1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Copyright (c) 2025 Christian Brauner <brauner@kernel.org> */ 3 4 #include <linux/ns_common.h> 5 #include <linux/nstree.h> 6 #include <linux/proc_ns.h> 7 #include <linux/security.h> 8 #include <linux/user_namespace.h> 9 #include <linux/vfsdebug.h> 10 11 #ifdef CONFIG_DEBUG_VFS 12 static void ns_debug(struct ns_common *ns, const struct proc_ns_operations *ops) 13 { 14 switch (ns->ns_type) { 15 #ifdef CONFIG_CGROUPS 16 case CLONE_NEWCGROUP: 17 VFS_WARN_ON_ONCE(ops != &cgroupns_operations); 18 break; 19 #endif 20 #ifdef CONFIG_IPC_NS 21 case CLONE_NEWIPC: 22 VFS_WARN_ON_ONCE(ops != &ipcns_operations); 23 break; 24 #endif 25 case CLONE_NEWNS: 26 VFS_WARN_ON_ONCE(ops != &mntns_operations); 27 break; 28 #ifdef CONFIG_NET_NS 29 case CLONE_NEWNET: 30 VFS_WARN_ON_ONCE(ops != &netns_operations); 31 break; 32 #endif 33 #ifdef CONFIG_PID_NS 34 case CLONE_NEWPID: 35 VFS_WARN_ON_ONCE(ops != &pidns_operations); 36 break; 37 #endif 38 #ifdef CONFIG_TIME_NS 39 case CLONE_NEWTIME: 40 VFS_WARN_ON_ONCE(ops != &timens_operations); 41 break; 42 #endif 43 #ifdef CONFIG_USER_NS 44 case CLONE_NEWUSER: 45 VFS_WARN_ON_ONCE(ops != &userns_operations); 46 break; 47 #endif 48 #ifdef CONFIG_UTS_NS 49 case CLONE_NEWUTS: 50 VFS_WARN_ON_ONCE(ops != &utsns_operations); 51 break; 52 #endif 53 } 54 } 55 #endif 56 57 int __ns_common_init(struct ns_common *ns, u32 ns_type, const struct proc_ns_operations *ops, int inum) 58 { 59 int ret = 0; 60 61 refcount_set(&ns->__ns_ref, 1); 62 ns->stashed = NULL; 63 #ifdef CONFIG_SECURITY 64 ns->ns_security = NULL; 65 #endif 66 ns->ops = ops; 67 ns->ns_id = 0; 68 ns->ns_type = ns_type; 69 ns_tree_node_init(&ns->ns_tree_node); 70 ns_tree_node_init(&ns->ns_unified_node); 71 ns_tree_node_init(&ns->ns_owner_node); 72 ns_tree_root_init(&ns->ns_owner_root); 73 74 #ifdef CONFIG_DEBUG_VFS 75 ns_debug(ns, ops); 76 #endif 77 78 if (inum) 79 ns->inum = inum; 80 else 81 ret = proc_alloc_inum(&ns->inum); 82 if (ret) 83 return ret; 84 85 ret = security_namespace_init(ns); 86 if (ret) { 87 if (!inum) 88 proc_free_inum(ns->inum); 89 return ret; 90 } 91 92 /* 93 * Tree ref starts at 0. It's incremented when namespace enters 94 * active use (installed in nsproxy) and decremented when all 95 * active uses are gone. Initial namespaces are always active. 96 */ 97 if (is_ns_init_inum(ns)) 98 atomic_set(&ns->__ns_ref_active, 1); 99 else 100 atomic_set(&ns->__ns_ref_active, 0); 101 return 0; 102 } 103 104 void __ns_common_free(struct ns_common *ns) 105 { 106 security_namespace_free(ns); 107 108 if (ns->inum > MNT_NS_INO_SPECIAL_MAX) 109 proc_free_inum(ns->inum); 110 } 111 112 struct ns_common *__must_check ns_owner(struct ns_common *ns) 113 { 114 struct user_namespace *owner; 115 116 if (unlikely(!ns->ops)) 117 return NULL; 118 VFS_WARN_ON_ONCE(!ns->ops->owner); 119 owner = ns->ops->owner(ns); 120 VFS_WARN_ON_ONCE(!owner && ns != to_ns_common(&init_user_ns)); 121 if (!owner) 122 return NULL; 123 /* Skip init_user_ns as it's always active */ 124 if (owner == &init_user_ns) 125 return NULL; 126 return to_ns_common(owner); 127 } 128 129 /* 130 * The active reference count works by having each namespace that gets 131 * created take a single active reference on its owning user namespace. 132 * That single reference is only released once the child namespace's 133 * active count itself goes down. 134 * 135 * A regular namespace tree might look as follow: 136 * Legend: 137 * + : adding active reference 138 * - : dropping active reference 139 * x : always active (initial namespace) 140 * 141 * 142 * net_ns pid_ns 143 * \ / 144 * + + 145 * user_ns1 (2) 146 * | 147 * ipc_ns | uts_ns 148 * \ | / 149 * + + + 150 * user_ns2 (3) 151 * | 152 * cgroup_ns | mnt_ns 153 * \ | / 154 * x x x 155 * init_user_ns (1) 156 * 157 * If both net_ns and pid_ns put their last active reference on 158 * themselves it will cascade to user_ns1 dropping its own active 159 * reference and dropping one active reference on user_ns2: 160 * 161 * net_ns pid_ns 162 * \ / 163 * - - 164 * user_ns1 (0) 165 * | 166 * ipc_ns | uts_ns 167 * \ | / 168 * + - + 169 * user_ns2 (2) 170 * | 171 * cgroup_ns | mnt_ns 172 * \ | / 173 * x x x 174 * init_user_ns (1) 175 * 176 * The iteration stops once we reach a namespace that still has active 177 * references. 178 */ 179 void __ns_ref_active_put(struct ns_common *ns) 180 { 181 /* Initial namespaces are always active. */ 182 if (is_ns_init_id(ns)) 183 return; 184 185 if (!atomic_dec_and_test(&ns->__ns_ref_active)) { 186 VFS_WARN_ON_ONCE(__ns_ref_active_read(ns) < 0); 187 return; 188 } 189 190 VFS_WARN_ON_ONCE(is_ns_init_id(ns)); 191 VFS_WARN_ON_ONCE(!__ns_ref_read(ns)); 192 193 for (;;) { 194 ns = ns_owner(ns); 195 if (!ns) 196 return; 197 VFS_WARN_ON_ONCE(is_ns_init_id(ns)); 198 if (!atomic_dec_and_test(&ns->__ns_ref_active)) { 199 VFS_WARN_ON_ONCE(__ns_ref_active_read(ns) < 0); 200 return; 201 } 202 } 203 } 204 205 /* 206 * The active reference count works by having each namespace that gets 207 * created take a single active reference on its owning user namespace. 208 * That single reference is only released once the child namespace's 209 * active count itself goes down. This makes it possible to efficiently 210 * resurrect a namespace tree: 211 * 212 * A regular namespace tree might look as follow: 213 * Legend: 214 * + : adding active reference 215 * - : dropping active reference 216 * x : always active (initial namespace) 217 * 218 * 219 * net_ns pid_ns 220 * \ / 221 * + + 222 * user_ns1 (2) 223 * | 224 * ipc_ns | uts_ns 225 * \ | / 226 * + + + 227 * user_ns2 (3) 228 * | 229 * cgroup_ns | mnt_ns 230 * \ | / 231 * x x x 232 * init_user_ns (1) 233 * 234 * If both net_ns and pid_ns put their last active reference on 235 * themselves it will cascade to user_ns1 dropping its own active 236 * reference and dropping one active reference on user_ns2: 237 * 238 * net_ns pid_ns 239 * \ / 240 * - - 241 * user_ns1 (0) 242 * | 243 * ipc_ns | uts_ns 244 * \ | / 245 * + - + 246 * user_ns2 (2) 247 * | 248 * cgroup_ns | mnt_ns 249 * \ | / 250 * x x x 251 * init_user_ns (1) 252 * 253 * Assume the whole tree is dead but all namespaces are still active: 254 * 255 * net_ns pid_ns 256 * \ / 257 * - - 258 * user_ns1 (0) 259 * | 260 * ipc_ns | uts_ns 261 * \ | / 262 * - - - 263 * user_ns2 (0) 264 * | 265 * cgroup_ns | mnt_ns 266 * \ | / 267 * x x x 268 * init_user_ns (1) 269 * 270 * Now assume the net_ns gets resurrected (.e.g., via the SIOCGSKNS ioctl()): 271 * 272 * net_ns pid_ns 273 * \ / 274 * + - 275 * user_ns1 (0) 276 * | 277 * ipc_ns | uts_ns 278 * \ | / 279 * - + - 280 * user_ns2 (0) 281 * | 282 * cgroup_ns | mnt_ns 283 * \ | / 284 * x x x 285 * init_user_ns (1) 286 * 287 * If net_ns had a zero reference count and we bumped it we also need to 288 * take another reference on its owning user namespace. Similarly, if 289 * pid_ns had a zero reference count it also needs to take another 290 * reference on its owning user namespace. So both net_ns and pid_ns 291 * will each have their own reference on the owning user namespace. 292 * 293 * If the owning user namespace user_ns1 had a zero reference count then 294 * it also needs to take another reference on its owning user namespace 295 * and so on. 296 */ 297 void __ns_ref_active_get(struct ns_common *ns) 298 { 299 int prev; 300 301 /* Initial namespaces are always active. */ 302 if (is_ns_init_id(ns)) 303 return; 304 305 /* If we didn't resurrect the namespace we're done. */ 306 prev = atomic_fetch_add(1, &ns->__ns_ref_active); 307 VFS_WARN_ON_ONCE(prev < 0); 308 if (likely(prev)) 309 return; 310 311 /* 312 * We did resurrect it. Walk the ownership hierarchy upwards 313 * until we found an owning user namespace that is active. 314 */ 315 for (;;) { 316 ns = ns_owner(ns); 317 if (!ns) 318 return; 319 320 VFS_WARN_ON_ONCE(is_ns_init_id(ns)); 321 prev = atomic_fetch_add(1, &ns->__ns_ref_active); 322 VFS_WARN_ON_ONCE(prev < 0); 323 if (likely(prev)) 324 return; 325 } 326 } 327 328 bool may_see_all_namespaces(void) 329 { 330 return (task_active_pid_ns(current) == &init_pid_ns) && 331 ns_capable_noaudit(init_pid_ns.user_ns, CAP_SYS_ADMIN); 332 } 333