projects/linux·blob master · refs

317 lines · 9.0 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/* Copyright (c) 2025 Christian Brauner <[email protected]> */
3
4#include <linux/ns_common.h>
5#include <linux/nstree.h>
6#include <linux/proc_ns.h>
7#include <linux/user_namespace.h>
8#include <linux/vfsdebug.h>
9
10#ifdef CONFIG_DEBUG_VFS
11static void ns_debug(struct ns_common *ns, const struct proc_ns_operations *ops)
12{
13 switch (ns->ns_type) {
14#ifdef CONFIG_CGROUPS
15 case CLONE_NEWCGROUP:
16 VFS_WARN_ON_ONCE(ops != &cgroupns_operations);
17 break;
18#endif
19#ifdef CONFIG_IPC_NS
20 case CLONE_NEWIPC:
21 VFS_WARN_ON_ONCE(ops != &ipcns_operations);
22 break;
23#endif
24 case CLONE_NEWNS:
25 VFS_WARN_ON_ONCE(ops != &mntns_operations);
26 break;
27#ifdef CONFIG_NET_NS
28 case CLONE_NEWNET:
29 VFS_WARN_ON_ONCE(ops != &netns_operations);
30 break;
31#endif
32#ifdef CONFIG_PID_NS
33 case CLONE_NEWPID:
34 VFS_WARN_ON_ONCE(ops != &pidns_operations);
35 break;
36#endif
37#ifdef CONFIG_TIME_NS
38 case CLONE_NEWTIME:
39 VFS_WARN_ON_ONCE(ops != &timens_operations);
40 break;
41#endif
42#ifdef CONFIG_USER_NS
43 case CLONE_NEWUSER:
44 VFS_WARN_ON_ONCE(ops != &userns_operations);
45 break;
46#endif
47#ifdef CONFIG_UTS_NS
48 case CLONE_NEWUTS:
49 VFS_WARN_ON_ONCE(ops != &utsns_operations);
50 break;
51#endif
52 }
53}
54#endif
55
56int __ns_common_init(struct ns_common *ns, u32 ns_type, const struct proc_ns_operations *ops, int inum)
57{
58 int ret = 0;
59
60 refcount_set(&ns->__ns_ref, 1);
61 ns->stashed = NULL;
62 ns->ops = ops;
63 ns->ns_id = 0;
64 ns->ns_type = ns_type;
65 ns_tree_node_init(&ns->ns_tree_node);
66 ns_tree_node_init(&ns->ns_unified_node);
67 ns_tree_node_init(&ns->ns_owner_node);
68 ns_tree_root_init(&ns->ns_owner_root);
69
70#ifdef CONFIG_DEBUG_VFS
71 ns_debug(ns, ops);
72#endif
73
74 if (inum)
75 ns->inum = inum;
76 else
77 ret = proc_alloc_inum(&ns->inum);
78 if (ret)
79 return ret;
80 /*
81 * Tree ref starts at 0. It's incremented when namespace enters
82 * active use (installed in nsproxy) and decremented when all
83 * active uses are gone. Initial namespaces are always active.
84 */
85 if (is_ns_init_inum(ns))
86 atomic_set(&ns->__ns_ref_active, 1);
87 else
88 atomic_set(&ns->__ns_ref_active, 0);
89 return 0;
90}
91
92void __ns_common_free(struct ns_common *ns)
93{
94 proc_free_inum(ns->inum);
95}
96
97struct ns_common *__must_check ns_owner(struct ns_common *ns)
98{
99 struct user_namespace *owner;
100
101 if (unlikely(!ns->ops))
102 return NULL;
103 VFS_WARN_ON_ONCE(!ns->ops->owner);
104 owner = ns->ops->owner(ns);
105 VFS_WARN_ON_ONCE(!owner && ns != to_ns_common(&init_user_ns));
106 if (!owner)
107 return NULL;
108 /* Skip init_user_ns as it's always active */
109 if (owner == &init_user_ns)
110 return NULL;
111 return to_ns_common(owner);
112}
113
114/*
115 * The active reference count works by having each namespace that gets
116 * created take a single active reference on its owning user namespace.
117 * That single reference is only released once the child namespace's
118 * active count itself goes down.
119 *
120 * A regular namespace tree might look as follow:
121 * Legend:
122 * + : adding active reference
123 * - : dropping active reference
124 * x : always active (initial namespace)
125 *
126 *
127 * net_ns pid_ns
128 * \ /
129 * + +
130 * user_ns1 (2)
131 * |
132 * ipc_ns | uts_ns
133 * \ | /
134 * + + +
135 * user_ns2 (3)
136 * |
137 * cgroup_ns | mnt_ns
138 * \ | /
139 * x x x
140 * init_user_ns (1)
141 *
142 * If both net_ns and pid_ns put their last active reference on
143 * themselves it will cascade to user_ns1 dropping its own active
144 * reference and dropping one active reference on user_ns2:
145 *
146 * net_ns pid_ns
147 * \ /
148 * - -
149 * user_ns1 (0)
150 * |
151 * ipc_ns | uts_ns
152 * \ | /
153 * + - +
154 * user_ns2 (2)
155 * |
156 * cgroup_ns | mnt_ns
157 * \ | /
158 * x x x
159 * init_user_ns (1)
160 *
161 * The iteration stops once we reach a namespace that still has active
162 * references.
163 */
164void __ns_ref_active_put(struct ns_common *ns)
165{
166 /* Initial namespaces are always active. */
167 if (is_ns_init_id(ns))
168 return;
169
170 if (!atomic_dec_and_test(&ns->__ns_ref_active)) {
171 VFS_WARN_ON_ONCE(__ns_ref_active_read(ns) < 0);
172 return;
173 }
174
175 VFS_WARN_ON_ONCE(is_ns_init_id(ns));
176 VFS_WARN_ON_ONCE(!__ns_ref_read(ns));
177
178 for (;;) {
179 ns = ns_owner(ns);
180 if (!ns)
181 return;
182 VFS_WARN_ON_ONCE(is_ns_init_id(ns));
183 if (!atomic_dec_and_test(&ns->__ns_ref_active)) {
184 VFS_WARN_ON_ONCE(__ns_ref_active_read(ns) < 0);
185 return;
186 }
187 }
188}
189
190/*
191 * The active reference count works by having each namespace that gets
192 * created take a single active reference on its owning user namespace.
193 * That single reference is only released once the child namespace's
194 * active count itself goes down. This makes it possible to efficiently
195 * resurrect a namespace tree:
196 *
197 * A regular namespace tree might look as follow:
198 * Legend:
199 * + : adding active reference
200 * - : dropping active reference
201 * x : always active (initial namespace)
202 *
203 *
204 * net_ns pid_ns
205 * \ /
206 * + +
207 * user_ns1 (2)
208 * |
209 * ipc_ns | uts_ns
210 * \ | /
211 * + + +
212 * user_ns2 (3)
213 * |
214 * cgroup_ns | mnt_ns
215 * \ | /
216 * x x x
217 * init_user_ns (1)
218 *
219 * If both net_ns and pid_ns put their last active reference on
220 * themselves it will cascade to user_ns1 dropping its own active
221 * reference and dropping one active reference on user_ns2:
222 *
223 * net_ns pid_ns
224 * \ /
225 * - -
226 * user_ns1 (0)
227 * |
228 * ipc_ns | uts_ns
229 * \ | /
230 * + - +
231 * user_ns2 (2)
232 * |
233 * cgroup_ns | mnt_ns
234 * \ | /
235 * x x x
236 * init_user_ns (1)
237 *
238 * Assume the whole tree is dead but all namespaces are still active:
239 *
240 * net_ns pid_ns
241 * \ /
242 * - -
243 * user_ns1 (0)
244 * |
245 * ipc_ns | uts_ns
246 * \ | /
247 * - - -
248 * user_ns2 (0)
249 * |
250 * cgroup_ns | mnt_ns
251 * \ | /
252 * x x x
253 * init_user_ns (1)
254 *
255 * Now assume the net_ns gets resurrected (.e.g., via the SIOCGSKNS ioctl()):
256 *
257 * net_ns pid_ns
258 * \ /
259 * + -
260 * user_ns1 (0)
261 * |
262 * ipc_ns | uts_ns
263 * \ | /
264 * - + -
265 * user_ns2 (0)
266 * |
267 * cgroup_ns | mnt_ns
268 * \ | /
269 * x x x
270 * init_user_ns (1)
271 *
272 * If net_ns had a zero reference count and we bumped it we also need to
273 * take another reference on its owning user namespace. Similarly, if
274 * pid_ns had a zero reference count it also needs to take another
275 * reference on its owning user namespace. So both net_ns and pid_ns
276 * will each have their own reference on the owning user namespace.
277 *
278 * If the owning user namespace user_ns1 had a zero reference count then
279 * it also needs to take another reference on its owning user namespace
280 * and so on.
281 */
282void __ns_ref_active_get(struct ns_common *ns)
283{
284 int prev;
285
286 /* Initial namespaces are always active. */
287 if (is_ns_init_id(ns))
288 return;
289
290 /* If we didn't resurrect the namespace we're done. */
291 prev = atomic_fetch_add(1, &ns->__ns_ref_active);
292 VFS_WARN_ON_ONCE(prev < 0);
293 if (likely(prev))
294 return;
295
296 /*
297 * We did resurrect it. Walk the ownership hierarchy upwards
298 * until we found an owning user namespace that is active.
299 */
300 for (;;) {
301 ns = ns_owner(ns);
302 if (!ns)
303 return;
304
305 VFS_WARN_ON_ONCE(is_ns_init_id(ns));
306 prev = atomic_fetch_add(1, &ns->__ns_ref_active);
307 VFS_WARN_ON_ONCE(prev < 0);
308 if (likely(prev))
309 return;
310 }
311}
312
313bool may_see_all_namespaces(void)
314{
315 return (task_active_pid_ns(current) == &init_pid_ns) &&
316 ns_capable_noaudit(init_pid_ns.user_ns, CAP_SYS_ADMIN);
317}