1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/mount.h>
3 #include <linux/pseudo_fs.h>
4 #include <linux/file.h>
5 #include <linux/fs.h>
6 #include <linux/proc_fs.h>
7 #include <linux/proc_ns.h>
8 #include <linux/magic.h>
9 #include <linux/ktime.h>
10 #include <linux/seq_file.h>
11 #include <linux/user_namespace.h>
12 #include <linux/nsfs.h>
13 #include <linux/uaccess.h>
14 
15 #include "internal.h"
16 
17 static struct vfsmount *nsfs_mnt;
18 
19 static long ns_ioctl(struct file *filp, unsigned int ioctl,
20 			unsigned long arg);
21 static const struct file_operations ns_file_operations = {
22 	.llseek		= no_llseek,
23 	.unlocked_ioctl = ns_ioctl,
24 	.compat_ioctl   = compat_ptr_ioctl,
25 };
26 
ns_dname(struct dentry * dentry,char * buffer,int buflen)27 static char *ns_dname(struct dentry *dentry, char *buffer, int buflen)
28 {
29 	struct inode *inode = d_inode(dentry);
30 	const struct proc_ns_operations *ns_ops = dentry->d_fsdata;
31 
32 	return dynamic_dname(buffer, buflen, "%s:[%lu]",
33 		ns_ops->name, inode->i_ino);
34 }
35 
ns_prune_dentry(struct dentry * dentry)36 static void ns_prune_dentry(struct dentry *dentry)
37 {
38 	struct inode *inode = d_inode(dentry);
39 	if (inode) {
40 		struct ns_common *ns = inode->i_private;
41 		atomic_long_set(&ns->stashed, 0);
42 	}
43 }
44 
45 const struct dentry_operations ns_dentry_operations =
46 {
47 	.d_prune	= ns_prune_dentry,
48 	.d_delete	= always_delete_dentry,
49 	.d_dname	= ns_dname,
50 };
51 
nsfs_evict(struct inode * inode)52 static void nsfs_evict(struct inode *inode)
53 {
54 	struct ns_common *ns = inode->i_private;
55 	clear_inode(inode);
56 	ns->ops->put(ns);
57 }
58 
__ns_get_path(struct path * path,struct ns_common * ns)59 static int __ns_get_path(struct path *path, struct ns_common *ns)
60 {
61 	struct vfsmount *mnt = nsfs_mnt;
62 	struct dentry *dentry;
63 	struct inode *inode;
64 	unsigned long d;
65 
66 	rcu_read_lock();
67 	d = atomic_long_read(&ns->stashed);
68 	if (!d)
69 		goto slow;
70 	dentry = (struct dentry *)d;
71 	if (!lockref_get_not_dead(&dentry->d_lockref))
72 		goto slow;
73 	rcu_read_unlock();
74 	ns->ops->put(ns);
75 got_it:
76 	path->mnt = mntget(mnt);
77 	path->dentry = dentry;
78 	return 0;
79 slow:
80 	rcu_read_unlock();
81 	inode = new_inode_pseudo(mnt->mnt_sb);
82 	if (!inode) {
83 		ns->ops->put(ns);
84 		return -ENOMEM;
85 	}
86 	inode->i_ino = ns->inum;
87 	inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
88 	inode->i_flags |= S_IMMUTABLE;
89 	inode->i_mode = S_IFREG | S_IRUGO;
90 	inode->i_fop = &ns_file_operations;
91 	inode->i_private = ns;
92 
93 	dentry = d_alloc_anon(mnt->mnt_sb);
94 	if (!dentry) {
95 		iput(inode);
96 		return -ENOMEM;
97 	}
98 	d_instantiate(dentry, inode);
99 	dentry->d_fsdata = (void *)ns->ops;
100 	d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
101 	if (d) {
102 		d_delete(dentry);	/* make sure ->d_prune() does nothing */
103 		dput(dentry);
104 		cpu_relax();
105 		return -EAGAIN;
106 	}
107 	goto got_it;
108 }
109 
ns_get_path_cb(struct path * path,ns_get_path_helper_t * ns_get_cb,void * private_data)110 int ns_get_path_cb(struct path *path, ns_get_path_helper_t *ns_get_cb,
111 		     void *private_data)
112 {
113 	int ret;
114 
115 	do {
116 		struct ns_common *ns = ns_get_cb(private_data);
117 		if (!ns)
118 			return -ENOENT;
119 		ret = __ns_get_path(path, ns);
120 	} while (ret == -EAGAIN);
121 
122 	return ret;
123 }
124 
125 struct ns_get_path_task_args {
126 	const struct proc_ns_operations *ns_ops;
127 	struct task_struct *task;
128 };
129 
ns_get_path_task(void * private_data)130 static struct ns_common *ns_get_path_task(void *private_data)
131 {
132 	struct ns_get_path_task_args *args = private_data;
133 
134 	return args->ns_ops->get(args->task);
135 }
136 
ns_get_path(struct path * path,struct task_struct * task,const struct proc_ns_operations * ns_ops)137 int ns_get_path(struct path *path, struct task_struct *task,
138 		  const struct proc_ns_operations *ns_ops)
139 {
140 	struct ns_get_path_task_args args = {
141 		.ns_ops	= ns_ops,
142 		.task	= task,
143 	};
144 
145 	return ns_get_path_cb(path, ns_get_path_task, &args);
146 }
147 
open_related_ns(struct ns_common * ns,struct ns_common * (* get_ns)(struct ns_common * ns))148 int open_related_ns(struct ns_common *ns,
149 		   struct ns_common *(*get_ns)(struct ns_common *ns))
150 {
151 	struct path path = {};
152 	struct file *f;
153 	int err;
154 	int fd;
155 
156 	fd = get_unused_fd_flags(O_CLOEXEC);
157 	if (fd < 0)
158 		return fd;
159 
160 	do {
161 		struct ns_common *relative;
162 
163 		relative = get_ns(ns);
164 		if (IS_ERR(relative)) {
165 			put_unused_fd(fd);
166 			return PTR_ERR(relative);
167 		}
168 
169 		err = __ns_get_path(&path, relative);
170 	} while (err == -EAGAIN);
171 
172 	if (err) {
173 		put_unused_fd(fd);
174 		return err;
175 	}
176 
177 	f = dentry_open(&path, O_RDONLY, current_cred());
178 	path_put(&path);
179 	if (IS_ERR(f)) {
180 		put_unused_fd(fd);
181 		fd = PTR_ERR(f);
182 	} else
183 		fd_install(fd, f);
184 
185 	return fd;
186 }
187 EXPORT_SYMBOL_GPL(open_related_ns);
188 
ns_ioctl(struct file * filp,unsigned int ioctl,unsigned long arg)189 static long ns_ioctl(struct file *filp, unsigned int ioctl,
190 			unsigned long arg)
191 {
192 	struct user_namespace *user_ns;
193 	struct ns_common *ns = get_proc_ns(file_inode(filp));
194 	uid_t __user *argp;
195 	uid_t uid;
196 
197 	switch (ioctl) {
198 	case NS_GET_USERNS:
199 		return open_related_ns(ns, ns_get_owner);
200 	case NS_GET_PARENT:
201 		if (!ns->ops->get_parent)
202 			return -EINVAL;
203 		return open_related_ns(ns, ns->ops->get_parent);
204 	case NS_GET_NSTYPE:
205 		return ns->ops->type;
206 	case NS_GET_OWNER_UID:
207 		if (ns->ops->type != CLONE_NEWUSER)
208 			return -EINVAL;
209 		user_ns = container_of(ns, struct user_namespace, ns);
210 		argp = (uid_t __user *) arg;
211 		uid = from_kuid_munged(current_user_ns(), user_ns->owner);
212 		return put_user(uid, argp);
213 	default:
214 		return -ENOTTY;
215 	}
216 }
217 
ns_get_name(char * buf,size_t size,struct task_struct * task,const struct proc_ns_operations * ns_ops)218 int ns_get_name(char *buf, size_t size, struct task_struct *task,
219 			const struct proc_ns_operations *ns_ops)
220 {
221 	struct ns_common *ns;
222 	int res = -ENOENT;
223 	const char *name;
224 	ns = ns_ops->get(task);
225 	if (ns) {
226 		name = ns_ops->real_ns_name ? : ns_ops->name;
227 		res = snprintf(buf, size, "%s:[%u]", name, ns->inum);
228 		ns_ops->put(ns);
229 	}
230 	return res;
231 }
232 
proc_ns_file(const struct file * file)233 bool proc_ns_file(const struct file *file)
234 {
235 	return file->f_op == &ns_file_operations;
236 }
237 
proc_ns_fget(int fd)238 struct file *proc_ns_fget(int fd)
239 {
240 	struct file *file;
241 
242 	file = fget(fd);
243 	if (!file)
244 		return ERR_PTR(-EBADF);
245 
246 	if (file->f_op != &ns_file_operations)
247 		goto out_invalid;
248 
249 	return file;
250 
251 out_invalid:
252 	fput(file);
253 	return ERR_PTR(-EINVAL);
254 }
255 
256 /**
257  * ns_match() - Returns true if current namespace matches dev/ino provided.
258  * @ns: current namespace
259  * @dev: dev_t from nsfs that will be matched against current nsfs
260  * @ino: ino_t from nsfs that will be matched against current nsfs
261  *
262  * Return: true if dev and ino matches the current nsfs.
263  */
ns_match(const struct ns_common * ns,dev_t dev,ino_t ino)264 bool ns_match(const struct ns_common *ns, dev_t dev, ino_t ino)
265 {
266 	return (ns->inum == ino) && (nsfs_mnt->mnt_sb->s_dev == dev);
267 }
268 
269 
nsfs_show_path(struct seq_file * seq,struct dentry * dentry)270 static int nsfs_show_path(struct seq_file *seq, struct dentry *dentry)
271 {
272 	struct inode *inode = d_inode(dentry);
273 	const struct proc_ns_operations *ns_ops = dentry->d_fsdata;
274 
275 	seq_printf(seq, "%s:[%lu]", ns_ops->name, inode->i_ino);
276 	return 0;
277 }
278 
279 static const struct super_operations nsfs_ops = {
280 	.statfs = simple_statfs,
281 	.evict_inode = nsfs_evict,
282 	.show_path = nsfs_show_path,
283 };
284 
nsfs_init_fs_context(struct fs_context * fc)285 static int nsfs_init_fs_context(struct fs_context *fc)
286 {
287 	struct pseudo_fs_context *ctx = init_pseudo(fc, NSFS_MAGIC);
288 	if (!ctx)
289 		return -ENOMEM;
290 	ctx->ops = &nsfs_ops;
291 	ctx->dops = &ns_dentry_operations;
292 	return 0;
293 }
294 
295 static struct file_system_type nsfs = {
296 	.name = "nsfs",
297 	.init_fs_context = nsfs_init_fs_context,
298 	.kill_sb = kill_anon_super,
299 };
300 
nsfs_init(void)301 void __init nsfs_init(void)
302 {
303 	nsfs_mnt = kern_mount(&nsfs);
304 	if (IS_ERR(nsfs_mnt))
305 		panic("can't set nsfs up\n");
306 	nsfs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;
307 }
308