1 // SPDX-License-Identifier: GPL-2.0
3 * linux/ipc/namespace.c
4 * Copyright (C) 2006 Pavel Emelyanov <xemul@openvz.org> OpenVZ, SWsoft Inc.
9 #include <linux/ipc_namespace.h>
10 #include <linux/rcupdate.h>
11 #include <linux/nsproxy.h>
12 #include <linux/slab.h>
13 #include <linux/cred.h>
15 #include <linux/mount.h>
16 #include <linux/user_namespace.h>
17 #include <linux/proc_ns.h>
18 #include <linux/sched/task.h>
22 static struct ucounts
*inc_ipc_namespaces(struct user_namespace
*ns
)
24 return inc_ucount(ns
, current_euid(), UCOUNT_IPC_NAMESPACES
);
27 static void dec_ipc_namespaces(struct ucounts
*ucounts
)
29 dec_ucount(ucounts
, UCOUNT_IPC_NAMESPACES
);
32 static struct ipc_namespace
*create_ipc_ns(struct user_namespace
*user_ns
,
33 struct ipc_namespace
*old_ns
)
35 struct ipc_namespace
*ns
;
36 struct ucounts
*ucounts
;
40 ucounts
= inc_ipc_namespaces(user_ns
);
45 ns
= kzalloc(sizeof(struct ipc_namespace
), GFP_KERNEL_ACCOUNT
);
49 err
= ns_alloc_inum(&ns
->ns
);
52 ns
->ns
.ops
= &ipcns_operations
;
54 refcount_set(&ns
->ns
.count
, 1);
55 ns
->user_ns
= get_user_ns(user_ns
);
56 ns
->ucounts
= ucounts
;
63 if (!setup_mq_sysctls(ns
))
66 if (!setup_ipc_sysctls(ns
))
76 put_user_ns(ns
->user_ns
);
77 ns_free_inum(&ns
->ns
);
81 dec_ipc_namespaces(ucounts
);
86 struct ipc_namespace
*copy_ipcs(unsigned long flags
,
87 struct user_namespace
*user_ns
, struct ipc_namespace
*ns
)
89 if (!(flags
& CLONE_NEWIPC
))
90 return get_ipc_ns(ns
);
91 return create_ipc_ns(user_ns
, ns
);
95 * free_ipcs - free all ipcs of one type
96 * @ns: the namespace to remove the ipcs from
97 * @ids: the table of ipcs to free
98 * @free: the function called to free each individual ipc
100 * Called for each kind of ipc when an ipc_namespace exits.
102 void free_ipcs(struct ipc_namespace
*ns
, struct ipc_ids
*ids
,
103 void (*free
)(struct ipc_namespace
*, struct kern_ipc_perm
*))
105 struct kern_ipc_perm
*perm
;
109 down_write(&ids
->rwsem
);
111 in_use
= ids
->in_use
;
113 for (total
= 0, next_id
= 0; total
< in_use
; next_id
++) {
114 perm
= idr_find(&ids
->ipcs_idr
, next_id
);
118 ipc_lock_object(perm
);
122 up_write(&ids
->rwsem
);
125 static void free_ipc_ns(struct ipc_namespace
*ns
)
127 /* mq_put_mnt() waits for a grace period as kern_unmount()
128 * uses synchronize_rcu().
135 retire_mq_sysctls(ns
);
136 retire_ipc_sysctls(ns
);
138 dec_ipc_namespaces(ns
->ucounts
);
139 put_user_ns(ns
->user_ns
);
140 ns_free_inum(&ns
->ns
);
144 static LLIST_HEAD(free_ipc_list
);
145 static void free_ipc(struct work_struct
*unused
)
147 struct llist_node
*node
= llist_del_all(&free_ipc_list
);
148 struct ipc_namespace
*n
, *t
;
150 llist_for_each_entry_safe(n
, t
, node
, mnt_llist
)
155 * The work queue is used to avoid the cost of synchronize_rcu in kern_unmount.
157 static DECLARE_WORK(free_ipc_work
, free_ipc
);
160 * put_ipc_ns - drop a reference to an ipc namespace.
161 * @ns: the namespace to put
163 * If this is the last task in the namespace exiting, and
164 * it is dropping the refcount to 0, then it can race with
165 * a task in another ipc namespace but in a mounts namespace
166 * which has this ipcns's mqueuefs mounted, doing some action
167 * with one of the mqueuefs files. That can raise the refcount.
168 * So dropping the refcount, and raising the refcount when
169 * accessing it through the VFS, are protected with mq_lock.
171 * (Clearly, a task raising the refcount on its own ipc_ns
172 * needn't take mq_lock since it can't race with the last task
173 * in the ipcns exiting).
175 void put_ipc_ns(struct ipc_namespace
*ns
)
177 if (refcount_dec_and_lock(&ns
->ns
.count
, &mq_lock
)) {
179 spin_unlock(&mq_lock
);
181 if (llist_add(&ns
->mnt_llist
, &free_ipc_list
))
182 schedule_work(&free_ipc_work
);
186 static inline struct ipc_namespace
*to_ipc_ns(struct ns_common
*ns
)
188 return container_of(ns
, struct ipc_namespace
, ns
);
191 static struct ns_common
*ipcns_get(struct task_struct
*task
)
193 struct ipc_namespace
*ns
= NULL
;
194 struct nsproxy
*nsproxy
;
197 nsproxy
= task
->nsproxy
;
199 ns
= get_ipc_ns(nsproxy
->ipc_ns
);
202 return ns
? &ns
->ns
: NULL
;
205 static void ipcns_put(struct ns_common
*ns
)
207 return put_ipc_ns(to_ipc_ns(ns
));
210 static int ipcns_install(struct nsset
*nsset
, struct ns_common
*new)
212 struct nsproxy
*nsproxy
= nsset
->nsproxy
;
213 struct ipc_namespace
*ns
= to_ipc_ns(new);
214 if (!ns_capable(ns
->user_ns
, CAP_SYS_ADMIN
) ||
215 !ns_capable(nsset
->cred
->user_ns
, CAP_SYS_ADMIN
))
218 put_ipc_ns(nsproxy
->ipc_ns
);
219 nsproxy
->ipc_ns
= get_ipc_ns(ns
);
223 static struct user_namespace
*ipcns_owner(struct ns_common
*ns
)
225 return to_ipc_ns(ns
)->user_ns
;
228 const struct proc_ns_operations ipcns_operations
= {
230 .type
= CLONE_NEWIPC
,
233 .install
= ipcns_install
,
234 .owner
= ipcns_owner
,