blob: d87e6baa13238d11aca72f0edaae53ca1c220f61 [file] [log] [blame]
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -08001/*
2 * linux/ipc/namespace.c
3 * Copyright (C) 2006 Pavel Emelyanov <xemul@openvz.org> OpenVZ, SWsoft Inc.
4 */
5
6#include <linux/ipc.h>
7#include <linux/msg.h>
8#include <linux/ipc_namespace.h>
9#include <linux/rcupdate.h>
10#include <linux/nsproxy.h>
11#include <linux/slab.h>
Serge E. Hallyn7eafd7c2009-04-06 19:01:10 -070012#include <linux/fs.h>
13#include <linux/mount.h>
Serge E. Hallynb5154982011-03-23 16:43:23 -070014#include <linux/user_namespace.h>
David Howells0bb80f22013-04-12 01:50:06 +010015#include <linux/proc_ns.h>
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080016
17#include "util.h"
18
Eric W. Biedermanbcf58e72012-07-26 04:02:49 -070019static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
Serge E. Hallynb0e77592011-03-23 16:43:24 -070020 struct ipc_namespace *old_ns)
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080021{
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080022 struct ipc_namespace *ns;
Serge E. Hallyn7eafd7c2009-04-06 19:01:10 -070023 int err;
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080024
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080025 ns = kmalloc(sizeof(struct ipc_namespace), GFP_KERNEL);
26 if (ns == NULL)
Pierre Peiffered2ddbf2008-02-08 04:18:57 -080027 return ERR_PTR(-ENOMEM);
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080028
Al Viro6344c432014-11-01 00:45:45 -040029 err = ns_alloc_inum(&ns->ns);
Eric W. Biederman98f842e2011-06-15 10:21:48 -070030 if (err) {
31 kfree(ns);
32 return ERR_PTR(err);
33 }
Al Viro33c42942014-11-01 02:32:53 -040034 ns->ns.ops = &ipcns_operations;
Eric W. Biederman98f842e2011-06-15 10:21:48 -070035
Serge E. Hallyn7eafd7c2009-04-06 19:01:10 -070036 atomic_set(&ns->count, 1);
Eric W. Biedermanb2360172016-05-31 12:26:41 -050037 ns->user_ns = get_user_ns(user_ns);
38
Serge E. Hallyn7eafd7c2009-04-06 19:01:10 -070039 err = mq_init_ns(ns);
40 if (err) {
Eric W. Biedermanb2360172016-05-31 12:26:41 -050041 put_user_ns(ns->user_ns);
Al Viro6344c432014-11-01 00:45:45 -040042 ns_free_inum(&ns->ns);
Serge E. Hallyn7eafd7c2009-04-06 19:01:10 -070043 kfree(ns);
44 return ERR_PTR(err);
45 }
Nadia Derbey4d89dc62008-04-29 01:00:40 -070046
Pierre Peiffered2ddbf2008-02-08 04:18:57 -080047 sem_init_ns(ns);
48 msg_init_ns(ns);
49 shm_init_ns(ns);
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080050
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080051 return ns;
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080052}
53
Serge E. Hallynb0e77592011-03-23 16:43:24 -070054struct ipc_namespace *copy_ipcs(unsigned long flags,
Eric W. Biedermanbcf58e72012-07-26 04:02:49 -070055 struct user_namespace *user_ns, struct ipc_namespace *ns)
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080056{
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080057 if (!(flags & CLONE_NEWIPC))
Alexey Dobriyan64424282009-06-17 16:27:54 -070058 return get_ipc_ns(ns);
Eric W. Biedermanbcf58e72012-07-26 04:02:49 -070059 return create_ipc_ns(user_ns, ns);
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -080060}
61
Pierre Peiffer01b8b072008-02-08 04:18:57 -080062/*
63 * free_ipcs - free all ipcs of one type
64 * @ns: the namespace to remove the ipcs from
65 * @ids: the table of ipcs to free
66 * @free: the function called to free each individual ipc
67 *
68 * Called for each kind of ipc when an ipc_namespace exits.
69 */
70void free_ipcs(struct ipc_namespace *ns, struct ipc_ids *ids,
71 void (*free)(struct ipc_namespace *, struct kern_ipc_perm *))
72{
73 struct kern_ipc_perm *perm;
74 int next_id;
75 int total, in_use;
76
Davidlohr Buesod9a605e2013-09-11 14:26:24 -070077 down_write(&ids->rwsem);
Pierre Peiffer01b8b072008-02-08 04:18:57 -080078
79 in_use = ids->in_use;
80
81 for (total = 0, next_id = 0; total < in_use; next_id++) {
82 perm = idr_find(&ids->ipcs_idr, next_id);
83 if (perm == NULL)
84 continue;
Davidlohr Bueso32a27502013-09-11 14:26:29 -070085 rcu_read_lock();
86 ipc_lock_object(perm);
Pierre Peiffer01b8b072008-02-08 04:18:57 -080087 free(ns, perm);
88 total++;
89 }
Davidlohr Buesod9a605e2013-09-11 14:26:24 -070090 up_write(&ids->rwsem);
Pierre Peiffer01b8b072008-02-08 04:18:57 -080091}
92
Alexey Dobriyanb4188de2009-06-17 16:27:56 -070093static void free_ipc_ns(struct ipc_namespace *ns)
94{
Alexey Dobriyanb4188de2009-06-17 16:27:56 -070095 sem_exit_ns(ns);
96 msg_exit_ns(ns);
97 shm_exit_ns(ns);
Alexey Dobriyanb4188de2009-06-17 16:27:56 -070098
Serge E. Hallynb5154982011-03-23 16:43:23 -070099 put_user_ns(ns->user_ns);
Al Viro6344c432014-11-01 00:45:45 -0400100 ns_free_inum(&ns->ns);
Xiaotian Fengbe4d2502011-03-25 01:57:01 -0700101 kfree(ns);
Alexey Dobriyanb4188de2009-06-17 16:27:56 -0700102}
103
Serge E. Hallyn7eafd7c2009-04-06 19:01:10 -0700104/*
105 * put_ipc_ns - drop a reference to an ipc namespace.
106 * @ns: the namespace to put
107 *
108 * If this is the last task in the namespace exiting, and
109 * it is dropping the refcount to 0, then it can race with
110 * a task in another ipc namespace but in a mounts namespace
111 * which has this ipcns's mqueuefs mounted, doing some action
112 * with one of the mqueuefs files. That can raise the refcount.
113 * So dropping the refcount, and raising the refcount when
114 * accessing it through the VFS, are protected with mq_lock.
115 *
116 * (Clearly, a task raising the refcount on its own ipc_ns
117 * needn't take mq_lock since it can't race with the last task
118 * in the ipcns exiting).
119 */
120void put_ipc_ns(struct ipc_namespace *ns)
Pavel Emelyanovae5e1b22008-02-08 04:18:22 -0800121{
Serge E. Hallyn7eafd7c2009-04-06 19:01:10 -0700122 if (atomic_dec_and_lock(&ns->count, &mq_lock)) {
123 mq_clear_sbinfo(ns);
124 spin_unlock(&mq_lock);
125 mq_put_mnt(ns);
126 free_ipc_ns(ns);
127 }
128}
Eric W. Biedermana00eaf12010-03-07 18:48:39 -0800129
Al Viro3c041182014-11-01 00:25:30 -0400130static inline struct ipc_namespace *to_ipc_ns(struct ns_common *ns)
131{
132 return container_of(ns, struct ipc_namespace, ns);
133}
134
Al Viro64964522014-11-01 00:37:32 -0400135static struct ns_common *ipcns_get(struct task_struct *task)
Eric W. Biedermana00eaf12010-03-07 18:48:39 -0800136{
137 struct ipc_namespace *ns = NULL;
138 struct nsproxy *nsproxy;
139
Eric W. Biederman728dba32014-02-03 19:13:49 -0800140 task_lock(task);
141 nsproxy = task->nsproxy;
Eric W. Biedermana00eaf12010-03-07 18:48:39 -0800142 if (nsproxy)
143 ns = get_ipc_ns(nsproxy->ipc_ns);
Eric W. Biederman728dba32014-02-03 19:13:49 -0800144 task_unlock(task);
Eric W. Biedermana00eaf12010-03-07 18:48:39 -0800145
Al Viro3c041182014-11-01 00:25:30 -0400146 return ns ? &ns->ns : NULL;
Eric W. Biedermana00eaf12010-03-07 18:48:39 -0800147}
148
Al Viro64964522014-11-01 00:37:32 -0400149static void ipcns_put(struct ns_common *ns)
Eric W. Biedermana00eaf12010-03-07 18:48:39 -0800150{
Al Viro3c041182014-11-01 00:25:30 -0400151 return put_ipc_ns(to_ipc_ns(ns));
Eric W. Biedermana00eaf12010-03-07 18:48:39 -0800152}
153
Al Viro64964522014-11-01 00:37:32 -0400154static int ipcns_install(struct nsproxy *nsproxy, struct ns_common *new)
Eric W. Biedermana00eaf12010-03-07 18:48:39 -0800155{
Al Viro3c041182014-11-01 00:25:30 -0400156 struct ipc_namespace *ns = to_ipc_ns(new);
Eric W. Biederman5e4a0842012-12-14 07:55:36 -0800157 if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) ||
Eric W. Biedermanc7b96ac2013-03-20 12:49:49 -0700158 !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
Eric W. Biederman142e1d12012-07-26 01:13:20 -0700159 return -EPERM;
160
Eric W. Biedermana00eaf12010-03-07 18:48:39 -0800161 /* Ditch state from the old ipc namespace */
162 exit_sem(current);
163 put_ipc_ns(nsproxy->ipc_ns);
164 nsproxy->ipc_ns = get_ipc_ns(ns);
165 return 0;
166}
167
168const struct proc_ns_operations ipcns_operations = {
169 .name = "ipc",
170 .type = CLONE_NEWIPC,
171 .get = ipcns_get,
172 .put = ipcns_put,
173 .install = ipcns_install,
174};