1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/mount.h> 3 #include <linux/pseudo_fs.h> 4 #include <linux/file.h> 5 #include <linux/fs.h> 6 #include <linux/proc_fs.h> 7 #include <linux/proc_ns.h> 8 #include <linux/magic.h> 9 #include <linux/ktime.h> 10 #include <linux/seq_file.h> 11 #include <linux/pid_namespace.h> 12 #include <linux/user_namespace.h> 13 #include <linux/nsfs.h> 14 #include <linux/uaccess.h> 15 #include <linux/mnt_namespace.h> 16 17 #include "mount.h" 18 #include "internal.h" 19 20 static struct vfsmount *nsfs_mnt; 21 22 static long ns_ioctl(struct file *filp, unsigned int ioctl, 23 unsigned long arg); 24 static const struct file_operations ns_file_operations = { 25 .unlocked_ioctl = ns_ioctl, 26 .compat_ioctl = compat_ptr_ioctl, 27 }; 28 29 static char *ns_dname(struct dentry *dentry, char *buffer, int buflen) 30 { 31 struct inode *inode = d_inode(dentry); 32 struct ns_common *ns = inode->i_private; 33 const struct proc_ns_operations *ns_ops = ns->ops; 34 35 return dynamic_dname(buffer, buflen, "%s:[%lu]", 36 ns_ops->name, inode->i_ino); 37 } 38 39 const struct dentry_operations ns_dentry_operations = { 40 .d_dname = ns_dname, 41 .d_prune = stashed_dentry_prune, 42 }; 43 44 static void nsfs_evict(struct inode *inode) 45 { 46 struct ns_common *ns = inode->i_private; 47 clear_inode(inode); 48 ns->ops->put(ns); 49 } 50 51 int ns_get_path_cb(struct path *path, ns_get_path_helper_t *ns_get_cb, 52 void *private_data) 53 { 54 struct ns_common *ns; 55 56 ns = ns_get_cb(private_data); 57 if (!ns) 58 return -ENOENT; 59 60 return path_from_stashed(&ns->stashed, nsfs_mnt, ns, path); 61 } 62 63 struct ns_get_path_task_args { 64 const struct proc_ns_operations *ns_ops; 65 struct task_struct *task; 66 }; 67 68 static struct ns_common *ns_get_path_task(void *private_data) 69 { 70 struct ns_get_path_task_args *args = private_data; 71 72 return args->ns_ops->get(args->task); 73 } 74 75 int ns_get_path(struct path *path, struct task_struct *task, 76 const struct proc_ns_operations *ns_ops) 77 { 78 struct ns_get_path_task_args args = { 79 .ns_ops = ns_ops, 80 .task = task, 81 }; 82 83 return ns_get_path_cb(path, ns_get_path_task, &args); 84 } 85 86 /** 87 * open_namespace - open a namespace 88 * @ns: the namespace to open 89 * 90 * This will consume a reference to @ns indendent of success or failure. 91 * 92 * Return: A file descriptor on success or a negative error code on failure. 93 */ 94 int open_namespace(struct ns_common *ns) 95 { 96 struct path path __free(path_put) = {}; 97 struct file *f; 98 int err; 99 100 /* call first to consume reference */ 101 err = path_from_stashed(&ns->stashed, nsfs_mnt, ns, &path); 102 if (err < 0) 103 return err; 104 105 CLASS(get_unused_fd, fd)(O_CLOEXEC); 106 if (fd < 0) 107 return fd; 108 109 f = dentry_open(&path, O_RDONLY, current_cred()); 110 if (IS_ERR(f)) 111 return PTR_ERR(f); 112 113 fd_install(fd, f); 114 return take_fd(fd); 115 } 116 117 int open_related_ns(struct ns_common *ns, 118 struct ns_common *(*get_ns)(struct ns_common *ns)) 119 { 120 struct ns_common *relative; 121 122 relative = get_ns(ns); 123 if (IS_ERR(relative)) 124 return PTR_ERR(relative); 125 126 return open_namespace(relative); 127 } 128 EXPORT_SYMBOL_GPL(open_related_ns); 129 130 static int copy_ns_info_to_user(const struct mnt_namespace *mnt_ns, 131 struct mnt_ns_info __user *uinfo, size_t usize, 132 struct mnt_ns_info *kinfo) 133 { 134 /* 135 * If userspace and the kernel have the same struct size it can just 136 * be copied. If userspace provides an older struct, only the bits that 137 * userspace knows about will be copied. If userspace provides a new 138 * struct, only the bits that the kernel knows aobut will be copied and 139 * the size value will be set to the size the kernel knows about. 140 */ 141 kinfo->size = min(usize, sizeof(*kinfo)); 142 kinfo->mnt_ns_id = mnt_ns->seq; 143 kinfo->nr_mounts = READ_ONCE(mnt_ns->nr_mounts); 144 /* Subtract the root mount of the mount namespace. */ 145 if (kinfo->nr_mounts) 146 kinfo->nr_mounts--; 147 148 if (copy_to_user(uinfo, kinfo, kinfo->size)) 149 return -EFAULT; 150 151 return 0; 152 } 153 154 static long ns_ioctl(struct file *filp, unsigned int ioctl, 155 unsigned long arg) 156 { 157 struct user_namespace *user_ns; 158 struct pid_namespace *pid_ns; 159 struct task_struct *tsk; 160 struct ns_common *ns = get_proc_ns(file_inode(filp)); 161 struct mnt_namespace *mnt_ns; 162 bool previous = false; 163 uid_t __user *argp; 164 uid_t uid; 165 int ret; 166 167 switch (ioctl) { 168 case NS_GET_USERNS: 169 return open_related_ns(ns, ns_get_owner); 170 case NS_GET_PARENT: 171 if (!ns->ops->get_parent) 172 return -EINVAL; 173 return open_related_ns(ns, ns->ops->get_parent); 174 case NS_GET_NSTYPE: 175 return ns->ops->type; 176 case NS_GET_OWNER_UID: 177 if (ns->ops->type != CLONE_NEWUSER) 178 return -EINVAL; 179 user_ns = container_of(ns, struct user_namespace, ns); 180 argp = (uid_t __user *) arg; 181 uid = from_kuid_munged(current_user_ns(), user_ns->owner); 182 return put_user(uid, argp); 183 case NS_GET_MNTNS_ID: { 184 __u64 __user *idp; 185 __u64 id; 186 187 if (ns->ops->type != CLONE_NEWNS) 188 return -EINVAL; 189 190 mnt_ns = container_of(ns, struct mnt_namespace, ns); 191 idp = (__u64 __user *)arg; 192 id = mnt_ns->seq; 193 return put_user(id, idp); 194 } 195 case NS_GET_PID_FROM_PIDNS: 196 fallthrough; 197 case NS_GET_TGID_FROM_PIDNS: 198 fallthrough; 199 case NS_GET_PID_IN_PIDNS: 200 fallthrough; 201 case NS_GET_TGID_IN_PIDNS: { 202 if (ns->ops->type != CLONE_NEWPID) 203 return -EINVAL; 204 205 ret = -ESRCH; 206 pid_ns = container_of(ns, struct pid_namespace, ns); 207 208 guard(rcu)(); 209 210 if (ioctl == NS_GET_PID_IN_PIDNS || 211 ioctl == NS_GET_TGID_IN_PIDNS) 212 tsk = find_task_by_vpid(arg); 213 else 214 tsk = find_task_by_pid_ns(arg, pid_ns); 215 if (!tsk) 216 break; 217 218 switch (ioctl) { 219 case NS_GET_PID_FROM_PIDNS: 220 ret = task_pid_vnr(tsk); 221 break; 222 case NS_GET_TGID_FROM_PIDNS: 223 ret = task_tgid_vnr(tsk); 224 break; 225 case NS_GET_PID_IN_PIDNS: 226 ret = task_pid_nr_ns(tsk, pid_ns); 227 break; 228 case NS_GET_TGID_IN_PIDNS: 229 ret = task_tgid_nr_ns(tsk, pid_ns); 230 break; 231 default: 232 ret = 0; 233 break; 234 } 235 236 if (!ret) 237 ret = -ESRCH; 238 return ret; 239 } 240 } 241 242 /* extensible ioctls */ 243 switch (_IOC_NR(ioctl)) { 244 case _IOC_NR(NS_MNT_GET_INFO): { 245 struct mnt_ns_info kinfo = {}; 246 struct mnt_ns_info __user *uinfo = (struct mnt_ns_info __user *)arg; 247 size_t usize = _IOC_SIZE(ioctl); 248 249 if (ns->ops->type != CLONE_NEWNS) 250 return -EINVAL; 251 252 if (!uinfo) 253 return -EINVAL; 254 255 if (usize < MNT_NS_INFO_SIZE_VER0) 256 return -EINVAL; 257 258 return copy_ns_info_to_user(to_mnt_ns(ns), uinfo, usize, &kinfo); 259 } 260 case _IOC_NR(NS_MNT_GET_PREV): 261 previous = true; 262 fallthrough; 263 case _IOC_NR(NS_MNT_GET_NEXT): { 264 struct mnt_ns_info kinfo = {}; 265 struct mnt_ns_info __user *uinfo = (struct mnt_ns_info __user *)arg; 266 struct path path __free(path_put) = {}; 267 struct file *f __free(fput) = NULL; 268 size_t usize = _IOC_SIZE(ioctl); 269 270 if (ns->ops->type != CLONE_NEWNS) 271 return -EINVAL; 272 273 if (usize < MNT_NS_INFO_SIZE_VER0) 274 return -EINVAL; 275 276 mnt_ns = get_sequential_mnt_ns(to_mnt_ns(ns), previous); 277 if (IS_ERR(mnt_ns)) 278 return PTR_ERR(mnt_ns); 279 280 ns = to_ns_common(mnt_ns); 281 /* Transfer ownership of @mnt_ns reference to @path. */ 282 ret = path_from_stashed(&ns->stashed, nsfs_mnt, ns, &path); 283 if (ret) 284 return ret; 285 286 CLASS(get_unused_fd, fd)(O_CLOEXEC); 287 if (fd < 0) 288 return fd; 289 290 f = dentry_open(&path, O_RDONLY, current_cred()); 291 if (IS_ERR(f)) 292 return PTR_ERR(f); 293 294 if (uinfo) { 295 /* 296 * If @uinfo is passed return all information about the 297 * mount namespace as well. 298 */ 299 ret = copy_ns_info_to_user(to_mnt_ns(ns), uinfo, usize, &kinfo); 300 if (ret) 301 return ret; 302 } 303 304 /* Transfer reference of @f to caller's fdtable. */ 305 fd_install(fd, no_free_ptr(f)); 306 /* File descriptor is live so hand it off to the caller. */ 307 return take_fd(fd); 308 } 309 default: 310 ret = -ENOTTY; 311 } 312 313 return ret; 314 } 315 316 int ns_get_name(char *buf, size_t size, struct task_struct *task, 317 const struct proc_ns_operations *ns_ops) 318 { 319 struct ns_common *ns; 320 int res = -ENOENT; 321 const char *name; 322 ns = ns_ops->get(task); 323 if (ns) { 324 name = ns_ops->real_ns_name ? : ns_ops->name; 325 res = snprintf(buf, size, "%s:[%u]", name, ns->inum); 326 ns_ops->put(ns); 327 } 328 return res; 329 } 330 331 bool proc_ns_file(const struct file *file) 332 { 333 return file->f_op == &ns_file_operations; 334 } 335 336 /** 337 * ns_match() - Returns true if current namespace matches dev/ino provided. 338 * @ns: current namespace 339 * @dev: dev_t from nsfs that will be matched against current nsfs 340 * @ino: ino_t from nsfs that will be matched against current nsfs 341 * 342 * Return: true if dev and ino matches the current nsfs. 343 */ 344 bool ns_match(const struct ns_common *ns, dev_t dev, ino_t ino) 345 { 346 return (ns->inum == ino) && (nsfs_mnt->mnt_sb->s_dev == dev); 347 } 348 349 350 static int nsfs_show_path(struct seq_file *seq, struct dentry *dentry) 351 { 352 struct inode *inode = d_inode(dentry); 353 const struct ns_common *ns = inode->i_private; 354 const struct proc_ns_operations *ns_ops = ns->ops; 355 356 seq_printf(seq, "%s:[%lu]", ns_ops->name, inode->i_ino); 357 return 0; 358 } 359 360 static const struct super_operations nsfs_ops = { 361 .statfs = simple_statfs, 362 .evict_inode = nsfs_evict, 363 .show_path = nsfs_show_path, 364 }; 365 366 static int nsfs_init_inode(struct inode *inode, void *data) 367 { 368 struct ns_common *ns = data; 369 370 inode->i_private = data; 371 inode->i_mode |= S_IRUGO; 372 inode->i_fop = &ns_file_operations; 373 inode->i_ino = ns->inum; 374 return 0; 375 } 376 377 static void nsfs_put_data(void *data) 378 { 379 struct ns_common *ns = data; 380 ns->ops->put(ns); 381 } 382 383 static const struct stashed_operations nsfs_stashed_ops = { 384 .init_inode = nsfs_init_inode, 385 .put_data = nsfs_put_data, 386 }; 387 388 static int nsfs_init_fs_context(struct fs_context *fc) 389 { 390 struct pseudo_fs_context *ctx = init_pseudo(fc, NSFS_MAGIC); 391 if (!ctx) 392 return -ENOMEM; 393 ctx->ops = &nsfs_ops; 394 ctx->dops = &ns_dentry_operations; 395 fc->s_fs_info = (void *)&nsfs_stashed_ops; 396 return 0; 397 } 398 399 static struct file_system_type nsfs = { 400 .name = "nsfs", 401 .init_fs_context = nsfs_init_fs_context, 402 .kill_sb = kill_anon_super, 403 }; 404 405 void __init nsfs_init(void) 406 { 407 nsfs_mnt = kern_mount(&nsfs); 408 if (IS_ERR(nsfs_mnt)) 409 panic("can't set nsfs up\n"); 410 nsfs_mnt->mnt_sb->s_flags &= ~SB_NOUSER; 411 } 412