
  224. spin_unlock_bh(&net->nsid_lock);
  225. return NETNSA_NSID_NOT_ASSIGNED;
  226. }
  227. id = alloc_netid(net, peer, -1);
  228. spin_unlock_bh(&net->nsid_lock);
  229. put_net(peer);
  230. if (id < 0)
  231. return NETNSA_NSID_NOT_ASSIGNED;
  232. rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp);
  233. return id;
  234. }
  235. EXPORT_SYMBOL_GPL(peernet2id_alloc);
  236. /* This function returns, if assigned, the id of a peer netns. */
  237. int peernet2id(const struct net *net, struct net *peer)
  238. {
  239. int id;
  240. rcu_read_lock();
  241. id = __peernet2id(net, peer);
  242. rcu_read_unlock();
  243. return id;
  244. }
  245. EXPORT_SYMBOL(peernet2id);
  246. /* This function returns true is the peer netns has an id assigned into the
  247. * current netns.
  248. */
  249. bool peernet_has_id(const struct net *net, struct net *peer)
  250. {
  251. return peernet2id(net, peer) >= 0;
  252. }
  253. struct net *get_net_ns_by_id(const struct net *net, int id)
  254. {
  255. struct net *peer;
  256. if (id < 0)
  257. return NULL;
  258. rcu_read_lock();
  259. peer = idr_find(&net->netns_ids, id);
  260. if (peer)
  261. peer = maybe_get_net(peer);
  262. rcu_read_unlock();
  263. return peer;
  264. }
  265. /*
  266. * setup_net runs the initializers for the network namespace object.
  267. */
  268. static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
  269. {
  270. /* Must be called with pernet_ops_rwsem held */
  271. const struct pernet_operations *ops, *saved_ops;
  272. int error = 0;
  273. LIST_HEAD(net_exit_list);
  274. refcount_set(&net->count, 1);
  275. refcount_set(&net->passive, 1);
  276. get_random_bytes(&net->hash_mix, sizeof(u32));
  277. net->dev_base_seq = 1;
  278. net->user_ns = user_ns;
  279. idr_init(&net->netns_ids);
  280. spin_lock_init(&net->nsid_lock);
  281. mutex_init(&net->ipv4.ra_mutex);
  282. list_for_each_entry(ops, &pernet_list, list) {
  283. error = ops_init(ops, net);
  284. if (error < 0)
  285. goto out_undo;
  286. }
  287. down_write(&net_rwsem);
  288. list_add_tail_rcu(&net->list, &net_namespace_list);
  289. up_write(&net_rwsem);
  290. out:
  291. return error;
  292. out_undo:
  293. /* Walk through the list backwards calling the exit functions
  294. * for the pernet modules whose init functions did not fail.
  295. */
  296. list_add(&net->exit_list, &net_exit_list);
  297. saved_ops = ops;
  298. list_for_each_entry_continue_reverse(ops, &pernet_list, list)
  299. ops_pre_exit_list(ops, &net_exit_list);
  300. synchronize_rcu();
  301. ops = saved_ops;
  302. list_for_each_entry_continue_reverse(ops, &pernet_list, list)
  303. ops_exit_list(ops, &net_exit_list);
  304. ops = saved_ops;
  305. list_for_each_entry_continue_reverse(ops, &pernet_list, list)
  306. ops_free_list(ops, &net_exit_list);
  307. rcu_barrier();
  308. goto out;
  309. }
  310. static int __net_init net_defaults_init_net(struct net *net)
  311. {
  312. net->core.sysctl_somaxconn = SOMAXCONN;
  313. return 0;
  314. }
  315. static struct pernet_operations net_defaults_ops = {
  316. .init = net_defaults_init_net,
  317. };
  318. static __init int net_defaults_init(void)
  319. {
  320. if (register_pernet_subsys(&net_defaults_ops))
  321. panic("Cannot initialize net default settings");
  322. return 0;
  323. }
  324. core_initcall(net_defaults_init);
  325. #ifdef CONFIG_NET_NS
  326. static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
  327. {
  328. return inc_ucount(ns, current_euid(), UCOUNT_NET_NAMESPACES);
  329. }
  330. static void dec_net_namespaces(struct ucounts *ucounts)
  331. {
  332. dec_ucount(ucounts, UCOUNT_NET_NAMESPACES);
  333. }
  334. static struct kmem_cache *net_cachep __ro_after_init;
  335. static struct workqueue_struct *netns_wq;
  336. static struct net *net_alloc(void)
  337. {
  338. struct net *net = NULL;
  339. struct net_generic *ng;
  340. ng = net_alloc_generic();
  341. if (!ng)
  342. goto out;
  343. net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
  344. if (!net)
  345. goto out_free;
  346. #ifdef CONFIG_KEYS
  347. net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL);
  348. if (!net->key_domain)
  349. goto out_free_2;
  350. refcount_set(&net->key_domain->usage, 1);
  351. #endif
  352. rcu_assign_pointer(net->gen, ng);
  353. out:
  354. return net;
  355. #ifdef CONFIG_KEYS
  356. out_free_2:
  357. kmem_cache_free(net_cachep, net);
  358. net = NULL;
  359. #endif
  360. out_free:
  361. kfree(ng);
  362. goto out;
  363. }
  364. static void net_free(struct net *net)
  365. {
  366. kfree(rcu_access_pointer(net->gen));
  367. kmem_cache_free(net_cachep, net);
  368. }
  369. void net_drop_ns(void *p)
  370. {
  371. struct net *ns = p;
  372. if (ns && refcount_dec_and_test(&ns->passive))
  373. net_free(ns);
  374. }
  375. struct net *copy_net_ns(unsigned long flags,
  376. struct user_namespace *user_ns, struct net *old_net)
  377. {
  378. struct ucounts *ucounts;
  379. struct net *net;
  380. int rv;
  381. if (!(flags & CLONE_NEWNET))
  382. return get_net(old_net);
  383. ucounts = inc_net_namespaces(user_ns);
  384. if (!ucounts)
  385. return ERR_PTR(-ENOSPC);
  386. net = net_alloc();
  387. if (!net) {
  388. rv = -ENOMEM;
  389. goto dec_ucounts;
  390. }
  391. refcount_set(&net->passive, 1);
  392. net->ucounts = ucounts;
  393. get_user_ns(user_ns);
  394. rv = down_read_killable(&pernet_ops_rwsem);
  395. if (rv < 0)
  396. goto put_userns;
  397. rv = setup_net(net, user_ns);
  398. up_read(&pernet_ops_rwsem);
  399. if (rv < 0) {
  400. put_userns:
  401. #ifdef CONFIG_KEYS
  402. key_remove_domain(net->key_domain);
  403. #endif
  404. put_user_ns(user_ns);
  405. net_drop_ns(net);
  406. dec_ucounts:
  407. dec_net_namespaces(ucounts);
  408. return ERR_PTR(rv);
  409. }
  410. return net;
  411. }
  412. /**
  413. * net_ns_get_ownership - get sysfs ownership data for @net
  414. * @net: network namespace in question (can be NULL)
  415. * @uid: kernel user ID for sysfs objects
  416. * @gid: kernel group ID for sysfs objects
  417. *
  418. * Returns the uid/gid pair of root in the user namespace associated with the
  419. * given network namespace.
  420. */
  421. void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid)
  422. {
  423. if (net) {
  424. kuid_t ns_root_uid = make_kuid(net->user_ns, 0);
  425. kgid_t ns_root_gid = make_kgid(net->user_ns, 0);
  426. if (uid_valid(ns_root_uid))
  427. *uid = ns_root_uid;
  428. if (gid_valid(ns_root_gid))
  429. *gid = ns_root_gid;
  430. } else {
  431. *uid = GLOBAL_ROOT_UID;
  432. *gid = GLOBAL_ROOT_GID;
  433. }
  434. }
  435. EXPORT_SYMBOL_GPL(net_ns_get_ownership);
  436. static void unhash_nsid(struct net *net, struct net *last)
  437. {
  438. struct net *tmp;
  439. /* This function is only called from cleanup_net() work,
  440. * and this work is the only process, that may delete
  441. * a net from net_namespace_list. So, when the below
  442. * is executing, the list may only grow. Thus, we do not
  443. * use for_each_net_rcu() or net_rwsem.
  444. */
  445. for_each_net(tmp) {
  446. int id;
  447. spin_lock_bh(&tmp->nsid_lock);
  448. id = __peernet2id(tmp, net);
  449. if (id >= 0)
  450. idr_remove(&tmp->netns_ids, id);
  451. spin_unlock_bh(&tmp->nsid_lock);
  452. if (id >= 0)
  453. rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL,
  454. GFP_KERNEL);
  455. if (tmp == last)
  456. break;
  457. }
  458. spin_lock_bh(&net->nsid_lock);
  459. idr_destroy(&net->netns_ids);
  460. spin_unlock_bh(&net->nsid_lock);
  461. }
  462. static LLIST_HEAD(cleanup_list);
  463. static void cleanup_net(struct work_struct *work)
  464. {
  465. const struct pernet_operations *ops;
  466. struct net *net, *tmp, *last;
  467. struct llist_node *net_kill_list;
  468. LIST_HEAD(net_exit_list);
  469. /* Atomically snapshot the list of namespaces to cleanup */
  470. net_kill_list = llist_del_all(&cleanup_list);
  471. down_read(&pernet_ops_rwsem);
  472. /* Don't let anyone else find us. */
  473. down_write(&net_rwsem);
  474. llist_for_each_entry(net, net_kill_list, cleanup_list)
  475. list_del_rcu(&net->list);
  476. /* Cache last net. After we unlock rtnl, no one new net
  477. * added to net_namespace_list can assign nsid pointer
  478. * to a net from net_kill_list (see peernet2id_alloc()).
  479. * So, we skip them in unhash_nsid().
  480. *
  481. * Note, that unhash_nsid() does not delete nsid links
  482. * between net_kill_list's nets, as they've already
  483. * deleted from net_namespace_list. But, this would be
  484. * useless anyway, as netns_ids are destroyed there.
  485. */
  486. last = list_last_entry(&net_namespace_list, struct net, list);
  487. up_write(&net_rwsem);
  488. llist_for_each_entry(net, net_kill_list, cleanup_list) {
  489. unhash_nsid(net, last);
  490. list_add_tail(&net->exit_list, &net_exit_list);
  491. }
  492. /* Run all of the network namespace pre_exit methods */
  493. list_for_each_entry_reverse(ops, &pernet_list, list)
  494. ops_pre_exit_list(ops, &net_exit_list);
  495. /*
  496. * Another CPU might be rcu-iterating the list, wait for it.
  497. * This needs to be before calling the exit() notifiers, so
  498. * the rcu_barrier() below isn't sufficient alone.
  499. * Also the pre_exit() and exit() methods need this barrier.
  500. */
  501. synchronize_rcu();
  502. /* Run all of the network namespace exit methods */
  503. list_for_each_entry_reverse(ops, &pernet_list, list)
  504. ops_exit_list(ops, &net_exit_list);
  505. /* Free the net generic variables */
  506. list_for_each_entry_reverse(ops, &pernet_list, list)
  507. ops_free_list(ops, &net_exit_list);
  508. up_read(&pernet_ops_rwsem);
  509. /* Ensure there are no outstanding rcu callbacks using this
  510. * network namespace.
  511. */
  512. rcu_barrier();
  513. /* Finally it is safe to free my network namespace structure */
  514. list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
  515. list_del_init(&net->exit_list);
  516. dec_net_namespaces(net->ucounts);
  517. #ifdef CONFIG_KEYS
  518. key_remove_domain(net->key_domain);
  519. #endif
  520. put_user_ns(net->user_ns);
  521. net_drop_ns(net);
  522. }
  523. }
  524. /**
  525. * net_ns_barrier - wait until concurrent net_cleanup_work is done
  526. *
  527. * cleanup_net runs from work queue and will first remove namespaces
  528. * from the global list, then run net exit functions.
  529. *
  530. * Call this in module exit path to make sure that all netns
  531. * ->exit ops have been invoked before the function is removed.
  532. */
  533. void net_ns_barrier(void)
  534. {
  535. down_write(&pernet_ops_rwsem);
  536. up_write(&pernet_ops_rwsem);
  537. }
  538. EXPORT_SYMBOL(net_ns_barrier);
  539. static DECLARE_WORK(net_cleanup_work, cleanup_net);
  540. void __put_net(struct net *net)
  541. {
  542. /* Cleanup the network namespace in process context */
  543. if (llist_add(&net->cleanup_list, &cleanup_list))
  544. queue_work(netns_wq, &net_cleanup_work);
  545. }
  546. EXPORT_SYMBOL_GPL(__put_net);
  547. /**
  548. * get_net_ns - increment the refcount of the network namespace
  549. * @ns: common namespace (net)
  550. *
  551. * Returns the net's common namespace.
  552. */
  553. struct ns_common *get_net_ns(struct ns_common *ns)
  554. {
  555. return &get_net(container_of(ns, struct net, ns))->ns;
  556. }
  557. EXPORT_SYMBOL_GPL(get_net_ns);
  558. struct net *get_net_ns_by_fd(int fd)
  559. {
  560. struct file *file;
  561. struct ns_common *ns;
  562. struct net *net;
  563. file = proc_ns_fget(fd);
  564. if (IS_ERR(file))
  565. return ERR_CAST(file);
  566. ns = get_proc_ns(file_inode(file));
  567. if (ns->ops == &netns_operations)
  568. net = get_net(container_of(ns, struct net, ns));
  569. else
  570. net = ERR_PTR(-EINVAL);
  571. fput(file);
  572. return net;
  573. }
  574. #else
  575. struct net *get_net_ns_by_fd(int fd)
  576. {
  577. return ERR_PTR(-EINVAL);
  578. }
  579. #endif
  580. EXPORT_SYMBOL_GPL(get_net_ns_by_fd);
  581. struct net *get_net_ns_by_pid(pid_t pid)
  582. {
  583. struct task_struct *tsk;
  584. struct net *net;
  585. /* Lookup the network namespace */
  586. net = ERR_PTR(-ESRCH);
  587. rcu_read_lock();
  588. tsk = find_task_by_vpid(pid);
  589. if (tsk) {
  590. struct nsproxy *nsproxy;
  591. task_lock(tsk);
  592. nsproxy = tsk->nsproxy;
  593. if (nsproxy)
  594. net = get_net(nsproxy->net_ns);
  595. task_unlock(tsk);
  596. }
  597. rcu_read_unlock();
  598. return net;
  599. }
  600. EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
  601. static __net_init int net_ns_net_init(struct net *net)
  602. {
  603. #ifdef CONFIG_NET_NS
  604. net->ns.ops = &netns_operations;
  605. #endif
  606. return ns_alloc_inum(&net->ns);
  607. }
  608. static __net_exit void net_ns_net_exit(struct net *net)
  609. {
  610. ns_free_inum(&net->ns);
  611. }
  612. static struct pernet_operations __net_initdata net_ns_ops = {
  613. .init = net_ns_net_init,
  614. .exit = net_ns_net_exit,
  615. };
  616. static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = {
  617. [NETNSA_NONE] = { .type = NLA_UNSPEC },
  618. [NETNSA_NSID] = { .type = NLA_S32 },
  619. [NETNSA_PID] = { .type = NLA_U32 },
  620. [NETNSA_FD] = { .type = NLA_U32 },
  621. [NETNSA_TARGET_NSID] = { .type = NLA_S32 },
  622. };
  623. static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
  624. struct netlink_ext_ack *extack)
  625. {
  626. struct net *net = sock_net(skb->sk);
  627. struct nlattr *tb[NETNSA_MAX + 1];
  628. struct nlattr *nla;
  629. struct net *peer;
  630. int nsid, err;
  631. err = nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), tb,
  632. NETNSA_MAX, rtnl_net_policy, extack);
  633. if (err < 0)
  634. return err;
  635. if (!tb[NETNSA_NSID]) {
  636. NL_SET_ERR_MSG(extack, "nsid is missing");
  637. return -EINVAL;
  638. }
  639. nsid = nla_get_s32(tb[NETNSA_NSID]);
  640. if (tb[NETNSA_PID]) {
  641. peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
  642. nla = tb[NETNSA_PID];
  643. } else if (tb[NETNSA_FD]) {
  644. peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
  645. nla = tb[NETNSA_FD];
  646. } else {
  647. NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
  648. return -EINVAL;
  649. }
  650. if (IS_ERR(peer)) {
  651. NL_SET_BAD_ATTR(extack, nla);
  652. NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
  653. return PTR_ERR(peer);
  654. }
  655. spin_lock_bh(&net->nsid_lock);
  656. if (__peernet2id(net, peer) >= 0) {
  657. spin_unlock_bh(&net->nsid_lock);
  658. err = -EEXIST;
  659. NL_SET_BAD_ATTR(extack, nla);
  660. NL_SET_ERR_MSG(extack,
  661. "Peer netns already has a nsid assigned");
  662. goto out;
  663. }
  664. err = alloc_netid(net, peer, nsid);
  665. spin_unlock_bh(&net->nsid_lock);
  666. if (err >= 0) {
  667. rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid,
  668. nlh, GFP_KERNEL);
  669. err = 0;
  670. } else if (err == -ENOSPC && nsid >= 0) {
  671. err = -EEXIST;
  672. NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]);
  673. NL_SET_ERR_MSG(extack, "The specified nsid is already used");
  674. }
  675. out:
  676. put_net(peer);
  677. return err;
  678. }
  679. static int rtnl_net_get_size(void)
  680. {
  681. return NLMSG_ALIGN(sizeof(struct rtgenmsg))
  682. + nla_total_size(sizeof(s32)) /* NETNSA_NSID */
  683. + nla_total_size(sizeof(s32)) /* NETNSA_CURRENT_NSID */
  684. ;
  685. }
  686. struct net_fill_args {
  687. u32 portid;
  688. u32 seq;
  689. int flags;
  690. int cmd;
  691. int nsid;
  692. bool add_ref;
  693. int ref_nsid;
  694. };
  695. static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args)
  696. {
  697. struct nlmsghdr *nlh;
  698. struct rtgenmsg *rth;
  699. nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth),
  700. args->flags);
  701. if (!nlh)
  702. return -EMSGSIZE;
  703. rth = nlmsg_data(nlh);
  704. rth->rtgen_family = AF_UNSPEC;
  705. if (nla_put_s32(skb, NETNSA_NSID, args->nsid))
  706. goto nla_put_failure;
  707. if (args->add_ref &&
  708. nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid))
  709. goto nla_put_failure;
  710. nlmsg_end(skb, nlh);
  711. return 0;
  712. nla_put_failure:
  713. nlmsg_cancel(skb, nlh);
  714. return -EMSGSIZE;
  715. }
  716. static int rtnl_net_valid_getid_req(struct sk_buff *skb,
  717. const struct nlmsghdr *nlh,
  718. struct nlattr **tb,
  719. struct netlink_ext_ack *extack)
  720. {
  721. int i, err;
  722. if (!netlink_strict_get_check(skb))
  723. return nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg),
  724. tb, NETNSA_MAX, rtnl_net_policy,
  725. extack);
  726. err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
  727. NETNSA_MAX, rtnl_net_policy,
  728. extack);
  729. if (err)
  730. return err;
  731. for (i = 0; i <= NETNSA_MAX; i++) {
  732. if (!tb[i])
  733. continue;
  734. switch (i) {
  735. case NETNSA_PID:
  736. case NETNSA_FD:
  737. case NETNSA_NSID:
  738. case NETNSA_TARGET_NSID:
  739. break;
  740. default:
  741. NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request");
  742. return -EINVAL;
  743. }
  744. }
  745. return 0;
  746. }
  747. static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
  748. struct netlink_ext_ack *extack)
  749. {
  750. struct net *net = sock_net(skb->sk);
  751. struct nlattr *tb[NETNSA_MAX + 1];
  752. struct net_fill_args fillargs = {
  753. .portid = NETLINK_CB(skb).portid,
  754. .seq = nlh->nlmsg_seq,
  755. .cmd = RTM_NEWNSID,
  756. };
  757. struct net *peer, *target = net;
  758. struct nlattr *nla;
  759. struct sk_buff *msg;
  760. int err;
  761. err = rtnl_net_valid_getid_req(skb, nlh, tb, extack);
  762. if (err < 0)
  763. return err;
  764. if (tb[NETNSA_PID]) {
  765. peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
  766. nla = tb[NETNSA_PID];
  767. } else if (tb[NETNSA_FD]) {
  768. peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
  769. nla = tb[NETNSA_FD];
  770. } else if (tb[NETNSA_NSID]) {
  771. peer = get_net_ns_by_id(net, nla_get_s32(tb[NETNSA_NSID]));
  772. if (!peer)
  773. peer = ERR_PTR(-ENOENT);
  774. nla = tb[NETNSA_NSID];
  775. } else {
  776. NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
  777. return -EINVAL;
  778. }
  779. if (IS_ERR(peer)) {
  780. NL_SET_BAD_ATTR(extack, nla);
  781. NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
  782. return PTR_ERR(peer);
  783. }
  784. if (tb[NETNSA_TARGET_NSID]) {
  785. int id = nla_get_s32(tb[NETNSA_TARGET_NSID]);
  786. target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id);
  787. if (IS_ERR(target)) {
  788. NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]);
  789. NL_SET_ERR_MSG(extack,
  790. "Target netns reference is invalid");
  791. err = PTR_ERR(target);
  792. goto out;
  793. }
  794. fillargs.add_ref = true;
  795. fillargs.ref_nsid = peernet2id(net, peer);
  796. }
  797. msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
  798. if (!msg) {
  799. err = -ENOMEM;
  800. goto out;
  801. }
  802. fillargs.nsid = peernet2id(target, peer);
  803. err = rtnl_net_fill(msg, &fillargs);
  804. if (err < 0)
  805. goto err_out;
  806. err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid);
  807. goto out;
  808. err_out:
  809. nlmsg_free(msg);
  810. out:
  811. if (fillargs.add_ref)
  812. put_net(target);
  813. put_net(peer);
  814. return err;
  815. }
  816. struct rtnl_net_dump_cb {
  817. struct net *tgt_net;
  818. struct net *ref_net;
  819. struct sk_buff *skb;
  820. struct net_fill_args fillargs;
  821. int idx;
  822. int s_idx;
  823. };
  824. /* Runs in RCU-critical section. */
  825. static int rtnl_net_dumpid_one(int id, void *peer, void *data)
  826. {
  827. struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data;
  828. int ret;
  829. if (net_cb->idx < net_cb->s_idx)
  830. goto cont;
  831. net_cb->fillargs.nsid = id;
  832. if (net_cb->fillargs.add_ref)
  833. net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer);
  834. ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs);
  835. if (ret < 0)
  836. return ret;
  837. cont:
  838. net_cb->idx++;
  839. return 0;
  840. }
  841. static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk,
  842. struct rtnl_net_dump_cb *net_cb,
  843. struct netlink_callback *cb)
  844. {
  845. struct netlink_ext_ack *extack = cb->extack;
  846. struct nlattr *tb[NETNSA_MAX + 1];
  847. int err, i;
  848. err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
  849. NETNSA_MAX, rtnl_net_policy,
  850. extack);
  851. if (err < 0)
  852. return err;
  853. for (i = 0; i <= NETNSA_MAX; i++) {
  854. if (!tb[i])
  855. continue;
  856. if (i == NETNSA_TARGET_NSID) {
  857. struct net *net;
  858. net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i]));
  859. if (IS_ERR(net)) {
  860. NL_SET_BAD_ATTR(extack, tb[i]);
  861. NL_SET_ERR_MSG(extack,
  862. "Invalid target network namespace id");
  863. return PTR_ERR(net);
  864. }
  865. net_cb->fillargs.add_ref = true;
  866. net_cb->ref_net = net_cb->tgt_net;
  867. net_cb->tgt_net = net;
  868. } else {
  869. NL_SET_BAD_ATTR(extack, tb[i]);
  870. NL_SET_ERR_MSG(extack,
  871. "Unsupported attribute in dump request");
  872. return -EINVAL;
  873. }
  874. }
  875. return 0;
  876. }
  877. static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
  878. {
  879. struct rtnl_net_dump_cb net_cb = {
  880. .tgt_net = sock_net(skb->sk),
  881. .skb = skb,
  882. .fillargs = {
  883. .portid = NETLINK_CB(cb->skb).portid,
  884. .seq = cb->nlh->nlmsg_seq,
  885. .flags = NLM_F_MULTI,
  886. .cmd = RTM_NEWNSID,
  887. },
  888. .idx = 0,
  889. .s_idx = cb->args[0],
  890. };
  891. int err = 0;
  892. if (cb->strict_check) {
  893. err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb);
  894. if (err < 0)
  895. goto end;
  896. }
  897. rcu_read_lock();
  898. idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb);
  899. rcu_read_unlock();
  900. cb->args[0] = net_cb.idx;
  901. end:
  902. if (net_cb.fillargs.add_ref)
  903. put_net(net_cb.tgt_net);
  904. return err < 0 ? err : skb->len;
  905. }
  906. static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
  907. struct nlmsghdr *nlh, gfp_t gfp)
  908. {
  909. struct net_fill_args fillargs = {
  910. .portid = portid,
  911. .seq = nlh ? nlh->nlmsg_seq : 0,
  912. .cmd = cmd,
  913. .nsid = id,
  914. };
  915. struct sk_buff *msg;
  916. int err = -ENOMEM;
  917. msg = nlmsg_new(rtnl_net_get_size(), gfp);
  918. if (!msg)
  919. goto out;
  920. err = rtnl_net_fill(msg, &fillargs);
  921. if (err < 0)
  922. goto err_out;
  923. rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp);
  924. return;
  925. err_out:
  926. nlmsg_free(msg);
  927. out:
  928. rtnl_set_sk_err(net, RTNLGRP_NSID, err);
  929. }
  930. static int __init net_ns_init(void)
  931. {
  932. struct net_generic *ng;
  933. #ifdef CONFIG_NET_NS
  934. net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
  935. SMP_CACHE_BYTES,
  936. SLAB_PANIC|SLAB_ACCOUNT, NULL);
  937. /* Create workqueue for cleanup */
  938. netns_wq = create_singlethread_workqueue("netns");
  939. if (!netns_wq)
  940. panic("Could not create netns workq");
  941. #endif
  942. ng = net_alloc_generic();
  943. if (!ng)
  944. panic("Could not allocate generic netns");
  945. rcu_assign_pointer(init_net.gen, ng);
  946. preempt_disable();
  947. __net_gen_cookie(&init_net);
  948. preempt_enable();
  949. down_write(&pernet_ops_rwsem);
  950. if (setup_net(&init_net, &init_user_ns))
  951. panic("Could not setup the initial network namespace");
  952. init_net_initialized = true;
  953. up_write(&pernet_ops_rwsem);
  954. if (register_pernet_subsys(&net_ns_ops))
  955. panic("Could not register network namespace subsystems");
  956. rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL,
  957. RTNL_FLAG_DOIT_UNLOCKED);
  958. rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid,
  959. RTNL_FLAG_DOIT_UNLOCKED);
  960. return 0;
  961. }
  962. pure_initcall(net_ns_init);
  963. #ifdef CONFIG_NET_NS
  964. static int __register_pernet_operations(struct list_head *list,
  965. struct pernet_operations *ops)
  966. {
  967. struct net *net;
  968. int error;
  969. LIST_HEAD(net_exit_list);
  970. list_add_tail(&ops->list, list);
  971. if (ops->init || (ops->id && ops->size)) {
  972. /* We held write locked pernet_ops_rwsem, and parallel
  973. * setup_net() and cleanup_net() are not possible.
  974. */
  975. for_each_net(net) {
  976. error = ops_init(ops, net);
  977. if (error)
  978. goto out_undo;
  979. list_add_tail(&net->exit_list, &net_exit_list);
  980. }
  981. }
  982. return 0;
  983. out_undo:
  984. /* If I have an error cleanup all namespaces I initialized */
  985. list_del(&ops->list);
  986. ops_pre_exit_list(ops, &net_exit_list);
  987. synchronize_rcu();
  988. ops_exit_list(ops, &net_exit_list);
  989. ops_free_list(ops, &net_exit_list);
  990. return error;
  991. }
  992. static void __unregister_pernet_operations(struct pernet_operations *ops)
  993. {
  994. struct net *net;
  995. LIST_HEAD(net_exit_list);
  996. list_del(&ops->list);
  997. /* See comment in __register_pernet_operations() */
  998. for_each_net(net)
  999. list_add_tail(&net->exit_list, &net_exit_list);
  1000. ops_pre_exit_list(ops, &net_exit_list);
  1001. synchronize_rcu();
  1002. ops_exit_list(ops, &net_exit_list);
  1003. ops_free_list(ops, &net_exit_list);
  1004. }
  1005. #else
  1006. static int __register_pernet_operations(struct list_head *list,
  1007. struct pernet_operations *ops)
  1008. {
  1009. if (!init_net_initialized) {
  1010. list_add_tail(&ops->list, list);
  1011. return 0;
  1012. }
  1013. return ops_init(ops, &init_net);
  1014. }
  1015. static void __unregister_pernet_operations(struct pernet_operations *ops)
  1016. {
  1017. if (!init_net_initialized) {
  1018. list_del(&ops->list);
  1019. } else {
  1020. LIST_HEAD(net_exit_list);
  1021. list_add(&init_net.exit_list, &net_exit_list);
  1022. ops_pre_exit_list(ops, &net_exit_list);
  1023. synchronize_rcu();
  1024. ops_exit_list(ops, &net_exit_list);
  1025. ops_free_list(ops, &net_exit_list);
  1026. }
  1027. }
  1028. #endif /* CONFIG_NET_NS */
  1029. static DEFINE_IDA(net_generic_ids);
  1030. static int register_pernet_operations(struct list_head *list,
  1031. struct pernet_operations *ops)
  1032. {
  1033. int error;
  1034. if (ops->id) {
  1035. error = ida_alloc_min(&net_generic_ids, MIN_PERNET_OPS_ID,
  1036. GFP_KERNEL);
  1037. if (error < 0)
  1038. return error;
  1039. *ops->id = error;
  1040. max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1);
  1041. }
  1042. error = __register_pernet_operations(list, ops);
  1043. if (error) {
  1044. rcu_barrier();
  1045. if (ops->id)
  1046. ida_free(&net_generic_ids, *ops->id);
  1047. }
  1048. return error;
  1049. }
  1050. static void unregister_pernet_operations(struct pernet_operations *ops)
  1051. {
  1052. __unregister_pernet_operations(ops);
  1053. rcu_barrier();
  1054. if (ops->id)
  1055. ida_free(&net_generic_ids, *ops->id);
  1056. }
  1057. /**
  1058. * register_pernet_subsys - register a network namespace subsystem
  1059. * @ops: pernet operations structure for the subsystem
  1060. *
  1061. * Register a subsystem which has init and exit functions
  1062. * that are called when network namespaces are created and
  1063. * destroyed respectively.
  1064. *
  1065. * When registered all network namespace init functions are
  1066. * called for every existing network namespace. Allowing kernel
  1067. * modules to have a race free view of the set of network namespaces.
  1068. *
  1069. * When a new network namespace is created all of the init
  1070. * methods are called in the order in which they were registered.
  1071. *
  1072. * When a network namespace is destroyed all of the exit methods
  1073. * are called in the reverse of the order with which they were
  1074. * registered.
  1075. */
  1076. int register_pernet_subsys(struct pernet_operations *ops)
  1077. {
  1078. int error;
  1079. down_write(&pernet_ops_rwsem);
  1080. error = register_pernet_operations(first_device, ops);
  1081. up_write(&pernet_ops_rwsem);
  1082. return error;
  1083. }
  1084. EXPORT_SYMBOL_GPL(register_pernet_subsys);
  1085. /**
  1086. * unregister_pernet_subsys - unregister a network namespace subsystem
  1087. * @ops: pernet operations structure to manipulate
  1088. *
  1089. * Remove the pernet operations structure from the list to be
  1090. * used when network namespaces are created or destroyed. In
  1091. * addition run the exit method for all existing network
  1092. * namespaces.
  1093. */
  1094. void unregister_pernet_subsys(struct pernet_operations *ops)
  1095. {
  1096. down_write(&pernet_ops_rwsem);
  1097. unregister_pernet_operations(ops);
  1098. up_write(&pernet_ops_rwsem);
  1099. }
  1100. EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
  1101. /**
  1102. * register_pernet_device - register a network namespace device
  1103. * @ops: pernet operations structure for the subsystem
  1104. *
  1105. * Register a device which has init and exit functions
  1106. * that are called when network namespaces are created and
  1107. * destroyed respectively.
  1108. *
  1109. * When registered all network namespace init functions are
  1110. * called for every existing network namespace. Allowing kernel
  1111. * modules to have a race free view of the set of network namespaces.
  1112. *
  1113. * When a new network namespace is created all of the init
  1114. * methods are called in the order in which they were registered.
  1115. *
  1116. * When a network namespace is destroyed all of the exit methods
  1117. * are called in the reverse of the order with which they were
  1118. * registered.
  1119. */
  1120. int register_pernet_device(struct pernet_operations *ops)
  1121. {
  1122. int error;
  1123. down_write(&pernet_ops_rwsem);
  1124. error = register_pernet_operations(&pernet_list, ops);
  1125. if (!error && (first_device == &pernet_list))
  1126. first_device = &ops->list;
  1127. up_write(&pernet_ops_rwsem);
  1128. return error;
  1129. }
  1130. EXPORT_SYMBOL_GPL(register_pernet_device);
  1131. /**
  1132. * unregister_pernet_device - unregister a network namespace netdevice
  1133. * @ops: pernet operations structure to manipulate
  1134. *
  1135. * Remove the pernet operations structure from the list to be
  1136. * used when network namespaces are created or destroyed. In
  1137. * addition run the exit method for all existing network
  1138. * namespaces.
  1139. */
  1140. void unregister_pernet_device(struct pernet_operations *ops)
  1141. {
  1142. down_write(&pernet_ops_rwsem);
  1143. if (&ops->list == first_device)
  1144. first_device = first_device->next;
  1145. unregister_pernet_operations(ops);
  1146. up_write(&pernet_ops_rwsem);
  1147. }
  1148. EXPORT_SYMBOL_GPL(unregister_pernet_device);
  1149. #ifdef CONFIG_NET_NS
  1150. static struct ns_common *netns_get(struct task_struct *task)
  1151. {
  1152. struct net *net = NULL;
  1153. struct nsproxy *nsproxy;
  1154. task_lock(task);
  1155. nsproxy = task->nsproxy;
  1156. if (nsproxy)
  1157. net = get_net(nsproxy->net_ns);
  1158. task_unlock(task);
  1159. return net ? &net->ns : NULL;
  1160. }
  1161. static inline struct net *to_net_ns(struct ns_common *ns)
  1162. {
  1163. return container_of(ns, struct net, ns);
  1164. }
  1165. static void netns_put(struct ns_common *ns)
  1166. {
  1167. put_net(to_net_ns(ns));
  1168. }
  1169. static int netns_install(struct nsset *nsset, struct ns_common *ns)
  1170. {
  1171. struct nsproxy *nsproxy = nsset->nsproxy;
  1172. struct net *net = to_net_ns(ns);
  1173. if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
  1174. !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
  1175. return -EPERM;
  1176. put_net(nsproxy->net_ns);
  1177. nsproxy->net_ns = get_net(net);
  1178. return 0;
  1179. }
  1180. static struct user_namespace *netns_owner(struct ns_common *ns)
  1181. {
  1182. return to_net_ns(ns)->user_ns;
  1183. }
  1184. const struct proc_ns_operations netns_operations = {
  1185. .name = "net",
  1186. .type = CLONE_NEWNET,
  1187. .get = netns_get,
  1188. .put = netns_put,
  1189. .install = netns_install,
  1190. .owner = netns_owner,
  1191. };
  1192. #endif