Greg Kroah-Hartman | b244131 | 2017-11-01 15:07:57 +0100 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0 |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 2 | #include <linux/mount.h> |
David Howells | 059b20d | 2019-03-25 16:38:23 +0000 | [diff] [blame] | 3 | #include <linux/pseudo_fs.h> |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 4 | #include <linux/file.h> |
| 5 | #include <linux/fs.h> |
Eric Biggers | 7bebd69e | 2020-01-04 12:59:52 -0800 | [diff] [blame] | 6 | #include <linux/proc_fs.h> |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 7 | #include <linux/proc_ns.h> |
| 8 | #include <linux/magic.h> |
| 9 | #include <linux/ktime.h> |
Eric W. Biederman | 75509fd | 2015-05-24 12:49:04 -0500 | [diff] [blame] | 10 | #include <linux/seq_file.h> |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 11 | #include <linux/user_namespace.h> |
| 12 | #include <linux/nsfs.h> |
Michael Kerrisk (man-pages) | d95fa3c | 2017-01-25 14:04:15 +1300 | [diff] [blame] | 13 | #include <linux/uaccess.h> |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 14 | |
Eric Biggers | 7bebd69e | 2020-01-04 12:59:52 -0800 | [diff] [blame] | 15 | #include "internal.h" |
| 16 | |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 17 | static struct vfsmount *nsfs_mnt; |
| 18 | |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 19 | static long ns_ioctl(struct file *filp, unsigned int ioctl, |
| 20 | unsigned long arg); |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 21 | static const struct file_operations ns_file_operations = { |
| 22 | .llseek = no_llseek, |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 23 | .unlocked_ioctl = ns_ioctl, |
Thomas Weißschuh | 1cb925c | 2023-01-11 16:46:30 +0000 | [diff] [blame] | 24 | .compat_ioctl = compat_ptr_ioctl, |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 25 | }; |
| 26 | |
| 27 | static char *ns_dname(struct dentry *dentry, char *buffer, int buflen) |
| 28 | { |
David Howells | 75c3cfa | 2015-03-17 22:26:12 +0000 | [diff] [blame] | 29 | struct inode *inode = d_inode(dentry); |
Christian Brauner | 1fa08ae | 2024-02-18 14:51:23 +0100 | [diff] [blame] | 30 | struct ns_common *ns = inode->i_private; |
| 31 | const struct proc_ns_operations *ns_ops = ns->ops; |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 32 | |
Al Viro | 0f60d28 | 2022-01-30 15:03:49 -0500 | [diff] [blame] | 33 | return dynamic_dname(buffer, buflen, "%s:[%lu]", |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 34 | ns_ops->name, inode->i_ino); |
| 35 | } |
| 36 | |
Christian Brauner | 2558e3b | 2024-02-21 09:59:51 +0100 | [diff] [blame] | 37 | const struct dentry_operations ns_dentry_operations = { |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 38 | .d_delete = always_delete_dentry, |
| 39 | .d_dname = ns_dname, |
Christian Brauner | 2558e3b | 2024-02-21 09:59:51 +0100 | [diff] [blame] | 40 | .d_prune = stashed_dentry_prune, |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 41 | }; |
| 42 | |
| 43 | static void nsfs_evict(struct inode *inode) |
| 44 | { |
| 45 | struct ns_common *ns = inode->i_private; |
| 46 | clear_inode(inode); |
| 47 | ns->ops->put(ns); |
| 48 | } |
| 49 | |
Aleksa Sarai | ce623f8 | 2019-12-07 01:13:27 +1100 | [diff] [blame] | 50 | int ns_get_path_cb(struct path *path, ns_get_path_helper_t *ns_get_cb, |
Jakub Kicinski | cdab6ba | 2017-12-27 18:39:08 -0800 | [diff] [blame] | 51 | void *private_data) |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 52 | { |
Christian Brauner | 159a0d9 | 2024-02-18 14:52:24 +0100 | [diff] [blame] | 53 | struct ns_common *ns; |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 54 | |
Christian Brauner | 159a0d9 | 2024-02-18 14:52:24 +0100 | [diff] [blame] | 55 | ns = ns_get_cb(private_data); |
| 56 | if (!ns) |
| 57 | return -ENOENT; |
Christian Brauner | e9c5263 | 2024-03-01 10:26:03 +0100 | [diff] [blame] | 58 | |
Christian Brauner | 9d9539d | 2024-03-12 10:39:44 +0100 | [diff] [blame] | 59 | return path_from_stashed(&ns->stashed, nsfs_mnt, ns, path); |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 60 | } |
| 61 | |
Jakub Kicinski | cdab6ba | 2017-12-27 18:39:08 -0800 | [diff] [blame] | 62 | struct ns_get_path_task_args { |
| 63 | const struct proc_ns_operations *ns_ops; |
| 64 | struct task_struct *task; |
| 65 | }; |
| 66 | |
| 67 | static struct ns_common *ns_get_path_task(void *private_data) |
| 68 | { |
| 69 | struct ns_get_path_task_args *args = private_data; |
| 70 | |
| 71 | return args->ns_ops->get(args->task); |
| 72 | } |
| 73 | |
Aleksa Sarai | ce623f8 | 2019-12-07 01:13:27 +1100 | [diff] [blame] | 74 | int ns_get_path(struct path *path, struct task_struct *task, |
Jakub Kicinski | cdab6ba | 2017-12-27 18:39:08 -0800 | [diff] [blame] | 75 | const struct proc_ns_operations *ns_ops) |
| 76 | { |
| 77 | struct ns_get_path_task_args args = { |
| 78 | .ns_ops = ns_ops, |
| 79 | .task = task, |
| 80 | }; |
| 81 | |
| 82 | return ns_get_path_cb(path, ns_get_path_task, &args); |
| 83 | } |
| 84 | |
Andrey Vagin | c62cce2 | 2016-10-24 18:29:13 -0700 | [diff] [blame] | 85 | int open_related_ns(struct ns_common *ns, |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 86 | struct ns_common *(*get_ns)(struct ns_common *ns)) |
| 87 | { |
| 88 | struct path path = {}; |
Christian Brauner | 159a0d9 | 2024-02-18 14:52:24 +0100 | [diff] [blame] | 89 | struct ns_common *relative; |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 90 | struct file *f; |
Aleksa Sarai | ce623f8 | 2019-12-07 01:13:27 +1100 | [diff] [blame] | 91 | int err; |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 92 | int fd; |
| 93 | |
| 94 | fd = get_unused_fd_flags(O_CLOEXEC); |
| 95 | if (fd < 0) |
| 96 | return fd; |
| 97 | |
Christian Brauner | 159a0d9 | 2024-02-18 14:52:24 +0100 | [diff] [blame] | 98 | relative = get_ns(ns); |
| 99 | if (IS_ERR(relative)) { |
| 100 | put_unused_fd(fd); |
| 101 | return PTR_ERR(relative); |
| 102 | } |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 103 | |
Christian Brauner | 9d9539d | 2024-03-12 10:39:44 +0100 | [diff] [blame] | 104 | err = path_from_stashed(&relative->stashed, nsfs_mnt, relative, &path); |
Christian Brauner | 1fa08ae | 2024-02-18 14:51:23 +0100 | [diff] [blame] | 105 | if (err < 0) { |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 106 | put_unused_fd(fd); |
Aleksa Sarai | ce623f8 | 2019-12-07 01:13:27 +1100 | [diff] [blame] | 107 | return err; |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 108 | } |
| 109 | |
| 110 | f = dentry_open(&path, O_RDONLY, current_cred()); |
| 111 | path_put(&path); |
| 112 | if (IS_ERR(f)) { |
| 113 | put_unused_fd(fd); |
| 114 | fd = PTR_ERR(f); |
| 115 | } else |
| 116 | fd_install(fd, f); |
| 117 | |
| 118 | return fd; |
| 119 | } |
Kirill Tkhai | 24dce08 | 2018-02-14 16:40:05 +0300 | [diff] [blame] | 120 | EXPORT_SYMBOL_GPL(open_related_ns); |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 121 | |
| 122 | static long ns_ioctl(struct file *filp, unsigned int ioctl, |
| 123 | unsigned long arg) |
| 124 | { |
Michael Kerrisk (man-pages) | d95fa3c | 2017-01-25 14:04:15 +1300 | [diff] [blame] | 125 | struct user_namespace *user_ns; |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 126 | struct ns_common *ns = get_proc_ns(file_inode(filp)); |
Michael Kerrisk (man-pages) | d95fa3c | 2017-01-25 14:04:15 +1300 | [diff] [blame] | 127 | uid_t __user *argp; |
| 128 | uid_t uid; |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 129 | |
| 130 | switch (ioctl) { |
| 131 | case NS_GET_USERNS: |
| 132 | return open_related_ns(ns, ns_get_owner); |
Andrey Vagin | a7306ed | 2016-09-06 00:47:15 -0700 | [diff] [blame] | 133 | case NS_GET_PARENT: |
| 134 | if (!ns->ops->get_parent) |
| 135 | return -EINVAL; |
| 136 | return open_related_ns(ns, ns->ops->get_parent); |
Michael Kerrisk (man-pages) | e5ff5ce | 2017-01-25 14:03:36 +1300 | [diff] [blame] | 137 | case NS_GET_NSTYPE: |
| 138 | return ns->ops->type; |
Michael Kerrisk (man-pages) | d95fa3c | 2017-01-25 14:04:15 +1300 | [diff] [blame] | 139 | case NS_GET_OWNER_UID: |
| 140 | if (ns->ops->type != CLONE_NEWUSER) |
| 141 | return -EINVAL; |
| 142 | user_ns = container_of(ns, struct user_namespace, ns); |
| 143 | argp = (uid_t __user *) arg; |
| 144 | uid = from_kuid_munged(current_user_ns(), user_ns->owner); |
| 145 | return put_user(uid, argp); |
Andrey Vagin | 6786741 | 2016-09-06 00:47:14 -0700 | [diff] [blame] | 146 | default: |
| 147 | return -ENOTTY; |
| 148 | } |
| 149 | } |
| 150 | |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 151 | int ns_get_name(char *buf, size_t size, struct task_struct *task, |
| 152 | const struct proc_ns_operations *ns_ops) |
| 153 | { |
| 154 | struct ns_common *ns; |
| 155 | int res = -ENOENT; |
Kirill Tkhai | 25b14e9 | 2017-05-08 15:56:38 -0700 | [diff] [blame] | 156 | const char *name; |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 157 | ns = ns_ops->get(task); |
| 158 | if (ns) { |
Kirill Tkhai | 25b14e9 | 2017-05-08 15:56:38 -0700 | [diff] [blame] | 159 | name = ns_ops->real_ns_name ? : ns_ops->name; |
| 160 | res = snprintf(buf, size, "%s:[%u]", name, ns->inum); |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 161 | ns_ops->put(ns); |
| 162 | } |
| 163 | return res; |
| 164 | } |
| 165 | |
Christian Brauner | 303cc57 | 2020-05-05 16:04:31 +0200 | [diff] [blame] | 166 | bool proc_ns_file(const struct file *file) |
| 167 | { |
| 168 | return file->f_op == &ns_file_operations; |
| 169 | } |
| 170 | |
Carlos Neira | 1e2328e | 2020-03-04 17:41:55 -0300 | [diff] [blame] | 171 | /** |
| 172 | * ns_match() - Returns true if current namespace matches dev/ino provided. |
Lukas Bulwahn | 39ecb65 | 2022-11-07 12:08:17 +0100 | [diff] [blame] | 173 | * @ns: current namespace |
Carlos Neira | 1e2328e | 2020-03-04 17:41:55 -0300 | [diff] [blame] | 174 | * @dev: dev_t from nsfs that will be matched against current nsfs |
| 175 | * @ino: ino_t from nsfs that will be matched against current nsfs |
| 176 | * |
| 177 | * Return: true if dev and ino matches the current nsfs. |
| 178 | */ |
| 179 | bool ns_match(const struct ns_common *ns, dev_t dev, ino_t ino) |
| 180 | { |
| 181 | return (ns->inum == ino) && (nsfs_mnt->mnt_sb->s_dev == dev); |
| 182 | } |
| 183 | |
| 184 | |
Eric W. Biederman | 75509fd | 2015-05-24 12:49:04 -0500 | [diff] [blame] | 185 | static int nsfs_show_path(struct seq_file *seq, struct dentry *dentry) |
| 186 | { |
| 187 | struct inode *inode = d_inode(dentry); |
Christian Brauner | 1fa08ae | 2024-02-18 14:51:23 +0100 | [diff] [blame] | 188 | const struct ns_common *ns = inode->i_private; |
| 189 | const struct proc_ns_operations *ns_ops = ns->ops; |
Eric W. Biederman | 75509fd | 2015-05-24 12:49:04 -0500 | [diff] [blame] | 190 | |
Joe Perches | 6798a8c | 2015-09-11 13:07:48 -0700 | [diff] [blame] | 191 | seq_printf(seq, "%s:[%lu]", ns_ops->name, inode->i_ino); |
| 192 | return 0; |
Eric W. Biederman | 75509fd | 2015-05-24 12:49:04 -0500 | [diff] [blame] | 193 | } |
| 194 | |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 195 | static const struct super_operations nsfs_ops = { |
| 196 | .statfs = simple_statfs, |
| 197 | .evict_inode = nsfs_evict, |
Eric W. Biederman | 75509fd | 2015-05-24 12:49:04 -0500 | [diff] [blame] | 198 | .show_path = nsfs_show_path, |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 199 | }; |
David Howells | 059b20d | 2019-03-25 16:38:23 +0000 | [diff] [blame] | 200 | |
Christian Brauner | 9d9539d | 2024-03-12 10:39:44 +0100 | [diff] [blame] | 201 | static int nsfs_init_inode(struct inode *inode, void *data) |
Christian Brauner | e9c5263 | 2024-03-01 10:26:03 +0100 | [diff] [blame] | 202 | { |
Christian Brauner | 9d9539d | 2024-03-12 10:39:44 +0100 | [diff] [blame] | 203 | struct ns_common *ns = data; |
| 204 | |
Christian Brauner | e9c5263 | 2024-03-01 10:26:03 +0100 | [diff] [blame] | 205 | inode->i_private = data; |
| 206 | inode->i_mode |= S_IRUGO; |
| 207 | inode->i_fop = &ns_file_operations; |
Christian Brauner | 9d9539d | 2024-03-12 10:39:44 +0100 | [diff] [blame] | 208 | inode->i_ino = ns->inum; |
| 209 | return 0; |
Christian Brauner | e9c5263 | 2024-03-01 10:26:03 +0100 | [diff] [blame] | 210 | } |
| 211 | |
| 212 | static void nsfs_put_data(void *data) |
| 213 | { |
| 214 | struct ns_common *ns = data; |
| 215 | ns->ops->put(ns); |
| 216 | } |
| 217 | |
| 218 | static const struct stashed_operations nsfs_stashed_ops = { |
| 219 | .init_inode = nsfs_init_inode, |
| 220 | .put_data = nsfs_put_data, |
| 221 | }; |
| 222 | |
David Howells | 059b20d | 2019-03-25 16:38:23 +0000 | [diff] [blame] | 223 | static int nsfs_init_fs_context(struct fs_context *fc) |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 224 | { |
David Howells | 059b20d | 2019-03-25 16:38:23 +0000 | [diff] [blame] | 225 | struct pseudo_fs_context *ctx = init_pseudo(fc, NSFS_MAGIC); |
| 226 | if (!ctx) |
| 227 | return -ENOMEM; |
| 228 | ctx->ops = &nsfs_ops; |
| 229 | ctx->dops = &ns_dentry_operations; |
Christian Brauner | e9c5263 | 2024-03-01 10:26:03 +0100 | [diff] [blame] | 230 | fc->s_fs_info = (void *)&nsfs_stashed_ops; |
David Howells | 059b20d | 2019-03-25 16:38:23 +0000 | [diff] [blame] | 231 | return 0; |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 232 | } |
David Howells | 059b20d | 2019-03-25 16:38:23 +0000 | [diff] [blame] | 233 | |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 234 | static struct file_system_type nsfs = { |
| 235 | .name = "nsfs", |
David Howells | 059b20d | 2019-03-25 16:38:23 +0000 | [diff] [blame] | 236 | .init_fs_context = nsfs_init_fs_context, |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 237 | .kill_sb = kill_anon_super, |
| 238 | }; |
| 239 | |
| 240 | void __init nsfs_init(void) |
| 241 | { |
| 242 | nsfs_mnt = kern_mount(&nsfs); |
| 243 | if (IS_ERR(nsfs_mnt)) |
| 244 | panic("can't set nsfs up\n"); |
Linus Torvalds | 1751e8a | 2017-11-27 13:05:09 -0800 | [diff] [blame] | 245 | nsfs_mnt->mnt_sb->s_flags &= ~SB_NOUSER; |
Al Viro | e149ed2 | 2014-11-01 10:57:28 -0400 | [diff] [blame] | 246 | } |