1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/mount.h>
3 #include <linux/pseudo_fs.h>
4 #include <linux/file.h>
6 #include <linux/proc_fs.h>
7 #include <linux/proc_ns.h>
8 #include <linux/magic.h>
9 #include <linux/ktime.h>
10 #include <linux/seq_file.h>
11 #include <linux/user_namespace.h>
12 #include <linux/nsfs.h>
13 #include <linux/uaccess.h>
17 static struct vfsmount
*nsfs_mnt
;
19 static long ns_ioctl(struct file
*filp
, unsigned int ioctl
,
21 static const struct file_operations ns_file_operations
= {
23 .unlocked_ioctl
= ns_ioctl
,
24 .compat_ioctl
= compat_ptr_ioctl
,
27 static char *ns_dname(struct dentry
*dentry
, char *buffer
, int buflen
)
29 struct inode
*inode
= d_inode(dentry
);
30 const struct proc_ns_operations
*ns_ops
= dentry
->d_fsdata
;
32 return dynamic_dname(buffer
, buflen
, "%s:[%lu]",
33 ns_ops
->name
, inode
->i_ino
);
36 static void ns_prune_dentry(struct dentry
*dentry
)
38 struct inode
*inode
= d_inode(dentry
);
40 struct ns_common
*ns
= inode
->i_private
;
41 atomic_long_set(&ns
->stashed
, 0);
45 const struct dentry_operations ns_dentry_operations
=
47 .d_prune
= ns_prune_dentry
,
48 .d_delete
= always_delete_dentry
,
52 static void nsfs_evict(struct inode
*inode
)
54 struct ns_common
*ns
= inode
->i_private
;
59 static int __ns_get_path(struct path
*path
, struct ns_common
*ns
)
61 struct vfsmount
*mnt
= nsfs_mnt
;
62 struct dentry
*dentry
;
67 d
= atomic_long_read(&ns
->stashed
);
70 dentry
= (struct dentry
*)d
;
71 if (!lockref_get_not_dead(&dentry
->d_lockref
))
76 path
->mnt
= mntget(mnt
);
77 path
->dentry
= dentry
;
81 inode
= new_inode_pseudo(mnt
->mnt_sb
);
86 inode
->i_ino
= ns
->inum
;
87 simple_inode_init_ts(inode
);
88 inode
->i_flags
|= S_IMMUTABLE
;
89 inode
->i_mode
= S_IFREG
| S_IRUGO
;
90 inode
->i_fop
= &ns_file_operations
;
91 inode
->i_private
= ns
;
93 dentry
= d_make_root(inode
); /* not the normal use, but... */
96 dentry
->d_fsdata
= (void *)ns
->ops
;
97 d
= atomic_long_cmpxchg(&ns
->stashed
, 0, (unsigned long)dentry
);
99 d_delete(dentry
); /* make sure ->d_prune() does nothing */
107 int ns_get_path_cb(struct path
*path
, ns_get_path_helper_t
*ns_get_cb
,
113 struct ns_common
*ns
= ns_get_cb(private_data
);
116 ret
= __ns_get_path(path
, ns
);
117 } while (ret
== -EAGAIN
);
122 struct ns_get_path_task_args
{
123 const struct proc_ns_operations
*ns_ops
;
124 struct task_struct
*task
;
127 static struct ns_common
*ns_get_path_task(void *private_data
)
129 struct ns_get_path_task_args
*args
= private_data
;
131 return args
->ns_ops
->get(args
->task
);
134 int ns_get_path(struct path
*path
, struct task_struct
*task
,
135 const struct proc_ns_operations
*ns_ops
)
137 struct ns_get_path_task_args args
= {
142 return ns_get_path_cb(path
, ns_get_path_task
, &args
);
145 int open_related_ns(struct ns_common
*ns
,
146 struct ns_common
*(*get_ns
)(struct ns_common
*ns
))
148 struct path path
= {};
153 fd
= get_unused_fd_flags(O_CLOEXEC
);
158 struct ns_common
*relative
;
160 relative
= get_ns(ns
);
161 if (IS_ERR(relative
)) {
163 return PTR_ERR(relative
);
166 err
= __ns_get_path(&path
, relative
);
167 } while (err
== -EAGAIN
);
174 f
= dentry_open(&path
, O_RDONLY
, current_cred());
184 EXPORT_SYMBOL_GPL(open_related_ns
);
186 static long ns_ioctl(struct file
*filp
, unsigned int ioctl
,
189 struct user_namespace
*user_ns
;
190 struct ns_common
*ns
= get_proc_ns(file_inode(filp
));
196 return open_related_ns(ns
, ns_get_owner
);
198 if (!ns
->ops
->get_parent
)
200 return open_related_ns(ns
, ns
->ops
->get_parent
);
202 return ns
->ops
->type
;
203 case NS_GET_OWNER_UID
:
204 if (ns
->ops
->type
!= CLONE_NEWUSER
)
206 user_ns
= container_of(ns
, struct user_namespace
, ns
);
207 argp
= (uid_t __user
*) arg
;
208 uid
= from_kuid_munged(current_user_ns(), user_ns
->owner
);
209 return put_user(uid
, argp
);
215 int ns_get_name(char *buf
, size_t size
, struct task_struct
*task
,
216 const struct proc_ns_operations
*ns_ops
)
218 struct ns_common
*ns
;
221 ns
= ns_ops
->get(task
);
223 name
= ns_ops
->real_ns_name
? : ns_ops
->name
;
224 res
= snprintf(buf
, size
, "%s:[%u]", name
, ns
->inum
);
230 bool proc_ns_file(const struct file
*file
)
232 return file
->f_op
== &ns_file_operations
;
236 * ns_match() - Returns true if current namespace matches dev/ino provided.
237 * @ns: current namespace
238 * @dev: dev_t from nsfs that will be matched against current nsfs
239 * @ino: ino_t from nsfs that will be matched against current nsfs
241 * Return: true if dev and ino matches the current nsfs.
243 bool ns_match(const struct ns_common
*ns
, dev_t dev
, ino_t ino
)
245 return (ns
->inum
== ino
) && (nsfs_mnt
->mnt_sb
->s_dev
== dev
);
249 static int nsfs_show_path(struct seq_file
*seq
, struct dentry
*dentry
)
251 struct inode
*inode
= d_inode(dentry
);
252 const struct proc_ns_operations
*ns_ops
= dentry
->d_fsdata
;
254 seq_printf(seq
, "%s:[%lu]", ns_ops
->name
, inode
->i_ino
);
258 static const struct super_operations nsfs_ops
= {
259 .statfs
= simple_statfs
,
260 .evict_inode
= nsfs_evict
,
261 .show_path
= nsfs_show_path
,
264 static int nsfs_init_fs_context(struct fs_context
*fc
)
266 struct pseudo_fs_context
*ctx
= init_pseudo(fc
, NSFS_MAGIC
);
269 ctx
->ops
= &nsfs_ops
;
270 ctx
->dops
= &ns_dentry_operations
;
274 static struct file_system_type nsfs
= {
276 .init_fs_context
= nsfs_init_fs_context
,
277 .kill_sb
= kill_anon_super
,
280 void __init
nsfs_init(void)
282 nsfs_mnt
= kern_mount(&nsfs
);
283 if (IS_ERR(nsfs_mnt
))
284 panic("can't set nsfs up\n");
285 nsfs_mnt
->mnt_sb
->s_flags
&= ~SB_NOUSER
;