xref: /linux/kernel/pid_namespace.c (revision a1ff5a7d78a036d6c2178ee5acd6ba4946243800)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Pid namespaces
4  *
5  * Authors:
6  *    (C) 2007 Pavel Emelyanov <xemul@openvz.org>, OpenVZ, SWsoft Inc.
7  *    (C) 2007 Sukadev Bhattiprolu <sukadev@us.ibm.com>, IBM
8  *     Many thanks to Oleg Nesterov for comments and help
9  *
10  */
11 
12 #include <linux/pid.h>
13 #include <linux/pid_namespace.h>
14 #include <linux/user_namespace.h>
15 #include <linux/syscalls.h>
16 #include <linux/cred.h>
17 #include <linux/err.h>
18 #include <linux/acct.h>
19 #include <linux/slab.h>
20 #include <linux/proc_ns.h>
21 #include <linux/reboot.h>
22 #include <linux/export.h>
23 #include <linux/sched/task.h>
24 #include <linux/sched/signal.h>
25 #include <linux/idr.h>
26 #include <uapi/linux/wait.h>
27 #include "pid_sysctl.h"
28 
29 static DEFINE_MUTEX(pid_caches_mutex);
30 static struct kmem_cache *pid_ns_cachep;
31 /* Write once array, filled from the beginning. */
32 static struct kmem_cache *pid_cache[MAX_PID_NS_LEVEL];
33 
34 /*
35  * creates the kmem cache to allocate pids from.
36  * @level: pid namespace level
37  */
38 
create_pid_cachep(unsigned int level)39 static struct kmem_cache *create_pid_cachep(unsigned int level)
40 {
41 	/* Level 0 is init_pid_ns.pid_cachep */
42 	struct kmem_cache **pkc = &pid_cache[level - 1];
43 	struct kmem_cache *kc;
44 	char name[4 + 10 + 1];
45 	unsigned int len;
46 
47 	kc = READ_ONCE(*pkc);
48 	if (kc)
49 		return kc;
50 
51 	snprintf(name, sizeof(name), "pid_%u", level + 1);
52 	len = struct_size_t(struct pid, numbers, level + 1);
53 	mutex_lock(&pid_caches_mutex);
54 	/* Name collision forces to do allocation under mutex. */
55 	if (!*pkc)
56 		*pkc = kmem_cache_create(name, len, 0,
57 					 SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL);
58 	mutex_unlock(&pid_caches_mutex);
59 	/* current can fail, but someone else can succeed. */
60 	return READ_ONCE(*pkc);
61 }
62 
inc_pid_namespaces(struct user_namespace * ns)63 static struct ucounts *inc_pid_namespaces(struct user_namespace *ns)
64 {
65 	return inc_ucount(ns, current_euid(), UCOUNT_PID_NAMESPACES);
66 }
67 
dec_pid_namespaces(struct ucounts * ucounts)68 static void dec_pid_namespaces(struct ucounts *ucounts)
69 {
70 	dec_ucount(ucounts, UCOUNT_PID_NAMESPACES);
71 }
72 
create_pid_namespace(struct user_namespace * user_ns,struct pid_namespace * parent_pid_ns)73 static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns,
74 	struct pid_namespace *parent_pid_ns)
75 {
76 	struct pid_namespace *ns;
77 	unsigned int level = parent_pid_ns->level + 1;
78 	struct ucounts *ucounts;
79 	int err;
80 
81 	err = -EINVAL;
82 	if (!in_userns(parent_pid_ns->user_ns, user_ns))
83 		goto out;
84 
85 	err = -ENOSPC;
86 	if (level > MAX_PID_NS_LEVEL)
87 		goto out;
88 	ucounts = inc_pid_namespaces(user_ns);
89 	if (!ucounts)
90 		goto out;
91 
92 	err = -ENOMEM;
93 	ns = kmem_cache_zalloc(pid_ns_cachep, GFP_KERNEL);
94 	if (ns == NULL)
95 		goto out_dec;
96 
97 	idr_init(&ns->idr);
98 
99 	ns->pid_cachep = create_pid_cachep(level);
100 	if (ns->pid_cachep == NULL)
101 		goto out_free_idr;
102 
103 	err = ns_alloc_inum(&ns->ns);
104 	if (err)
105 		goto out_free_idr;
106 	ns->ns.ops = &pidns_operations;
107 
108 	refcount_set(&ns->ns.count, 1);
109 	ns->level = level;
110 	ns->parent = get_pid_ns(parent_pid_ns);
111 	ns->user_ns = get_user_ns(user_ns);
112 	ns->ucounts = ucounts;
113 	ns->pid_allocated = PIDNS_ADDING;
114 #if defined(CONFIG_SYSCTL) && defined(CONFIG_MEMFD_CREATE)
115 	ns->memfd_noexec_scope = pidns_memfd_noexec_scope(parent_pid_ns);
116 #endif
117 	return ns;
118 
119 out_free_idr:
120 	idr_destroy(&ns->idr);
121 	kmem_cache_free(pid_ns_cachep, ns);
122 out_dec:
123 	dec_pid_namespaces(ucounts);
124 out:
125 	return ERR_PTR(err);
126 }
127 
delayed_free_pidns(struct rcu_head * p)128 static void delayed_free_pidns(struct rcu_head *p)
129 {
130 	struct pid_namespace *ns = container_of(p, struct pid_namespace, rcu);
131 
132 	dec_pid_namespaces(ns->ucounts);
133 	put_user_ns(ns->user_ns);
134 
135 	kmem_cache_free(pid_ns_cachep, ns);
136 }
137 
destroy_pid_namespace(struct pid_namespace * ns)138 static void destroy_pid_namespace(struct pid_namespace *ns)
139 {
140 	ns_free_inum(&ns->ns);
141 
142 	idr_destroy(&ns->idr);
143 	call_rcu(&ns->rcu, delayed_free_pidns);
144 }
145 
copy_pid_ns(unsigned long flags,struct user_namespace * user_ns,struct pid_namespace * old_ns)146 struct pid_namespace *copy_pid_ns(unsigned long flags,
147 	struct user_namespace *user_ns, struct pid_namespace *old_ns)
148 {
149 	if (!(flags & CLONE_NEWPID))
150 		return get_pid_ns(old_ns);
151 	if (task_active_pid_ns(current) != old_ns)
152 		return ERR_PTR(-EINVAL);
153 	return create_pid_namespace(user_ns, old_ns);
154 }
155 
put_pid_ns(struct pid_namespace * ns)156 void put_pid_ns(struct pid_namespace *ns)
157 {
158 	struct pid_namespace *parent;
159 
160 	while (ns != &init_pid_ns) {
161 		parent = ns->parent;
162 		if (!refcount_dec_and_test(&ns->ns.count))
163 			break;
164 		destroy_pid_namespace(ns);
165 		ns = parent;
166 	}
167 }
168 EXPORT_SYMBOL_GPL(put_pid_ns);
169 
zap_pid_ns_processes(struct pid_namespace * pid_ns)170 void zap_pid_ns_processes(struct pid_namespace *pid_ns)
171 {
172 	int nr;
173 	int rc;
174 	struct task_struct *task, *me = current;
175 	int init_pids = thread_group_leader(me) ? 1 : 2;
176 	struct pid *pid;
177 
178 	/* Don't allow any more processes into the pid namespace */
179 	disable_pid_allocation(pid_ns);
180 
181 	/*
182 	 * Ignore SIGCHLD causing any terminated children to autoreap.
183 	 * This speeds up the namespace shutdown, plus see the comment
184 	 * below.
185 	 */
186 	spin_lock_irq(&me->sighand->siglock);
187 	me->sighand->action[SIGCHLD - 1].sa.sa_handler = SIG_IGN;
188 	spin_unlock_irq(&me->sighand->siglock);
189 
190 	/*
191 	 * The last thread in the cgroup-init thread group is terminating.
192 	 * Find remaining pid_ts in the namespace, signal and wait for them
193 	 * to exit.
194 	 *
195 	 * Note:  This signals each threads in the namespace - even those that
196 	 * 	  belong to the same thread group, To avoid this, we would have
197 	 * 	  to walk the entire tasklist looking a processes in this
198 	 * 	  namespace, but that could be unnecessarily expensive if the
199 	 * 	  pid namespace has just a few processes. Or we need to
200 	 * 	  maintain a tasklist for each pid namespace.
201 	 *
202 	 */
203 	rcu_read_lock();
204 	read_lock(&tasklist_lock);
205 	nr = 2;
206 	idr_for_each_entry_continue(&pid_ns->idr, pid, nr) {
207 		task = pid_task(pid, PIDTYPE_PID);
208 		if (task && !__fatal_signal_pending(task))
209 			group_send_sig_info(SIGKILL, SEND_SIG_PRIV, task, PIDTYPE_MAX);
210 	}
211 	read_unlock(&tasklist_lock);
212 	rcu_read_unlock();
213 
214 	/*
215 	 * Reap the EXIT_ZOMBIE children we had before we ignored SIGCHLD.
216 	 * kernel_wait4() will also block until our children traced from the
217 	 * parent namespace are detached and become EXIT_DEAD.
218 	 */
219 	do {
220 		clear_thread_flag(TIF_SIGPENDING);
221 		clear_thread_flag(TIF_NOTIFY_SIGNAL);
222 		rc = kernel_wait4(-1, NULL, __WALL, NULL);
223 	} while (rc != -ECHILD);
224 
225 	/*
226 	 * kernel_wait4() misses EXIT_DEAD children, and EXIT_ZOMBIE
227 	 * process whose parents processes are outside of the pid
228 	 * namespace.  Such processes are created with setns()+fork().
229 	 *
230 	 * If those EXIT_ZOMBIE processes are not reaped by their
231 	 * parents before their parents exit, they will be reparented
232 	 * to pid_ns->child_reaper.  Thus pidns->child_reaper needs to
233 	 * stay valid until they all go away.
234 	 *
235 	 * The code relies on the pid_ns->child_reaper ignoring
236 	 * SIGCHILD to cause those EXIT_ZOMBIE processes to be
237 	 * autoreaped if reparented.
238 	 *
239 	 * Semantically it is also desirable to wait for EXIT_ZOMBIE
240 	 * processes before allowing the child_reaper to be reaped, as
241 	 * that gives the invariant that when the init process of a
242 	 * pid namespace is reaped all of the processes in the pid
243 	 * namespace are gone.
244 	 *
245 	 * Once all of the other tasks are gone from the pid_namespace
246 	 * free_pid() will awaken this task.
247 	 */
248 	for (;;) {
249 		set_current_state(TASK_INTERRUPTIBLE);
250 		if (pid_ns->pid_allocated == init_pids)
251 			break;
252 		schedule();
253 	}
254 	__set_current_state(TASK_RUNNING);
255 
256 	if (pid_ns->reboot)
257 		current->signal->group_exit_code = pid_ns->reboot;
258 
259 	acct_exit_ns(pid_ns);
260 	return;
261 }
262 
263 #ifdef CONFIG_CHECKPOINT_RESTORE
pid_ns_ctl_handler(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)264 static int pid_ns_ctl_handler(const struct ctl_table *table, int write,
265 		void *buffer, size_t *lenp, loff_t *ppos)
266 {
267 	struct pid_namespace *pid_ns = task_active_pid_ns(current);
268 	struct ctl_table tmp = *table;
269 	int ret, next;
270 
271 	if (write && !checkpoint_restore_ns_capable(pid_ns->user_ns))
272 		return -EPERM;
273 
274 	next = idr_get_cursor(&pid_ns->idr) - 1;
275 
276 	tmp.data = &next;
277 	ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
278 	if (!ret && write)
279 		idr_set_cursor(&pid_ns->idr, next + 1);
280 
281 	return ret;
282 }
283 
284 extern int pid_max;
285 static struct ctl_table pid_ns_ctl_table[] = {
286 	{
287 		.procname = "ns_last_pid",
288 		.maxlen = sizeof(int),
289 		.mode = 0666, /* permissions are checked in the handler */
290 		.proc_handler = pid_ns_ctl_handler,
291 		.extra1 = SYSCTL_ZERO,
292 		.extra2 = &pid_max,
293 	},
294 };
295 #endif	/* CONFIG_CHECKPOINT_RESTORE */
296 
reboot_pid_ns(struct pid_namespace * pid_ns,int cmd)297 int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd)
298 {
299 	if (pid_ns == &init_pid_ns)
300 		return 0;
301 
302 	switch (cmd) {
303 	case LINUX_REBOOT_CMD_RESTART2:
304 	case LINUX_REBOOT_CMD_RESTART:
305 		pid_ns->reboot = SIGHUP;
306 		break;
307 
308 	case LINUX_REBOOT_CMD_POWER_OFF:
309 	case LINUX_REBOOT_CMD_HALT:
310 		pid_ns->reboot = SIGINT;
311 		break;
312 	default:
313 		return -EINVAL;
314 	}
315 
316 	read_lock(&tasklist_lock);
317 	send_sig(SIGKILL, pid_ns->child_reaper, 1);
318 	read_unlock(&tasklist_lock);
319 
320 	do_exit(0);
321 
322 	/* Not reached */
323 	return 0;
324 }
325 
to_pid_ns(struct ns_common * ns)326 static inline struct pid_namespace *to_pid_ns(struct ns_common *ns)
327 {
328 	return container_of(ns, struct pid_namespace, ns);
329 }
330 
pidns_get(struct task_struct * task)331 static struct ns_common *pidns_get(struct task_struct *task)
332 {
333 	struct pid_namespace *ns;
334 
335 	rcu_read_lock();
336 	ns = task_active_pid_ns(task);
337 	if (ns)
338 		get_pid_ns(ns);
339 	rcu_read_unlock();
340 
341 	return ns ? &ns->ns : NULL;
342 }
343 
pidns_for_children_get(struct task_struct * task)344 static struct ns_common *pidns_for_children_get(struct task_struct *task)
345 {
346 	struct pid_namespace *ns = NULL;
347 
348 	task_lock(task);
349 	if (task->nsproxy) {
350 		ns = task->nsproxy->pid_ns_for_children;
351 		get_pid_ns(ns);
352 	}
353 	task_unlock(task);
354 
355 	if (ns) {
356 		read_lock(&tasklist_lock);
357 		if (!ns->child_reaper) {
358 			put_pid_ns(ns);
359 			ns = NULL;
360 		}
361 		read_unlock(&tasklist_lock);
362 	}
363 
364 	return ns ? &ns->ns : NULL;
365 }
366 
pidns_put(struct ns_common * ns)367 static void pidns_put(struct ns_common *ns)
368 {
369 	put_pid_ns(to_pid_ns(ns));
370 }
371 
pidns_install(struct nsset * nsset,struct ns_common * ns)372 static int pidns_install(struct nsset *nsset, struct ns_common *ns)
373 {
374 	struct nsproxy *nsproxy = nsset->nsproxy;
375 	struct pid_namespace *active = task_active_pid_ns(current);
376 	struct pid_namespace *ancestor, *new = to_pid_ns(ns);
377 
378 	if (!ns_capable(new->user_ns, CAP_SYS_ADMIN) ||
379 	    !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
380 		return -EPERM;
381 
382 	/*
383 	 * Only allow entering the current active pid namespace
384 	 * or a child of the current active pid namespace.
385 	 *
386 	 * This is required for fork to return a usable pid value and
387 	 * this maintains the property that processes and their
388 	 * children can not escape their current pid namespace.
389 	 */
390 	if (new->level < active->level)
391 		return -EINVAL;
392 
393 	ancestor = new;
394 	while (ancestor->level > active->level)
395 		ancestor = ancestor->parent;
396 	if (ancestor != active)
397 		return -EINVAL;
398 
399 	put_pid_ns(nsproxy->pid_ns_for_children);
400 	nsproxy->pid_ns_for_children = get_pid_ns(new);
401 	return 0;
402 }
403 
pidns_get_parent(struct ns_common * ns)404 static struct ns_common *pidns_get_parent(struct ns_common *ns)
405 {
406 	struct pid_namespace *active = task_active_pid_ns(current);
407 	struct pid_namespace *pid_ns, *p;
408 
409 	/* See if the parent is in the current namespace */
410 	pid_ns = p = to_pid_ns(ns)->parent;
411 	for (;;) {
412 		if (!p)
413 			return ERR_PTR(-EPERM);
414 		if (p == active)
415 			break;
416 		p = p->parent;
417 	}
418 
419 	return &get_pid_ns(pid_ns)->ns;
420 }
421 
pidns_owner(struct ns_common * ns)422 static struct user_namespace *pidns_owner(struct ns_common *ns)
423 {
424 	return to_pid_ns(ns)->user_ns;
425 }
426 
427 const struct proc_ns_operations pidns_operations = {
428 	.name		= "pid",
429 	.type		= CLONE_NEWPID,
430 	.get		= pidns_get,
431 	.put		= pidns_put,
432 	.install	= pidns_install,
433 	.owner		= pidns_owner,
434 	.get_parent	= pidns_get_parent,
435 };
436 
437 const struct proc_ns_operations pidns_for_children_operations = {
438 	.name		= "pid_for_children",
439 	.real_ns_name	= "pid",
440 	.type		= CLONE_NEWPID,
441 	.get		= pidns_for_children_get,
442 	.put		= pidns_put,
443 	.install	= pidns_install,
444 	.owner		= pidns_owner,
445 	.get_parent	= pidns_get_parent,
446 };
447 
pid_namespaces_init(void)448 static __init int pid_namespaces_init(void)
449 {
450 	pid_ns_cachep = KMEM_CACHE(pid_namespace, SLAB_PANIC | SLAB_ACCOUNT);
451 
452 #ifdef CONFIG_CHECKPOINT_RESTORE
453 	register_sysctl_init("kernel", pid_ns_ctl_table);
454 #endif
455 
456 	register_pid_ns_sysctl_table_vm();
457 	return 0;
458 }
459 
460 __initcall(pid_namespaces_init);
461