projects/linux·blob master · refs

368 lines · 9.1 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2
3#include <linux/stat.h>
4#include <linux/sysctl.h>
5#include <linux/slab.h>
6#include <linux/cred.h>
7#include <linux/export.h>
8#include <linux/hash.h>
9#include <linux/kmemleak.h>
10#include <linux/user_namespace.h>
11
12struct ucounts init_ucounts = {
13 .ns = &init_user_ns,
14 .uid = GLOBAL_ROOT_UID,
15 .count = RCUREF_INIT(1),
16};
17
18#define UCOUNTS_HASHTABLE_BITS 10
19#define UCOUNTS_HASHTABLE_ENTRIES (1 << UCOUNTS_HASHTABLE_BITS)
20static struct hlist_nulls_head ucounts_hashtable[UCOUNTS_HASHTABLE_ENTRIES] = {
21 [0 ... UCOUNTS_HASHTABLE_ENTRIES - 1] = HLIST_NULLS_HEAD_INIT(0)
22};
23static DEFINE_SPINLOCK(ucounts_lock);
24
25#define ucounts_hashfn(ns, uid) \
26 hash_long((unsigned long)__kuid_val(uid) + (unsigned long)(ns), \
27 UCOUNTS_HASHTABLE_BITS)
28#define ucounts_hashentry(ns, uid) \
29 (ucounts_hashtable + ucounts_hashfn(ns, uid))
30
31#ifdef CONFIG_SYSCTL
32static struct ctl_table_set *
33set_lookup(struct ctl_table_root *root)
34{
35 return &current_user_ns()->set;
36}
37
38static int set_is_seen(struct ctl_table_set *set)
39{
40 return &current_user_ns()->set == set;
41}
42
43static int set_permissions(struct ctl_table_header *head,
44 const struct ctl_table *table)
45{
46 struct user_namespace *user_ns =
47 container_of(head->set, struct user_namespace, set);
48 int mode;
49
50 /* Allow users with CAP_SYS_RESOURCE unrestrained access */
51 if (ns_capable_noaudit(user_ns, CAP_SYS_RESOURCE))
52 mode = (table->mode & S_IRWXU) >> 6;
53 else
54 /* Allow all others at most read-only access */
55 mode = table->mode & S_IROTH;
56 return (mode << 6) | (mode << 3) | mode;
57}
58
59static struct ctl_table_root set_root = {
60 .lookup = set_lookup,
61 .permissions = set_permissions,
62};
63
64static long ue_zero = 0;
65static long ue_int_max = INT_MAX;
66
67#define UCOUNT_ENTRY(name) \
68 { \
69 .procname = name, \
70 .maxlen = sizeof(long), \
71 .mode = 0644, \
72 .proc_handler = proc_doulongvec_minmax, \
73 .extra1 = &ue_zero, \
74 .extra2 = &ue_int_max, \
75 }
76static const struct ctl_table user_table[] = {
77 UCOUNT_ENTRY("max_user_namespaces"),
78 UCOUNT_ENTRY("max_pid_namespaces"),
79 UCOUNT_ENTRY("max_uts_namespaces"),
80 UCOUNT_ENTRY("max_ipc_namespaces"),
81 UCOUNT_ENTRY("max_net_namespaces"),
82 UCOUNT_ENTRY("max_mnt_namespaces"),
83 UCOUNT_ENTRY("max_cgroup_namespaces"),
84 UCOUNT_ENTRY("max_time_namespaces"),
85#ifdef CONFIG_INOTIFY_USER
86 UCOUNT_ENTRY("max_inotify_instances"),
87 UCOUNT_ENTRY("max_inotify_watches"),
88#endif
89#ifdef CONFIG_FANOTIFY
90 UCOUNT_ENTRY("max_fanotify_groups"),
91 UCOUNT_ENTRY("max_fanotify_marks"),
92#endif
93#if IS_ENABLED(CONFIG_BINFMT_MISC)
94 UCOUNT_ENTRY("max_binfmt_misc_interpreters"),
95#endif
96};
97#endif /* CONFIG_SYSCTL */
98
99bool setup_userns_sysctls(struct user_namespace *ns)
100{
101#ifdef CONFIG_SYSCTL
102 struct ctl_table *tbl;
103
104 BUILD_BUG_ON(ARRAY_SIZE(user_table) != UCOUNT_COUNTS);
105 setup_sysctl_set(&ns->set, &set_root, set_is_seen);
106 tbl = kmemdup(user_table, sizeof(user_table), GFP_KERNEL);
107 if (tbl) {
108 int i;
109 for (i = 0; i < UCOUNT_COUNTS; i++) {
110 tbl[i].data = &ns->ucount_max[i];
111 }
112 ns->sysctls = __register_sysctl_table(&ns->set, "user", tbl,
113 ARRAY_SIZE(user_table));
114 }
115 if (!ns->sysctls) {
116 kfree(tbl);
117 retire_sysctl_set(&ns->set);
118 return false;
119 }
120#endif
121 return true;
122}
123
124void retire_userns_sysctls(struct user_namespace *ns)
125{
126#ifdef CONFIG_SYSCTL
127 const struct ctl_table *tbl;
128
129 tbl = ns->sysctls->ctl_table_arg;
130 unregister_sysctl_table(ns->sysctls);
131 retire_sysctl_set(&ns->set);
132 kfree(tbl);
133#endif
134}
135
136static struct ucounts *find_ucounts(struct user_namespace *ns, kuid_t uid,
137 struct hlist_nulls_head *hashent)
138{
139 struct ucounts *ucounts;
140 struct hlist_nulls_node *pos;
141
142 guard(rcu)();
143 hlist_nulls_for_each_entry_rcu(ucounts, pos, hashent, node) {
144 if (uid_eq(ucounts->uid, uid) && (ucounts->ns == ns)) {
145 if (rcuref_get(&ucounts->count))
146 return ucounts;
147 }
148 }
149 return NULL;
150}
151
152static void hlist_add_ucounts(struct ucounts *ucounts)
153{
154 struct hlist_nulls_head *hashent = ucounts_hashentry(ucounts->ns, ucounts->uid);
155
156 spin_lock_irq(&ucounts_lock);
157 hlist_nulls_add_head_rcu(&ucounts->node, hashent);
158 spin_unlock_irq(&ucounts_lock);
159}
160
161struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid)
162{
163 struct hlist_nulls_head *hashent = ucounts_hashentry(ns, uid);
164 struct ucounts *ucounts, *new;
165
166 ucounts = find_ucounts(ns, uid, hashent);
167 if (ucounts)
168 return ucounts;
169
170 new = kzalloc_obj(*new);
171 if (!new)
172 return NULL;
173
174 new->ns = ns;
175 new->uid = uid;
176 rcuref_init(&new->count, 1);
177
178 spin_lock_irq(&ucounts_lock);
179 ucounts = find_ucounts(ns, uid, hashent);
180 if (ucounts) {
181 spin_unlock_irq(&ucounts_lock);
182 kfree(new);
183 return ucounts;
184 }
185
186 hlist_nulls_add_head_rcu(&new->node, hashent);
187 get_user_ns(new->ns);
188 spin_unlock_irq(&ucounts_lock);
189 return new;
190}
191
192void put_ucounts(struct ucounts *ucounts)
193{
194 unsigned long flags;
195
196 if (rcuref_put(&ucounts->count)) {
197 spin_lock_irqsave(&ucounts_lock, flags);
198 hlist_nulls_del_rcu(&ucounts->node);
199 spin_unlock_irqrestore(&ucounts_lock, flags);
200
201 put_user_ns(ucounts->ns);
202 kfree_rcu(ucounts, rcu);
203 }
204}
205
206static inline bool atomic_long_inc_below(atomic_long_t *v, long u)
207{
208 long c = atomic_long_read(v);
209
210 do {
211 if (unlikely(c >= u))
212 return false;
213 } while (!atomic_long_try_cmpxchg(v, &c, c+1));
214
215 return true;
216}
217
218struct ucounts *inc_ucount(struct user_namespace *ns, kuid_t uid,
219 enum ucount_type type)
220{
221 struct ucounts *ucounts, *iter, *bad;
222 struct user_namespace *tns;
223 ucounts = alloc_ucounts(ns, uid);
224 for (iter = ucounts; iter; iter = tns->ucounts) {
225 long max;
226 tns = iter->ns;
227 max = READ_ONCE(tns->ucount_max[type]);
228 if (!atomic_long_inc_below(&iter->ucount[type], max))
229 goto fail;
230 }
231 return ucounts;
232fail:
233 bad = iter;
234 for (iter = ucounts; iter != bad; iter = iter->ns->ucounts)
235 atomic_long_dec(&iter->ucount[type]);
236
237 put_ucounts(ucounts);
238 return NULL;
239}
240EXPORT_SYMBOL_FOR_MODULES(inc_ucount, "binfmt_misc");
241
242void dec_ucount(struct ucounts *ucounts, enum ucount_type type)
243{
244 struct ucounts *iter;
245 for (iter = ucounts; iter; iter = iter->ns->ucounts) {
246 long dec = atomic_long_dec_if_positive(&iter->ucount[type]);
247 WARN_ON_ONCE(dec < 0);
248 }
249 put_ucounts(ucounts);
250}
251EXPORT_SYMBOL_FOR_MODULES(dec_ucount, "binfmt_misc");
252
253long inc_rlimit_ucounts(struct ucounts *ucounts, enum rlimit_type type, long v)
254{
255 struct ucounts *iter;
256 long max = LONG_MAX;
257 long ret = 0;
258
259 for (iter = ucounts; iter; iter = iter->ns->ucounts) {
260 long new = atomic_long_add_return(v, &iter->rlimit[type]);
261 if (new < 0 || new > max)
262 ret = LONG_MAX;
263 else if (iter == ucounts)
264 ret = new;
265 max = get_userns_rlimit_max(iter->ns, type);
266 }
267 return ret;
268}
269
270bool dec_rlimit_ucounts(struct ucounts *ucounts, enum rlimit_type type, long v)
271{
272 struct ucounts *iter;
273 long new = -1; /* Silence compiler warning */
274 for (iter = ucounts; iter; iter = iter->ns->ucounts) {
275 long dec = atomic_long_sub_return(v, &iter->rlimit[type]);
276 WARN_ON_ONCE(dec < 0);
277 if (iter == ucounts)
278 new = dec;
279 }
280 return (new == 0);
281}
282
283static void do_dec_rlimit_put_ucounts(struct ucounts *ucounts,
284 struct ucounts *last, enum rlimit_type type)
285{
286 struct ucounts *iter, *next;
287 for (iter = ucounts; iter != last; iter = next) {
288 long dec = atomic_long_sub_return(1, &iter->rlimit[type]);
289 WARN_ON_ONCE(dec < 0);
290 next = iter->ns->ucounts;
291 if (dec == 0)
292 put_ucounts(iter);
293 }
294}
295
296void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum rlimit_type type)
297{
298 do_dec_rlimit_put_ucounts(ucounts, NULL, type);
299}
300
301long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type,
302 bool override_rlimit)
303{
304 /* Caller must hold a reference to ucounts */
305 struct ucounts *iter;
306 long max = LONG_MAX;
307 long dec, ret = 0;
308
309 for (iter = ucounts; iter; iter = iter->ns->ucounts) {
310 long new = atomic_long_add_return(1, &iter->rlimit[type]);
311 if (new < 0 || new > max)
312 goto dec_unwind;
313 if (iter == ucounts)
314 ret = new;
315 if (!override_rlimit)
316 max = get_userns_rlimit_max(iter->ns, type);
317 /*
318 * Grab an extra ucount reference for the caller when
319 * the rlimit count was previously 0.
320 */
321 if (new != 1)
322 continue;
323 if (!get_ucounts(iter))
324 goto dec_unwind;
325 }
326 return ret;
327dec_unwind:
328 dec = atomic_long_sub_return(1, &iter->rlimit[type]);
329 WARN_ON_ONCE(dec < 0);
330 do_dec_rlimit_put_ucounts(ucounts, iter, type);
331 return 0;
332}
333
334bool is_rlimit_overlimit(struct ucounts *ucounts, enum rlimit_type type, unsigned long rlimit)
335{
336 struct ucounts *iter;
337 long max = rlimit;
338 if (rlimit > LONG_MAX)
339 max = LONG_MAX;
340 for (iter = ucounts; iter; iter = iter->ns->ucounts) {
341 long val = get_rlimit_value(iter, type);
342 if (val < 0 || val > max)
343 return true;
344 max = get_userns_rlimit_max(iter->ns, type);
345 }
346 return false;
347}
348
349static __init int user_namespace_sysctl_init(void)
350{
351#ifdef CONFIG_SYSCTL
352 static struct ctl_table_header *user_header;
353 static struct ctl_table empty[1];
354 /*
355 * It is necessary to register the user directory in the
356 * default set so that registrations in the child sets work
357 * properly.
358 */
359 user_header = register_sysctl_sz("user", empty, 0);
360 kmemleak_ignore(user_header);
361 BUG_ON(!user_header);
362 BUG_ON(!setup_userns_sysctls(&init_user_ns));
363#endif
364 hlist_add_ucounts(&init_ucounts);
365 inc_rlimit_ucounts(&init_ucounts, UCOUNT_RLIMIT_NPROC, 1);
366 return 0;
367}
368subsys_initcall(user_namespace_sysctl_init);