[linux.git] / fs / nsfs.c

// SPDX-License-Identifier: GPL-2.0
#include <linux/mount.h>
#include <linux/pseudo_fs.h>
#include <linux/file.h>
#include <linux/fs.h>
#include <linux/proc_fs.h>
#include <linux/proc_ns.h>
#include <linux/magic.h>
#include <linux/ktime.h>
#include <linux/seq_file.h>
#include <linux/pid_namespace.h>
#include <linux/user_namespace.h>
#include <linux/nsfs.h>
#include <linux/uaccess.h>

#include "mount.h"
#include "internal.h"

static struct vfsmount *nsfs_mnt;

static long ns_ioctl(struct file *filp, unsigned int ioctl,
			unsigned long arg);
static const struct file_operations ns_file_operations = {
	.llseek		= no_llseek,
	.unlocked_ioctl = ns_ioctl,
	.compat_ioctl   = compat_ptr_ioctl,
};

static char *ns_dname(struct dentry *dentry, char *buffer, int buflen)
{
	struct inode *inode = d_inode(dentry);
	struct ns_common *ns = inode->i_private;
	const struct proc_ns_operations *ns_ops = ns->ops;

	return dynamic_dname(buffer, buflen, "%s:[%lu]",
		ns_ops->name, inode->i_ino);
}

const struct dentry_operations ns_dentry_operations = {
	.d_delete	= always_delete_dentry,
	.d_dname	= ns_dname,
	.d_prune	= stashed_dentry_prune,
};

static void nsfs_evict(struct inode *inode)
{
	struct ns_common *ns = inode->i_private;
	clear_inode(inode);
	ns->ops->put(ns);
}

int ns_get_path_cb(struct path *path, ns_get_path_helper_t *ns_get_cb,
		     void *private_data)
{
	struct ns_common *ns;

	ns = ns_get_cb(private_data);
	if (!ns)
		return -ENOENT;

	return path_from_stashed(&ns->stashed, nsfs_mnt, ns, path);
}

struct ns_get_path_task_args {
	const struct proc_ns_operations *ns_ops;
	struct task_struct *task;
};

static struct ns_common *ns_get_path_task(void *private_data)
{
	struct ns_get_path_task_args *args = private_data;

	return args->ns_ops->get(args->task);
}

int ns_get_path(struct path *path, struct task_struct *task,
		  const struct proc_ns_operations *ns_ops)
{
	struct ns_get_path_task_args args = {
		.ns_ops	= ns_ops,
		.task	= task,
	};

	return ns_get_path_cb(path, ns_get_path_task, &args);
}

/**
 * open_namespace - open a namespace
 * @ns: the namespace to open
 *
 * This will consume a reference to @ns indendent of success or failure.
 *
 * Return: A file descriptor on success or a negative error code on failure.
 */
int open_namespace(struct ns_common *ns)
{
	struct path path __free(path_put) = {};
	struct file *f;
	int err;

	/* call first to consume reference */
	err = path_from_stashed(&ns->stashed, nsfs_mnt, ns, &path);
	if (err < 0)
		return err;

	CLASS(get_unused_fd, fd)(O_CLOEXEC);
	if (fd < 0)
		return fd;

	f = dentry_open(&path, O_RDONLY, current_cred());
	if (IS_ERR(f))
		return PTR_ERR(f);

	fd_install(fd, f);
	return take_fd(fd);
}

int open_related_ns(struct ns_common *ns,
		   struct ns_common *(*get_ns)(struct ns_common *ns))
{
	struct ns_common *relative;

	relative = get_ns(ns);
	if (IS_ERR(relative))
		return PTR_ERR(relative);

	return open_namespace(relative);
}
EXPORT_SYMBOL_GPL(open_related_ns);

static long ns_ioctl(struct file *filp, unsigned int ioctl,
			unsigned long arg)
{
	struct user_namespace *user_ns;
	struct pid_namespace *pid_ns;
	struct task_struct *tsk;
	struct ns_common *ns = get_proc_ns(file_inode(filp));
	uid_t __user *argp;
	uid_t uid;
	int ret;

	switch (ioctl) {
	case NS_GET_USERNS:
		return open_related_ns(ns, ns_get_owner);
	case NS_GET_PARENT:
		if (!ns->ops->get_parent)
			return -EINVAL;
		return open_related_ns(ns, ns->ops->get_parent);
	case NS_GET_NSTYPE:
		return ns->ops->type;
	case NS_GET_OWNER_UID:
		if (ns->ops->type != CLONE_NEWUSER)
			return -EINVAL;
		user_ns = container_of(ns, struct user_namespace, ns);
		argp = (uid_t __user *) arg;
		uid = from_kuid_munged(current_user_ns(), user_ns->owner);
		return put_user(uid, argp);
	case NS_GET_MNTNS_ID: {
		struct mnt_namespace *mnt_ns;
		__u64 __user *idp;
		__u64 id;

		if (ns->ops->type != CLONE_NEWNS)
			return -EINVAL;

		mnt_ns = container_of(ns, struct mnt_namespace, ns);
		idp = (__u64 __user *)arg;
		id = mnt_ns->seq;
		return put_user(id, idp);
	}
	case NS_GET_PID_FROM_PIDNS:
		fallthrough;
	case NS_GET_TGID_FROM_PIDNS:
		fallthrough;
	case NS_GET_PID_IN_PIDNS:
		fallthrough;
	case NS_GET_TGID_IN_PIDNS: {
		if (ns->ops->type != CLONE_NEWPID)
			return -EINVAL;

		ret = -ESRCH;
		pid_ns = container_of(ns, struct pid_namespace, ns);

		guard(rcu)();

		if (ioctl == NS_GET_PID_IN_PIDNS ||
		    ioctl == NS_GET_TGID_IN_PIDNS)
			tsk = find_task_by_vpid(arg);
		else
			tsk = find_task_by_pid_ns(arg, pid_ns);
		if (!tsk)
			break;

		switch (ioctl) {
		case NS_GET_PID_FROM_PIDNS:
			ret = task_pid_vnr(tsk);
			break;
		case NS_GET_TGID_FROM_PIDNS:
			ret = task_tgid_vnr(tsk);
			break;
		case NS_GET_PID_IN_PIDNS:
			ret = task_pid_nr_ns(tsk, pid_ns);
			break;
		case NS_GET_TGID_IN_PIDNS:
			ret = task_tgid_nr_ns(tsk, pid_ns);
			break;
		default:
			ret = 0;
			break;
		}

		if (!ret)
			ret = -ESRCH;
		break;
	}
	default:
		ret = -ENOTTY;
	}

	return ret;
}

int ns_get_name(char *buf, size_t size, struct task_struct *task,
			const struct proc_ns_operations *ns_ops)
{
	struct ns_common *ns;
	int res = -ENOENT;
	const char *name;
	ns = ns_ops->get(task);
	if (ns) {
		name = ns_ops->real_ns_name ? : ns_ops->name;
		res = snprintf(buf, size, "%s:[%u]", name, ns->inum);
		ns_ops->put(ns);
	}
	return res;
}

bool proc_ns_file(const struct file *file)
{
	return file->f_op == &ns_file_operations;
}

/**
 * ns_match() - Returns true if current namespace matches dev/ino provided.
 * @ns: current namespace
 * @dev: dev_t from nsfs that will be matched against current nsfs
 * @ino: ino_t from nsfs that will be matched against current nsfs
 *
 * Return: true if dev and ino matches the current nsfs.
 */
bool ns_match(const struct ns_common *ns, dev_t dev, ino_t ino)
{
	return (ns->inum == ino) && (nsfs_mnt->mnt_sb->s_dev == dev);
}


static int nsfs_show_path(struct seq_file *seq, struct dentry *dentry)
{
	struct inode *inode = d_inode(dentry);
	const struct ns_common *ns = inode->i_private;
	const struct proc_ns_operations *ns_ops = ns->ops;

	seq_printf(seq, "%s:[%lu]", ns_ops->name, inode->i_ino);
	return 0;
}

static const struct super_operations nsfs_ops = {
	.statfs = simple_statfs,
	.evict_inode = nsfs_evict,
	.show_path = nsfs_show_path,
};

static int nsfs_init_inode(struct inode *inode, void *data)
{
	struct ns_common *ns = data;

	inode->i_private = data;
	inode->i_mode |= S_IRUGO;
	inode->i_fop = &ns_file_operations;
	inode->i_ino = ns->inum;
	return 0;
}

static void nsfs_put_data(void *data)
{
	struct ns_common *ns = data;
	ns->ops->put(ns);
}

static const struct stashed_operations nsfs_stashed_ops = {
	.init_inode = nsfs_init_inode,
	.put_data = nsfs_put_data,
};

static int nsfs_init_fs_context(struct fs_context *fc)
{
	struct pseudo_fs_context *ctx = init_pseudo(fc, NSFS_MAGIC);
	if (!ctx)
		return -ENOMEM;
	ctx->ops = &nsfs_ops;
	ctx->dops = &ns_dentry_operations;
	fc->s_fs_info = (void *)&nsfs_stashed_ops;
	return 0;
}

static struct file_system_type nsfs = {
	.name = "nsfs",
	.init_fs_context = nsfs_init_fs_context,
	.kill_sb = kill_anon_super,
};

void __init nsfs_init(void)
{
	nsfs_mnt = kern_mount(&nsfs);
	if (IS_ERR(nsfs_mnt))
		panic("can't set nsfs up\n");
	nsfs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;
}
Commit	Line	Data
b2441318	1	// SPDX-License-Identifier: GPL-2.0
e149ed2b	2	#include <linux/mount.h>
059b20d9	3	#include <linux/pseudo_fs.h>
e149ed2b AV	4	#include <linux/file.h>
e149ed2b AV	5	#include <linux/fs.h>
7bebd69e	6	#include <linux/proc_fs.h>
e149ed2b AV	7	#include <linux/proc_ns.h>
	8	#include <linux/magic.h>
	9	#include <linux/ktime.h>
75509fd8	10	#include <linux/seq_file.h>
ca567df7	11	#include <linux/pid_namespace.h>
6786741d AV	12	#include <linux/user_namespace.h>
6786741d AV	13	#include <linux/nsfs.h>
d95fa3c7	14	#include <linux/uaccess.h>
e149ed2b	15
e8e43a1f	16	#include "mount.h"
7bebd69e EB	17	#include "internal.h"
7bebd69e EB	18
e149ed2b AV	19	static struct vfsmount *nsfs_mnt;
e149ed2b AV	20
6786741d AV	21	static long ns_ioctl(struct file *filp, unsigned int ioctl,
6786741d AV	22	unsigned long arg);
e149ed2b AV	23	static const struct file_operations ns_file_operations = {
e149ed2b AV	24	.llseek = no_llseek,
6786741d	25	.unlocked_ioctl = ns_ioctl,
1cb925c0	26	.compat_ioctl = compat_ptr_ioctl,
e149ed2b AV	27	};
	28
	29	static char ns_dname(struct dentry dentry, char *buffer, int buflen)
	30	{
75c3cfa8	31	struct inode *inode = d_inode(dentry);
1fa08aec CB	32	struct ns_common *ns = inode->i_private;
1fa08aec CB	33	const struct proc_ns_operations *ns_ops = ns->ops;
e149ed2b	34
0f60d288	35	return dynamic_dname(buffer, buflen, "%s:[%lu]",
e149ed2b AV	36	ns_ops->name, inode->i_ino);
	37	}
	38
2558e3b2	39	const struct dentry_operations ns_dentry_operations = {
e149ed2b AV	40	.d_delete = always_delete_dentry,
e149ed2b AV	41	.d_dname = ns_dname,
2558e3b2	42	.d_prune = stashed_dentry_prune,
e149ed2b AV	43	};
	44
	45	static void nsfs_evict(struct inode *inode)
	46	{
	47	struct ns_common *ns = inode->i_private;
	48	clear_inode(inode);
	49	ns->ops->put(ns);
	50	}
	51
ce623f89	52	int ns_get_path_cb(struct path path, ns_get_path_helper_t ns_get_cb,
cdab6ba8	53	void *private_data)
6786741d	54	{
159a0d9f CB	55	struct ns_common *ns;
	56
	57	ns = ns_get_cb(private_data);
	58	if (!ns)
	59	return -ENOENT;
e9c5263c	60
9d9539db	61	return path_from_stashed(&ns->stashed, nsfs_mnt, ns, path);
6786741d AV	62	}
6786741d AV	63
cdab6ba8 JK	64	struct ns_get_path_task_args {
	65	const struct proc_ns_operations *ns_ops;
	66	struct task_struct *task;
	67	};
	68
	69	static struct ns_common ns_get_path_task(void private_data)
	70	{
	71	struct ns_get_path_task_args *args = private_data;
	72
	73	return args->ns_ops->get(args->task);
	74	}
	75
ce623f89	76	int ns_get_path(struct path path, struct task_struct task,
cdab6ba8 JK	77	const struct proc_ns_operations *ns_ops)
	78	{
	79	struct ns_get_path_task_args args = {
	80	.ns_ops = ns_ops,
	81	.task = task,
	82	};
	83
	84	return ns_get_path_cb(path, ns_get_path_task, &args);
	85	}
	86
460695a2 CB	87	/**
	88	* open_namespace - open a namespace
	89	* @ns: the namespace to open
	90	*
	91	* This will consume a reference to @ns indendent of success or failure.
	92	*
	93	* Return: A file descriptor on success or a negative error code on failure.
	94	*/
	95	int open_namespace(struct ns_common *ns)
6786741d	96	{
460695a2	97	struct path path __free(path_put) = {};
6786741d	98	struct file *f;
ce623f89	99	int err;
6786741d	100
460695a2 CB	101	/* call first to consume reference */
	102	err = path_from_stashed(&ns->stashed, nsfs_mnt, ns, &path);
	103	if (err < 0)
	104	return err;
	105
	106	CLASS(get_unused_fd, fd)(O_CLOEXEC);
6786741d AV	107	if (fd < 0)
	108	return fd;
	109
460695a2 CB	110	f = dentry_open(&path, O_RDONLY, current_cred());
	111	if (IS_ERR(f))
	112	return PTR_ERR(f);
	113
	114	fd_install(fd, f);
	115	return take_fd(fd);
	116	}
	117
	118	int open_related_ns(struct ns_common *ns,
	119	struct ns_common (get_ns)(struct ns_common *ns))
	120	{
	121	struct ns_common *relative;
	122
159a0d9f	123	relative = get_ns(ns);
460695a2	124	if (IS_ERR(relative))
159a0d9f	125	return PTR_ERR(relative);
6786741d	126
460695a2	127	return open_namespace(relative);
6786741d	128	}
24dce080	129	EXPORT_SYMBOL_GPL(open_related_ns);
6786741d AV	130
	131	static long ns_ioctl(struct file *filp, unsigned int ioctl,
	132	unsigned long arg)
	133	{
d95fa3c7	134	struct user_namespace *user_ns;
ca567df7 CB	135	struct pid_namespace *pid_ns;
ca567df7 CB	136	struct task_struct *tsk;
6786741d	137	struct ns_common *ns = get_proc_ns(file_inode(filp));
d95fa3c7 MK	138	uid_t __user *argp;
d95fa3c7 MK	139	uid_t uid;
ca567df7	140	int ret;
6786741d AV	141
	142	switch (ioctl) {
	143	case NS_GET_USERNS:
	144	return open_related_ns(ns, ns_get_owner);
a7306ed8 AV	145	case NS_GET_PARENT:
	146	if (!ns->ops->get_parent)
	147	return -EINVAL;
	148	return open_related_ns(ns, ns->ops->get_parent);
e5ff5ce6 MK	149	case NS_GET_NSTYPE:
e5ff5ce6 MK	150	return ns->ops->type;
d95fa3c7 MK	151	case NS_GET_OWNER_UID:
	152	if (ns->ops->type != CLONE_NEWUSER)
	153	return -EINVAL;
	154	user_ns = container_of(ns, struct user_namespace, ns);
	155	argp = (uid_t __user *) arg;
	156	uid = from_kuid_munged(current_user_ns(), user_ns->owner);
	157	return put_user(uid, argp);
e8e43a1f JB	158	case NS_GET_MNTNS_ID: {
	159	struct mnt_namespace *mnt_ns;
	160	__u64 __user *idp;
	161	__u64 id;
	162
	163	if (ns->ops->type != CLONE_NEWNS)
	164	return -EINVAL;
	165
	166	mnt_ns = container_of(ns, struct mnt_namespace, ns);
	167	idp = (__u64 __user *)arg;
	168	id = mnt_ns->seq;
	169	return put_user(id, idp);
	170	}
ca567df7 CB	171	case NS_GET_PID_FROM_PIDNS:
	172	fallthrough;
	173	case NS_GET_TGID_FROM_PIDNS:
	174	fallthrough;
	175	case NS_GET_PID_IN_PIDNS:
	176	fallthrough;
280e36f0	177	case NS_GET_TGID_IN_PIDNS: {
ca567df7 CB	178	if (ns->ops->type != CLONE_NEWPID)
	179	return -EINVAL;
	180
	181	ret = -ESRCH;
	182	pid_ns = container_of(ns, struct pid_namespace, ns);
	183
280e36f0	184	guard(rcu)();
ca567df7 CB	185
	186	if (ioctl == NS_GET_PID_IN_PIDNS \|\|
	187	ioctl == NS_GET_TGID_IN_PIDNS)
	188	tsk = find_task_by_vpid(arg);
	189	else
	190	tsk = find_task_by_pid_ns(arg, pid_ns);
	191	if (!tsk)
	192	break;
	193
	194	switch (ioctl) {
	195	case NS_GET_PID_FROM_PIDNS:
	196	ret = task_pid_vnr(tsk);
	197	break;
	198	case NS_GET_TGID_FROM_PIDNS:
	199	ret = task_tgid_vnr(tsk);
	200	break;
	201	case NS_GET_PID_IN_PIDNS:
	202	ret = task_pid_nr_ns(tsk, pid_ns);
	203	break;
	204	case NS_GET_TGID_IN_PIDNS:
	205	ret = task_tgid_nr_ns(tsk, pid_ns);
	206	break;
	207	default:
	208	ret = 0;
	209	break;
	210	}
ca567df7 CB	211
	212	if (!ret)
	213	ret = -ESRCH;
	214	break;
280e36f0	215	}
6786741d	216	default:
ca567df7	217	ret = -ENOTTY;
6786741d	218	}
ca567df7 CB	219
ca567df7 CB	220	return ret;
6786741d AV	221	}
6786741d AV	222
e149ed2b AV	223	int ns_get_name(char buf, size_t size, struct task_struct task,
	224	const struct proc_ns_operations *ns_ops)
	225	{
	226	struct ns_common *ns;
	227	int res = -ENOENT;
25b14e92	228	const char *name;
e149ed2b AV	229	ns = ns_ops->get(task);
e149ed2b AV	230	if (ns) {
25b14e92 KT	231	name = ns_ops->real_ns_name ? : ns_ops->name;
25b14e92 KT	232	res = snprintf(buf, size, "%s:[%u]", name, ns->inum);
e149ed2b AV	233	ns_ops->put(ns);
	234	}
	235	return res;
	236	}
	237
303cc571 CB	238	bool proc_ns_file(const struct file *file)
	239	{
	240	return file->f_op == &ns_file_operations;
	241	}
	242
1e2328e7 CN	243	/**
1e2328e7 CN	244	* ns_match() - Returns true if current namespace matches dev/ino provided.
39ecb653	245	* @ns: current namespace
1e2328e7 CN	246	* @dev: dev_t from nsfs that will be matched against current nsfs
	247	* @ino: ino_t from nsfs that will be matched against current nsfs
	248	*
	249	* Return: true if dev and ino matches the current nsfs.
	250	*/
	251	bool ns_match(const struct ns_common *ns, dev_t dev, ino_t ino)
	252	{
	253	return (ns->inum == ino) && (nsfs_mnt->mnt_sb->s_dev == dev);
	254	}
	255
	256
75509fd8 EB	257	static int nsfs_show_path(struct seq_file seq, struct dentry dentry)
	258	{
	259	struct inode *inode = d_inode(dentry);
1fa08aec CB	260	const struct ns_common *ns = inode->i_private;
1fa08aec CB	261	const struct proc_ns_operations *ns_ops = ns->ops;
75509fd8	262
6798a8ca JP	263	seq_printf(seq, "%s:[%lu]", ns_ops->name, inode->i_ino);
6798a8ca JP	264	return 0;
75509fd8 EB	265	}
75509fd8 EB	266
e149ed2b AV	267	static const struct super_operations nsfs_ops = {
	268	.statfs = simple_statfs,
	269	.evict_inode = nsfs_evict,
75509fd8	270	.show_path = nsfs_show_path,
e149ed2b	271	};
059b20d9	272
9d9539db	273	static int nsfs_init_inode(struct inode inode, void data)
e9c5263c	274	{
9d9539db CB	275	struct ns_common *ns = data;
9d9539db CB	276
e9c5263c CB	277	inode->i_private = data;
	278	inode->i_mode \|= S_IRUGO;
	279	inode->i_fop = &ns_file_operations;
9d9539db CB	280	inode->i_ino = ns->inum;
9d9539db CB	281	return 0;
e9c5263c CB	282	}
	283
	284	static void nsfs_put_data(void *data)
	285	{
	286	struct ns_common *ns = data;
	287	ns->ops->put(ns);
	288	}
	289
	290	static const struct stashed_operations nsfs_stashed_ops = {
	291	.init_inode = nsfs_init_inode,
	292	.put_data = nsfs_put_data,
	293	};
	294
059b20d9	295	static int nsfs_init_fs_context(struct fs_context *fc)
e149ed2b	296	{
059b20d9 DH	297	struct pseudo_fs_context *ctx = init_pseudo(fc, NSFS_MAGIC);
	298	if (!ctx)
	299	return -ENOMEM;
	300	ctx->ops = &nsfs_ops;
	301	ctx->dops = &ns_dentry_operations;
e9c5263c	302	fc->s_fs_info = (void *)&nsfs_stashed_ops;
059b20d9	303	return 0;
e149ed2b	304	}
059b20d9	305
e149ed2b AV	306	static struct file_system_type nsfs = {
e149ed2b AV	307	.name = "nsfs",
059b20d9	308	.init_fs_context = nsfs_init_fs_context,
e149ed2b AV	309	.kill_sb = kill_anon_super,
	310	};
	311
	312	void __init nsfs_init(void)
	313	{
	314	nsfs_mnt = kern_mount(&nsfs);
	315	if (IS_ERR(nsfs_mnt))
	316	panic("can't set nsfs up\n");
1751e8a6	317	nsfs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;
e149ed2b	318	}