xref: /linux/kernel/time/namespace.c (revision 22c55fb9eb92395d999b8404d73e58540d11bdd8) 
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Author: Andrei Vagin <avagin@openvz.org>
4  * Author: Dmitry Safonov <dima@arista.com>
5  */
6 
7 #include <linux/time_namespace.h>
8 #include <linux/user_namespace.h>
9 #include <linux/sched/signal.h>
10 #include <linux/sched/task.h>
11 #include <linux/clocksource.h>
12 #include <linux/seq_file.h>
13 #include <linux/proc_ns.h>
14 #include <linux/export.h>
15 #include <linux/time.h>
16 #include <linux/slab.h>
17 #include <linux/cred.h>
18 #include <linux/err.h>
19 #include <linux/mm.h>
20 
21 #include <vdso/datapage.h>
22 
23 ktime_t do_timens_ktime_to_host(clockid_t clockid, ktime_t tim,
24 				struct timens_offsets *ns_offsets)
25 {
26 	ktime_t offset;
27 
28 	switch (clockid) {
29 	case CLOCK_MONOTONIC:
30 		offset = timespec64_to_ktime(ns_offsets->monotonic);
31 		break;
32 	case CLOCK_BOOTTIME:
33 	case CLOCK_BOOTTIME_ALARM:
34 		offset = timespec64_to_ktime(ns_offsets->boottime);
35 		break;
36 	default:
37 		return tim;
38 	}
39 
40 	/*
41 	 * Check that @tim value is in [offset, KTIME_MAX + offset]
42 	 * and subtract offset.
43 	 */
44 	if (tim < offset) {
45 		/*
46 		 * User can specify @tim *absolute* value - if it's lesser than
47 		 * the time namespace's offset - it's already expired.
48 		 */
49 		tim = 0;
50 	} else {
51 		tim = ktime_sub(tim, offset);
52 		if (unlikely(tim > KTIME_MAX))
53 			tim = KTIME_MAX;
54 	}
55 
56 	return tim;
57 }
58 
59 static struct ucounts *inc_time_namespaces(struct user_namespace *ns)
60 {
61 	return inc_ucount(ns, current_euid(), UCOUNT_TIME_NAMESPACES);
62 }
63 
64 static void dec_time_namespaces(struct ucounts *ucounts)
65 {
66 	dec_ucount(ucounts, UCOUNT_TIME_NAMESPACES);
67 }
68 
69 /**
70  * clone_time_ns - Clone a time namespace
71  * @user_ns:	User namespace which owns a new namespace.
72  * @old_ns:	Namespace to clone
73  *
74  * Clone @old_ns and set the clone refcount to 1
75  *
76  * Return: The new namespace or ERR_PTR.
77  */
78 static struct time_namespace *clone_time_ns(struct user_namespace *user_ns,
79 					  struct time_namespace *old_ns)
80 {
81 	struct time_namespace *ns;
82 	struct ucounts *ucounts;
83 	int err;
84 
85 	err = -ENOSPC;
86 	ucounts = inc_time_namespaces(user_ns);
87 	if (!ucounts)
88 		goto fail;
89 
90 	err = -ENOMEM;
91 	ns = kmalloc(sizeof(*ns), GFP_KERNEL_ACCOUNT);
92 	if (!ns)
93 		goto fail_dec;
94 
95 	refcount_set(&ns->ns.count, 1);
96 
97 	ns->vvar_page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
98 	if (!ns->vvar_page)
99 		goto fail_free;
100 
101 	err = ns_alloc_inum(&ns->ns);
102 	if (err)
103 		goto fail_free_page;
104 
105 	ns->ucounts = ucounts;
106 	ns->ns.ops = &timens_operations;
107 	ns->user_ns = get_user_ns(user_ns);
108 	ns->offsets = old_ns->offsets;
109 	ns->frozen_offsets = false;
110 	return ns;
111 
112 fail_free_page:
113 	__free_page(ns->vvar_page);
114 fail_free:
115 	kfree(ns);
116 fail_dec:
117 	dec_time_namespaces(ucounts);
118 fail:
119 	return ERR_PTR(err);
120 }
121 
122 /**
123  * copy_time_ns - Create timens_for_children from @old_ns
124  * @flags:	Cloning flags
125  * @user_ns:	User namespace which owns a new namespace.
126  * @old_ns:	Namespace to clone
127  *
128  * If CLONE_NEWTIME specified in @flags, creates a new timens_for_children;
129  * adds a refcounter to @old_ns otherwise.
130  *
131  * Return: timens_for_children namespace or ERR_PTR.
132  */
133 struct time_namespace *copy_time_ns(unsigned long flags,
134 	struct user_namespace *user_ns, struct time_namespace *old_ns)
135 {
136 	if (!(flags & CLONE_NEWTIME))
137 		return get_time_ns(old_ns);
138 
139 	return clone_time_ns(user_ns, old_ns);
140 }
141 
142 static struct timens_offset offset_from_ts(struct timespec64 off)
143 {
144 	struct timens_offset ret;
145 
146 	ret.sec = off.tv_sec;
147 	ret.nsec = off.tv_nsec;
148 
149 	return ret;
150 }
151 
152 /*
153  * A time namespace VVAR page has the same layout as the VVAR page which
154  * contains the system wide VDSO data.
155  *
156  * For a normal task the VVAR pages are installed in the normal ordering:
157  *     VVAR
158  *     PVCLOCK
159  *     HVCLOCK
160  *     TIMENS   <- Not really required
161  *
162  * Now for a timens task the pages are installed in the following order:
163  *     TIMENS
164  *     PVCLOCK
165  *     HVCLOCK
166  *     VVAR
167  *
168  * The check for vdso_clock->clock_mode is in the unlikely path of
169  * the seq begin magic. So for the non-timens case most of the time
170  * 'seq' is even, so the branch is not taken.
171  *
172  * If 'seq' is odd, i.e. a concurrent update is in progress, the extra check
173  * for vdso_clock->clock_mode is a non-issue. The task is spin waiting for the
174  * update to finish and for 'seq' to become even anyway.
175  *
176  * Timens page has vdso_clock->clock_mode set to VDSO_CLOCKMODE_TIMENS which
177  * enforces the time namespace handling path.
178  */
179 static void timens_setup_vdso_clock_data(struct vdso_clock *vc,
180 					 struct time_namespace *ns)
181 {
182 	struct timens_offset *offset = vc->offset;
183 	struct timens_offset monotonic = offset_from_ts(ns->offsets.monotonic);
184 	struct timens_offset boottime = offset_from_ts(ns->offsets.boottime);
185 
186 	vc->seq				= 1;
187 	vc->clock_mode			= VDSO_CLOCKMODE_TIMENS;
188 	offset[CLOCK_MONOTONIC]		= monotonic;
189 	offset[CLOCK_MONOTONIC_RAW]	= monotonic;
190 	offset[CLOCK_MONOTONIC_COARSE]	= monotonic;
191 	offset[CLOCK_BOOTTIME]		= boottime;
192 	offset[CLOCK_BOOTTIME_ALARM]	= boottime;
193 }
194 
195 struct page *find_timens_vvar_page(struct vm_area_struct *vma)
196 {
197 	if (likely(vma->vm_mm == current->mm))
198 		return current->nsproxy->time_ns->vvar_page;
199 
200 	/*
201 	 * VM_PFNMAP | VM_IO protect .fault() handler from being called
202 	 * through interfaces like /proc/$pid/mem or
203 	 * process_vm_{readv,writev}() as long as there's no .access()
204 	 * in special_mapping_vmops().
205 	 * For more details check_vma_flags() and __access_remote_vm()
206 	 */
207 
208 	WARN(1, "vvar_page accessed remotely");
209 
210 	return NULL;
211 }
212 
213 /*
214  * Protects possibly multiple offsets writers racing each other
215  * and tasks entering the namespace.
216  */
217 static DEFINE_MUTEX(offset_lock);
218 
219 static void timens_set_vvar_page(struct task_struct *task,
220 				struct time_namespace *ns)
221 {
222 	struct vdso_time_data *vdata;
223 	struct vdso_clock *vc;
224 	unsigned int i;
225 
226 	if (ns == &init_time_ns)
227 		return;
228 
229 	/* Fast-path, taken by every task in namespace except the first. */
230 	if (likely(ns->frozen_offsets))
231 		return;
232 
233 	mutex_lock(&offset_lock);
234 	/* Nothing to-do: vvar_page has been already initialized. */
235 	if (ns->frozen_offsets)
236 		goto out;
237 
238 	ns->frozen_offsets = true;
239 	vdata = page_address(ns->vvar_page);
240 	vc = vdata->clock_data;
241 
242 	for (i = 0; i < CS_BASES; i++)
243 		timens_setup_vdso_clock_data(&vc[i], ns);
244 
245 	if (IS_ENABLED(CONFIG_POSIX_AUX_CLOCKS)) {
246 		for (i = 0; i < ARRAY_SIZE(vdata->aux_clock_data); i++)
247 			timens_setup_vdso_clock_data(&vdata->aux_clock_data[i], ns);
248 	}
249 
250 out:
251 	mutex_unlock(&offset_lock);
252 }
253 
254 void free_time_ns(struct time_namespace *ns)
255 {
256 	dec_time_namespaces(ns->ucounts);
257 	put_user_ns(ns->user_ns);
258 	ns_free_inum(&ns->ns);
259 	__free_page(ns->vvar_page);
260 	kfree(ns);
261 }
262 
263 static struct time_namespace *to_time_ns(struct ns_common *ns)
264 {
265 	return container_of(ns, struct time_namespace, ns);
266 }
267 
268 static struct ns_common *timens_get(struct task_struct *task)
269 {
270 	struct time_namespace *ns = NULL;
271 	struct nsproxy *nsproxy;
272 
273 	task_lock(task);
274 	nsproxy = task->nsproxy;
275 	if (nsproxy) {
276 		ns = nsproxy->time_ns;
277 		get_time_ns(ns);
278 	}
279 	task_unlock(task);
280 
281 	return ns ? &ns->ns : NULL;
282 }
283 
284 static struct ns_common *timens_for_children_get(struct task_struct *task)
285 {
286 	struct time_namespace *ns = NULL;
287 	struct nsproxy *nsproxy;
288 
289 	task_lock(task);
290 	nsproxy = task->nsproxy;
291 	if (nsproxy) {
292 		ns = nsproxy->time_ns_for_children;
293 		get_time_ns(ns);
294 	}
295 	task_unlock(task);
296 
297 	return ns ? &ns->ns : NULL;
298 }
299 
300 static void timens_put(struct ns_common *ns)
301 {
302 	put_time_ns(to_time_ns(ns));
303 }
304 
305 void timens_commit(struct task_struct *tsk, struct time_namespace *ns)
306 {
307 	timens_set_vvar_page(tsk, ns);
308 	vdso_join_timens(tsk, ns);
309 }
310 
311 static int timens_install(struct nsset *nsset, struct ns_common *new)
312 {
313 	struct nsproxy *nsproxy = nsset->nsproxy;
314 	struct time_namespace *ns = to_time_ns(new);
315 
316 	if (!current_is_single_threaded())
317 		return -EUSERS;
318 
319 	if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) ||
320 	    !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
321 		return -EPERM;
322 
323 	get_time_ns(ns);
324 	put_time_ns(nsproxy->time_ns);
325 	nsproxy->time_ns = ns;
326 
327 	get_time_ns(ns);
328 	put_time_ns(nsproxy->time_ns_for_children);
329 	nsproxy->time_ns_for_children = ns;
330 	return 0;
331 }
332 
333 void timens_on_fork(struct nsproxy *nsproxy, struct task_struct *tsk)
334 {
335 	struct ns_common *nsc = &nsproxy->time_ns_for_children->ns;
336 	struct time_namespace *ns = to_time_ns(nsc);
337 
338 	/* create_new_namespaces() already incremented the ref counter */
339 	if (nsproxy->time_ns == nsproxy->time_ns_for_children)
340 		return;
341 
342 	get_time_ns(ns);
343 	put_time_ns(nsproxy->time_ns);
344 	nsproxy->time_ns = ns;
345 
346 	timens_commit(tsk, ns);
347 }
348 
349 static struct user_namespace *timens_owner(struct ns_common *ns)
350 {
351 	return to_time_ns(ns)->user_ns;
352 }
353 
354 static void show_offset(struct seq_file *m, int clockid, struct timespec64 *ts)
355 {
356 	char *clock;
357 
358 	switch (clockid) {
359 	case CLOCK_BOOTTIME:
360 		clock = "boottime";
361 		break;
362 	case CLOCK_MONOTONIC:
363 		clock = "monotonic";
364 		break;
365 	default:
366 		clock = "unknown";
367 		break;
368 	}
369 	seq_printf(m, "%-10s %10lld %9ld\n", clock, ts->tv_sec, ts->tv_nsec);
370 }
371 
372 void proc_timens_show_offsets(struct task_struct *p, struct seq_file *m)
373 {
374 	struct ns_common *ns;
375 	struct time_namespace *time_ns;
376 
377 	ns = timens_for_children_get(p);
378 	if (!ns)
379 		return;
380 	time_ns = to_time_ns(ns);
381 
382 	show_offset(m, CLOCK_MONOTONIC, &time_ns->offsets.monotonic);
383 	show_offset(m, CLOCK_BOOTTIME, &time_ns->offsets.boottime);
384 	put_time_ns(time_ns);
385 }
386 
387 int proc_timens_set_offset(struct file *file, struct task_struct *p,
388 			   struct proc_timens_offset *offsets, int noffsets)
389 {
390 	struct ns_common *ns;
391 	struct time_namespace *time_ns;
392 	struct timespec64 tp;
393 	int i, err;
394 
395 	ns = timens_for_children_get(p);
396 	if (!ns)
397 		return -ESRCH;
398 	time_ns = to_time_ns(ns);
399 
400 	if (!file_ns_capable(file, time_ns->user_ns, CAP_SYS_TIME)) {
401 		put_time_ns(time_ns);
402 		return -EPERM;
403 	}
404 
405 	for (i = 0; i < noffsets; i++) {
406 		struct proc_timens_offset *off = &offsets[i];
407 
408 		switch (off->clockid) {
409 		case CLOCK_MONOTONIC:
410 			ktime_get_ts64(&tp);
411 			break;
412 		case CLOCK_BOOTTIME:
413 			ktime_get_boottime_ts64(&tp);
414 			break;
415 		default:
416 			err = -EINVAL;
417 			goto out;
418 		}
419 
420 		err = -ERANGE;
421 
422 		if (off->val.tv_sec > KTIME_SEC_MAX ||
423 		    off->val.tv_sec < -KTIME_SEC_MAX)
424 			goto out;
425 
426 		tp = timespec64_add(tp, off->val);
427 		/*
428 		 * KTIME_SEC_MAX is divided by 2 to be sure that KTIME_MAX is
429 		 * still unreachable.
430 		 */
431 		if (tp.tv_sec < 0 || tp.tv_sec > KTIME_SEC_MAX / 2)
432 			goto out;
433 	}
434 
435 	mutex_lock(&offset_lock);
436 	if (time_ns->frozen_offsets) {
437 		err = -EACCES;
438 		goto out_unlock;
439 	}
440 
441 	err = 0;
442 	/* Don't report errors after this line */
443 	for (i = 0; i < noffsets; i++) {
444 		struct proc_timens_offset *off = &offsets[i];
445 		struct timespec64 *offset = NULL;
446 
447 		switch (off->clockid) {
448 		case CLOCK_MONOTONIC:
449 			offset = &time_ns->offsets.monotonic;
450 			break;
451 		case CLOCK_BOOTTIME:
452 			offset = &time_ns->offsets.boottime;
453 			break;
454 		}
455 
456 		*offset = off->val;
457 	}
458 
459 out_unlock:
460 	mutex_unlock(&offset_lock);
461 out:
462 	put_time_ns(time_ns);
463 
464 	return err;
465 }
466 
467 const struct proc_ns_operations timens_operations = {
468 	.name		= "time",
469 	.type		= CLONE_NEWTIME,
470 	.get		= timens_get,
471 	.put		= timens_put,
472 	.install	= timens_install,
473 	.owner		= timens_owner,
474 };
475 
476 const struct proc_ns_operations timens_for_children_operations = {
477 	.name		= "time_for_children",
478 	.real_ns_name	= "time",
479 	.type		= CLONE_NEWTIME,
480 	.get		= timens_for_children_get,
481 	.put		= timens_put,
482 	.install	= timens_install,
483 	.owner		= timens_owner,
484 };
485 
486 struct time_namespace init_time_ns = {
487 	.ns.count	= REFCOUNT_INIT(3),
488 	.user_ns	= &init_user_ns,
489 	.ns.inum	= PROC_TIME_INIT_INO,
490 	.ns.ops		= &timens_operations,
491 	.frozen_offsets	= true,
492 };
493