1 /* SPDX-License-Identifier: GPL-2.0 */ 2 #ifndef _LINUX_NS_COMMON_TYPES_H 3 #define _LINUX_NS_COMMON_TYPES_H 4 5 #include <linux/atomic.h> 6 #include <linux/ns/nstree_types.h> 7 #include <linux/rbtree.h> 8 #include <linux/refcount.h> 9 #include <linux/types.h> 10 #include <uapi/linux/sched.h> 11 12 struct cgroup_namespace; 13 struct dentry; 14 struct ipc_namespace; 15 struct mnt_namespace; 16 struct net; 17 struct pid_namespace; 18 struct proc_ns_operations; 19 struct time_namespace; 20 struct user_namespace; 21 struct uts_namespace; 22 23 extern struct cgroup_namespace init_cgroup_ns; 24 extern struct ipc_namespace init_ipc_ns; 25 extern struct mnt_namespace init_mnt_ns; 26 extern struct net init_net; 27 extern struct pid_namespace init_pid_ns; 28 extern struct time_namespace init_time_ns; 29 extern struct user_namespace init_user_ns; 30 extern struct uts_namespace init_uts_ns; 31 32 extern const struct proc_ns_operations cgroupns_operations; 33 extern const struct proc_ns_operations ipcns_operations; 34 extern const struct proc_ns_operations mntns_operations; 35 extern const struct proc_ns_operations netns_operations; 36 extern const struct proc_ns_operations pidns_operations; 37 extern const struct proc_ns_operations pidns_for_children_operations; 38 extern const struct proc_ns_operations timens_operations; 39 extern const struct proc_ns_operations timens_for_children_operations; 40 extern const struct proc_ns_operations userns_operations; 41 extern const struct proc_ns_operations utsns_operations; 42 43 /* 44 * Namespace lifetimes are managed via a two-tier reference counting model: 45 * 46 * (1) __ns_ref (refcount_t): Main reference count tracking memory 47 * lifetime. Controls when the namespace structure itself is freed. 48 * It also pins the namespace on the namespace trees whereas (2) 49 * only regulates their visibility to userspace. 50 * 51 * (2) __ns_ref_active (atomic_t): Reference count tracking active users. 52 * Controls visibility of the namespace in the namespace trees. 53 * Any live task that uses the namespace (via nsproxy or cred) holds 54 * an active reference. Any open file descriptor or bind-mount of 55 * the namespace holds an active reference. Once all tasks have 56 * called exited their namespaces and all file descriptors and 57 * bind-mounts have been released the active reference count drops 58 * to zero and the namespace becomes inactive. IOW, the namespace 59 * cannot be listed or opened via file handles anymore. 60 * 61 * Note that it is valid to transition from active to inactive and 62 * back from inactive to active e.g., when resurrecting an inactive 63 * namespace tree via the SIOCGSKNS ioctl(). 64 * 65 * Relationship and lifecycle states: 66 * 67 * - Active (__ns_ref_active > 0): 68 * Namespace is actively used and visible to userspace. The namespace 69 * can be reopened via /proc/<pid>/ns/<ns_type>, via namespace file 70 * handles, or discovered via listns(). 71 * 72 * - Inactive (__ns_ref_active == 0, __ns_ref > 0): 73 * No tasks are actively using the namespace and it isn't pinned by 74 * any bind-mounts or open file descriptors anymore. But the namespace 75 * is still kept alive by internal references. For example, the user 76 * namespace could be pinned by an open file through file->f_cred 77 * references when one of the now defunct tasks had opened a file and 78 * handed the file descriptor off to another process via a UNIX 79 * sockets. Such references keep the namespace structure alive through 80 * __ns_ref but will not hold an active reference. 81 * 82 * - Destroyed (__ns_ref == 0): 83 * No references remain. The namespace is removed from the tree and freed. 84 * 85 * State transitions: 86 * 87 * Active -> Inactive: 88 * When the last task using the namespace exits it drops its active 89 * references to all namespaces. However, user and pid namespaces 90 * remain accessible until the task has been reaped. 91 * 92 * Inactive -> Active: 93 * An inactive namespace tree might be resurrected due to e.g., the 94 * SIOCGSKNS ioctl() on a socket. 95 * 96 * Inactive -> Destroyed: 97 * When __ns_ref drops to zero the namespace is removed from the 98 * namespaces trees and the memory is freed (after RCU grace period). 99 * 100 * Initial namespaces: 101 * Boot-time namespaces (init_net, init_pid_ns, etc.) start with 102 * __ns_ref_active = 1 and remain active forever. 103 * 104 * @ns_type: type of namespace (e.g., CLONE_NEWNET) 105 * @stashed: cached dentry to be used by the vfs 106 * @ops: namespace operations 107 * @inum: namespace inode number (quickly recycled for non-initial namespaces) 108 * @__ns_ref: main reference count (do not use directly) 109 * @ns_tree: namespace tree nodes and active reference count 110 */ 111 struct ns_common { 112 struct { 113 refcount_t __ns_ref; /* do not use directly */ 114 } ____cacheline_aligned_in_smp; 115 u32 ns_type; 116 struct dentry *stashed; 117 const struct proc_ns_operations *ops; 118 unsigned int inum; 119 #ifdef CONFIG_SECURITY 120 void *ns_security; 121 #endif 122 struct ns_tree; 123 struct rcu_head ns_rcu; 124 }; 125 126 #define to_ns_common(__ns) \ 127 _Generic((__ns), \ 128 struct cgroup_namespace *: &(__ns)->ns, \ 129 const struct cgroup_namespace *: &(__ns)->ns, \ 130 struct ipc_namespace *: &(__ns)->ns, \ 131 const struct ipc_namespace *: &(__ns)->ns, \ 132 struct mnt_namespace *: &(__ns)->ns, \ 133 const struct mnt_namespace *: &(__ns)->ns, \ 134 struct net *: &(__ns)->ns, \ 135 const struct net *: &(__ns)->ns, \ 136 struct pid_namespace *: &(__ns)->ns, \ 137 const struct pid_namespace *: &(__ns)->ns, \ 138 struct time_namespace *: &(__ns)->ns, \ 139 const struct time_namespace *: &(__ns)->ns, \ 140 struct user_namespace *: &(__ns)->ns, \ 141 const struct user_namespace *: &(__ns)->ns, \ 142 struct uts_namespace *: &(__ns)->ns, \ 143 const struct uts_namespace *: &(__ns)->ns) 144 145 #define ns_init_inum(__ns) \ 146 _Generic((__ns), \ 147 struct cgroup_namespace *: CGROUP_NS_INIT_INO, \ 148 struct ipc_namespace *: IPC_NS_INIT_INO, \ 149 struct mnt_namespace *: MNT_NS_INIT_INO, \ 150 struct net *: NET_NS_INIT_INO, \ 151 struct pid_namespace *: PID_NS_INIT_INO, \ 152 struct time_namespace *: TIME_NS_INIT_INO, \ 153 struct user_namespace *: USER_NS_INIT_INO, \ 154 struct uts_namespace *: UTS_NS_INIT_INO) 155 156 #define ns_init_ns(__ns) \ 157 _Generic((__ns), \ 158 struct cgroup_namespace *: &init_cgroup_ns, \ 159 struct ipc_namespace *: &init_ipc_ns, \ 160 struct mnt_namespace *: &init_mnt_ns, \ 161 struct net *: &init_net, \ 162 struct pid_namespace *: &init_pid_ns, \ 163 struct time_namespace *: &init_time_ns, \ 164 struct user_namespace *: &init_user_ns, \ 165 struct uts_namespace *: &init_uts_ns) 166 167 #define ns_init_id(__ns) \ 168 _Generic((__ns), \ 169 struct cgroup_namespace *: CGROUP_NS_INIT_ID, \ 170 struct ipc_namespace *: IPC_NS_INIT_ID, \ 171 struct mnt_namespace *: MNT_NS_INIT_ID, \ 172 struct net *: NET_NS_INIT_ID, \ 173 struct pid_namespace *: PID_NS_INIT_ID, \ 174 struct time_namespace *: TIME_NS_INIT_ID, \ 175 struct user_namespace *: USER_NS_INIT_ID, \ 176 struct uts_namespace *: UTS_NS_INIT_ID) 177 178 #define to_ns_operations(__ns) \ 179 _Generic((__ns), \ 180 struct cgroup_namespace *: (IS_ENABLED(CONFIG_CGROUPS) ? &cgroupns_operations : NULL), \ 181 struct ipc_namespace *: (IS_ENABLED(CONFIG_IPC_NS) ? &ipcns_operations : NULL), \ 182 struct mnt_namespace *: &mntns_operations, \ 183 struct net *: (IS_ENABLED(CONFIG_NET_NS) ? &netns_operations : NULL), \ 184 struct pid_namespace *: (IS_ENABLED(CONFIG_PID_NS) ? &pidns_operations : NULL), \ 185 struct time_namespace *: (IS_ENABLED(CONFIG_TIME_NS) ? &timens_operations : NULL), \ 186 struct user_namespace *: (IS_ENABLED(CONFIG_USER_NS) ? &userns_operations : NULL), \ 187 struct uts_namespace *: (IS_ENABLED(CONFIG_UTS_NS) ? &utsns_operations : NULL)) 188 189 /* 190 * FOR_EACH_NS_TYPE - Canonical list of namespace types 191 * 192 * Enumerates all (struct type, CLONE_NEW* flag) pairs. This is the 193 * single source of truth used to derive ns_common_type() and 194 * CLONE_NS_ALL. When adding a new namespace type, add a single entry 195 * here; all consumers update automatically. 196 * 197 * @X: Callback macro taking (struct_name, clone_flag) as arguments. 198 */ 199 #define FOR_EACH_NS_TYPE(X) \ 200 X(cgroup_namespace, CLONE_NEWCGROUP) \ 201 X(ipc_namespace, CLONE_NEWIPC) \ 202 X(mnt_namespace, CLONE_NEWNS) \ 203 X(net, CLONE_NEWNET) \ 204 X(pid_namespace, CLONE_NEWPID) \ 205 X(time_namespace, CLONE_NEWTIME) \ 206 X(user_namespace, CLONE_NEWUSER) \ 207 X(uts_namespace, CLONE_NEWUTS) 208 209 /* Bitmask of all known CLONE_NEW* flags. */ 210 #define _NS_TYPE_FLAG_OR(struct_name, flag) | (flag) 211 #define CLONE_NS_ALL (0 FOR_EACH_NS_TYPE(_NS_TYPE_FLAG_OR)) 212 213 /* 214 * ns_common_type - Map a namespace struct pointer to its CLONE_NEW* flag 215 * 216 * Uses a leading-comma pattern so the FOR_EACH_NS_TYPE expansion 217 * produces ", struct foo *: FLAG" entries without a trailing comma. 218 */ 219 #define _NS_TYPE_ASSOC(struct_name, flag) , struct struct_name *: (flag) 220 221 #define ns_common_type(__ns) _Generic((__ns)FOR_EACH_NS_TYPE(_NS_TYPE_ASSOC)) 222 223 #endif /* _LINUX_NS_COMMON_TYPES_H */ 224