projects/linux·blob master · refs

1560 lines · 37.5 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
3
4#include <linux/workqueue.h>
5#include <linux/rtnetlink.h>
6#include <linux/cache.h>
7#include <linux/slab.h>
8#include <linux/list.h>
9#include <linux/delay.h>
10#include <linux/sched.h>
11#include <linux/idr.h>
12#include <linux/rculist.h>
13#include <linux/nsproxy.h>
14#include <linux/fs.h>
15#include <linux/proc_ns.h>
16#include <linux/file.h>
17#include <linux/export.h>
18#include <linux/user_namespace.h>
19#include <linux/net_namespace.h>
20#include <linux/sched/task.h>
21#include <linux/uidgid.h>
22#include <linux/proc_fs.h>
23#include <linux/nstree.h>
24
25#include <net/aligned_data.h>
26#include <net/sock.h>
27#include <net/netlink.h>
28#include <net/net_namespace.h>
29#include <net/netns/generic.h>
30
31/*
32 * Our network namespace constructor/destructor lists
33 */
34
35static LIST_HEAD(pernet_list);
36static struct list_head *first_device = &pernet_list;
37
38LIST_HEAD(net_namespace_list);
39EXPORT_SYMBOL_GPL(net_namespace_list);
40
41/* Protects net_namespace_list. Nests iside rtnl_lock() */
42DECLARE_RWSEM(net_rwsem);
43EXPORT_SYMBOL_GPL(net_rwsem);
44
45#ifdef CONFIG_KEYS
46static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) };
47#endif
48
49struct net init_net;
50EXPORT_SYMBOL(init_net);
51
52static bool init_net_initialized;
53/*
54 * pernet_ops_rwsem: protects: pernet_list, net_generic_ids,
55 * init_net_initialized and first_device pointer.
56 * This is internal net namespace object. Please, don't use it
57 * outside.
58 */
59DECLARE_RWSEM(pernet_ops_rwsem);
60
61#define MIN_PERNET_OPS_ID \
62 ((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *))
63
64#define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */
65
66static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
67
68static struct net_generic *net_alloc_generic(void)
69{
70 unsigned int gen_ptrs = READ_ONCE(max_gen_ptrs);
71 unsigned int generic_size;
72 struct net_generic *ng;
73
74 generic_size = offsetof(struct net_generic, ptr[gen_ptrs]);
75
76 ng = kzalloc(generic_size, GFP_KERNEL);
77 if (ng)
78 ng->s.len = gen_ptrs;
79
80 return ng;
81}
82
83static int net_assign_generic(struct net *net, unsigned int id, void *data)
84{
85 struct net_generic *ng, *old_ng;
86
87 BUG_ON(id < MIN_PERNET_OPS_ID);
88
89 old_ng = rcu_dereference_protected(net->gen,
90 lockdep_is_held(&pernet_ops_rwsem));
91 if (old_ng->s.len > id) {
92 old_ng->ptr[id] = data;
93 return 0;
94 }
95
96 ng = net_alloc_generic();
97 if (!ng)
98 return -ENOMEM;
99
100 /*
101 * Some synchronisation notes:
102 *
103 * The net_generic explores the net->gen array inside rcu
104 * read section. Besides once set the net->gen->ptr[x]
105 * pointer never changes (see rules in netns/generic.h).
106 *
107 * That said, we simply duplicate this array and schedule
108 * the old copy for kfree after a grace period.
109 */
110
111 memcpy(&ng->ptr[MIN_PERNET_OPS_ID], &old_ng->ptr[MIN_PERNET_OPS_ID],
112 (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *));
113 ng->ptr[id] = data;
114
115 rcu_assign_pointer(net->gen, ng);
116 kfree_rcu(old_ng, s.rcu);
117 return 0;
118}
119
120static int ops_init(const struct pernet_operations *ops, struct net *net)
121{
122 struct net_generic *ng;
123 int err = -ENOMEM;
124 void *data = NULL;
125
126 if (ops->id) {
127 data = kzalloc(ops->size, GFP_KERNEL);
128 if (!data)
129 goto out;
130
131 err = net_assign_generic(net, *ops->id, data);
132 if (err)
133 goto cleanup;
134 }
135 err = 0;
136 if (ops->init)
137 err = ops->init(net);
138 if (!err)
139 return 0;
140
141 if (ops->id) {
142 ng = rcu_dereference_protected(net->gen,
143 lockdep_is_held(&pernet_ops_rwsem));
144 ng->ptr[*ops->id] = NULL;
145 }
146
147cleanup:
148 kfree(data);
149
150out:
151 return err;
152}
153
154static void ops_pre_exit_list(const struct pernet_operations *ops,
155 struct list_head *net_exit_list)
156{
157 struct net *net;
158
159 if (ops->pre_exit) {
160 list_for_each_entry(net, net_exit_list, exit_list)
161 ops->pre_exit(net);
162 }
163}
164
165static void ops_exit_rtnl_list(const struct list_head *ops_list,
166 const struct pernet_operations *ops,
167 struct list_head *net_exit_list)
168{
169 const struct pernet_operations *saved_ops = ops;
170 LIST_HEAD(dev_kill_list);
171 struct net *net;
172
173 rtnl_lock();
174
175 list_for_each_entry(net, net_exit_list, exit_list) {
176 __rtnl_net_lock(net);
177
178 ops = saved_ops;
179 list_for_each_entry_continue_reverse(ops, ops_list, list) {
180 if (ops->exit_rtnl)
181 ops->exit_rtnl(net, &dev_kill_list);
182 }
183
184 unregister_netdevice_queue_many_net(net, &dev_kill_list);
185 __rtnl_net_unlock(net);
186 }
187
188 unregister_netdevice_many(&dev_kill_list);
189
190 rtnl_unlock();
191}
192
193static void ops_exit_list(const struct pernet_operations *ops,
194 struct list_head *net_exit_list)
195{
196 if (ops->exit) {
197 struct net *net;
198
199 list_for_each_entry(net, net_exit_list, exit_list) {
200 ops->exit(net);
201 cond_resched();
202 }
203 }
204
205 if (ops->exit_batch)
206 ops->exit_batch(net_exit_list);
207}
208
209static void ops_free_list(const struct pernet_operations *ops,
210 struct list_head *net_exit_list)
211{
212 struct net *net;
213
214 if (ops->id) {
215 list_for_each_entry(net, net_exit_list, exit_list)
216 kfree(net_generic(net, *ops->id));
217 }
218}
219
220static void ops_undo_list(const struct list_head *ops_list,
221 const struct pernet_operations *ops,
222 struct list_head *net_exit_list,
223 bool expedite_rcu)
224{
225 const struct pernet_operations *saved_ops;
226 bool hold_rtnl = false;
227
228 if (!ops)
229 ops = list_entry(ops_list, typeof(*ops), list);
230
231 saved_ops = ops;
232
233 list_for_each_entry_continue_reverse(ops, ops_list, list) {
234 hold_rtnl |= !!ops->exit_rtnl;
235 ops_pre_exit_list(ops, net_exit_list);
236 }
237
238 /* Another CPU might be rcu-iterating the list, wait for it.
239 * This needs to be before calling the exit() notifiers, so the
240 * rcu_barrier() after ops_undo_list() isn't sufficient alone.
241 * Also the pre_exit() and exit() methods need this barrier.
242 */
243 if (expedite_rcu)
244 synchronize_rcu_expedited();
245 else
246 synchronize_rcu();
247
248 if (hold_rtnl)
249 ops_exit_rtnl_list(ops_list, saved_ops, net_exit_list);
250
251 ops = saved_ops;
252 list_for_each_entry_continue_reverse(ops, ops_list, list)
253 ops_exit_list(ops, net_exit_list);
254
255 ops = saved_ops;
256 list_for_each_entry_continue_reverse(ops, ops_list, list)
257 ops_free_list(ops, net_exit_list);
258}
259
260static void ops_undo_single(struct pernet_operations *ops,
261 struct list_head *net_exit_list)
262{
263 LIST_HEAD(ops_list);
264
265 list_add(&ops->list, &ops_list);
266 ops_undo_list(&ops_list, NULL, net_exit_list, false);
267 list_del(&ops->list);
268}
269
270/* should be called with nsid_lock held */
271static int alloc_netid(struct net *net, struct net *peer, int reqid)
272{
273 int min = 0, max = 0;
274
275 if (reqid >= 0) {
276 min = reqid;
277 max = reqid + 1;
278 }
279
280 return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC);
281}
282
283/* This function is used by idr_for_each(). If net is equal to peer, the
284 * function returns the id so that idr_for_each() stops. Because we cannot
285 * returns the id 0 (idr_for_each() will not stop), we return the magic value
286 * NET_ID_ZERO (-1) for it.
287 */
288#define NET_ID_ZERO -1
289static int net_eq_idr(int id, void *net, void *peer)
290{
291 if (net_eq(net, peer))
292 return id ? : NET_ID_ZERO;
293 return 0;
294}
295
296/* Must be called from RCU-critical section or with nsid_lock held */
297static int __peernet2id(const struct net *net, struct net *peer)
298{
299 int id = idr_for_each(&net->netns_ids, net_eq_idr, peer);
300
301 /* Magic value for id 0. */
302 if (id == NET_ID_ZERO)
303 return 0;
304 if (id > 0)
305 return id;
306
307 return NETNSA_NSID_NOT_ASSIGNED;
308}
309
310static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
311 struct nlmsghdr *nlh, gfp_t gfp);
312/* This function returns the id of a peer netns. If no id is assigned, one will
313 * be allocated and returned.
314 */
315int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp)
316{
317 int id;
318
319 if (!check_net(net))
320 return NETNSA_NSID_NOT_ASSIGNED;
321
322 spin_lock(&net->nsid_lock);
323 id = __peernet2id(net, peer);
324 if (id >= 0) {
325 spin_unlock(&net->nsid_lock);
326 return id;
327 }
328
329 /* When peer is obtained from RCU lists, we may race with
330 * its cleanup. Check whether it's alive, and this guarantees
331 * we never hash a peer back to net->netns_ids, after it has
332 * just been idr_remove()'d from there in cleanup_net().
333 */
334 if (!maybe_get_net(peer)) {
335 spin_unlock(&net->nsid_lock);
336 return NETNSA_NSID_NOT_ASSIGNED;
337 }
338
339 id = alloc_netid(net, peer, -1);
340 spin_unlock(&net->nsid_lock);
341
342 put_net(peer);
343 if (id < 0)
344 return NETNSA_NSID_NOT_ASSIGNED;
345
346 rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp);
347
348 return id;
349}
350EXPORT_SYMBOL_GPL(peernet2id_alloc);
351
352/* This function returns, if assigned, the id of a peer netns. */
353int peernet2id(const struct net *net, struct net *peer)
354{
355 int id;
356
357 rcu_read_lock();
358 id = __peernet2id(net, peer);
359 rcu_read_unlock();
360
361 return id;
362}
363EXPORT_SYMBOL(peernet2id);
364
365/* This function returns true is the peer netns has an id assigned into the
366 * current netns.
367 */
368bool peernet_has_id(const struct net *net, struct net *peer)
369{
370 return peernet2id(net, peer) >= 0;
371}
372
373struct net *get_net_ns_by_id(const struct net *net, int id)
374{
375 struct net *peer;
376
377 if (id < 0)
378 return NULL;
379
380 rcu_read_lock();
381 peer = idr_find(&net->netns_ids, id);
382 if (peer)
383 peer = maybe_get_net(peer);
384 rcu_read_unlock();
385
386 return peer;
387}
388EXPORT_SYMBOL_GPL(get_net_ns_by_id);
389
390static __net_init void preinit_net_sysctl(struct net *net)
391{
392 net->core.sysctl_somaxconn = SOMAXCONN;
393 /* Limits per socket sk_omem_alloc usage.
394 * TCP zerocopy regular usage needs 128 KB.
395 */
396 net->core.sysctl_optmem_max = 128 * 1024;
397 net->core.sysctl_txrehash = SOCK_TXREHASH_ENABLED;
398 net->core.sysctl_tstamp_allow_data = 1;
399 net->core.sysctl_txq_reselection = msecs_to_jiffies(1000);
400}
401
402/* init code that must occur even if setup_net() is not called. */
403static __net_init void preinit_net(struct net *net, struct user_namespace *user_ns)
404{
405 refcount_set(&net->passive, 1);
406 ref_tracker_dir_init(&net->refcnt_tracker, 128, "net_refcnt");
407 ref_tracker_dir_init(&net->notrefcnt_tracker, 128, "net_notrefcnt");
408
409 net->hash_mix = get_random_u32();
410 net->dev_base_seq = 1;
411 net->user_ns = user_ns;
412
413 idr_init(&net->netns_ids);
414 spin_lock_init(&net->nsid_lock);
415 mutex_init(&net->ipv4.ra_mutex);
416
417#ifdef CONFIG_DEBUG_NET_SMALL_RTNL
418 mutex_init(&net->rtnl_mutex);
419 lock_set_cmp_fn(&net->rtnl_mutex, rtnl_net_lock_cmp_fn, NULL);
420 INIT_WORK(&net->rtnl_work, rtnl_net_work_func);
421 INIT_LIST_HEAD(&net->dev_unreg_head);
422 spin_lock_init(&net->dev_unreg_lock);
423#endif
424
425 INIT_LIST_HEAD(&net->ptype_all);
426 INIT_LIST_HEAD(&net->ptype_specific);
427 preinit_net_sysctl(net);
428}
429
430/*
431 * setup_net runs the initializers for the network namespace object.
432 */
433static __net_init int setup_net(struct net *net)
434{
435 /* Must be called with pernet_ops_rwsem held */
436 const struct pernet_operations *ops;
437 LIST_HEAD(net_exit_list);
438 int error = 0;
439
440 net->net_cookie = ns_tree_gen_id(net);
441
442 list_for_each_entry(ops, &pernet_list, list) {
443 error = ops_init(ops, net);
444 if (error < 0)
445 goto out_undo;
446 }
447 down_write(&net_rwsem);
448 list_add_tail_rcu(&net->list, &net_namespace_list);
449 up_write(&net_rwsem);
450 ns_tree_add_raw(net);
451out:
452 return error;
453
454out_undo:
455 /* Walk through the list backwards calling the exit functions
456 * for the pernet modules whose init functions did not fail.
457 */
458 list_add(&net->exit_list, &net_exit_list);
459 ops_undo_list(&pernet_list, ops, &net_exit_list, false);
460 rcu_barrier();
461 goto out;
462}
463
464#ifdef CONFIG_NET_NS
465static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
466{
467 return inc_ucount(ns, current_euid(), UCOUNT_NET_NAMESPACES);
468}
469
470static void dec_net_namespaces(struct ucounts *ucounts)
471{
472 dec_ucount(ucounts, UCOUNT_NET_NAMESPACES);
473}
474
475static struct kmem_cache *net_cachep __ro_after_init;
476static struct workqueue_struct *netns_wq;
477
478static struct net *net_alloc(void)
479{
480 struct net *net = NULL;
481 struct net_generic *ng;
482
483 ng = net_alloc_generic();
484 if (!ng)
485 goto out;
486
487 net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
488 if (!net)
489 goto out_free;
490
491#ifdef CONFIG_KEYS
492 net->key_domain = kzalloc_obj(struct key_tag);
493 if (!net->key_domain)
494 goto out_free_2;
495 refcount_set(&net->key_domain->usage, 1);
496#endif
497
498 rcu_assign_pointer(net->gen, ng);
499out:
500 return net;
501
502#ifdef CONFIG_KEYS
503out_free_2:
504 kmem_cache_free(net_cachep, net);
505 net = NULL;
506#endif
507out_free:
508 kfree(ng);
509 goto out;
510}
511
512static LLIST_HEAD(defer_free_list);
513
514static void net_complete_free(void)
515{
516 struct llist_node *kill_list;
517 struct net *net, *next;
518
519 /* Get the list of namespaces to free from last round. */
520 kill_list = llist_del_all(&defer_free_list);
521
522 llist_for_each_entry_safe(net, next, kill_list, defer_free_list)
523 kmem_cache_free(net_cachep, net);
524
525}
526
527void net_passive_dec(struct net *net)
528{
529 if (refcount_dec_and_test(&net->passive)) {
530 kfree(rcu_access_pointer(net->gen));
531
532#ifdef CONFIG_REF_TRACKER
533 /* There should not be any trackers left there. */
534 ref_tracker_dir_exit(&net->notrefcnt_tracker);
535 if (!net->refcnt_tracker.dead)
536 ref_tracker_dir_exit(&net->refcnt_tracker);
537#endif
538
539 /* Wait for an extra rcu_barrier() before final free. */
540 llist_add(&net->defer_free_list, &defer_free_list);
541 }
542}
543
544void net_drop_ns(struct ns_common *ns)
545{
546 if (ns)
547 net_passive_dec(to_net_ns(ns));
548}
549
550struct net *copy_net_ns(u64 flags,
551 struct user_namespace *user_ns, struct net *old_net)
552{
553 struct ucounts *ucounts;
554 struct net *net;
555 int rv;
556
557 if (!(flags & CLONE_NEWNET))
558 return get_net(old_net);
559
560 ucounts = inc_net_namespaces(user_ns);
561 if (!ucounts)
562 return ERR_PTR(-ENOSPC);
563
564 net = net_alloc();
565 if (!net) {
566 rv = -ENOMEM;
567 goto dec_ucounts;
568 }
569
570 preinit_net(net, user_ns);
571 net->ucounts = ucounts;
572 get_user_ns(user_ns);
573
574 rv = ns_common_init(net);
575 if (rv)
576 goto put_userns_no_common;
577
578 rv = down_read_killable(&pernet_ops_rwsem);
579 if (rv < 0)
580 goto put_userns;
581
582 rv = setup_net(net);
583
584 up_read(&pernet_ops_rwsem);
585
586 if (rv < 0) {
587put_userns:
588 ns_common_free(net);
589put_userns_no_common:
590#ifdef CONFIG_KEYS
591 key_remove_domain(net->key_domain);
592#endif
593 put_user_ns(user_ns);
594 net_passive_dec(net);
595dec_ucounts:
596 dec_net_namespaces(ucounts);
597 return ERR_PTR(rv);
598 }
599 return net;
600}
601
602/**
603 * net_ns_get_ownership - get sysfs ownership data for @net
604 * @net: network namespace in question (can be NULL)
605 * @uid: kernel user ID for sysfs objects
606 * @gid: kernel group ID for sysfs objects
607 *
608 * Returns the uid/gid pair of root in the user namespace associated with the
609 * given network namespace.
610 */
611void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid)
612{
613 if (net) {
614 kuid_t ns_root_uid = make_kuid(net->user_ns, 0);
615 kgid_t ns_root_gid = make_kgid(net->user_ns, 0);
616
617 if (uid_valid(ns_root_uid))
618 *uid = ns_root_uid;
619
620 if (gid_valid(ns_root_gid))
621 *gid = ns_root_gid;
622 } else {
623 *uid = GLOBAL_ROOT_UID;
624 *gid = GLOBAL_ROOT_GID;
625 }
626}
627EXPORT_SYMBOL_GPL(net_ns_get_ownership);
628
629static void unhash_nsid(struct net *last)
630{
631 struct net *tmp, *peer;
632
633 /* This function is only called from cleanup_net() work,
634 * and this work is the only process, that may delete
635 * a net from net_namespace_list. So, when the below
636 * is executing, the list may only grow. Thus, we do not
637 * use for_each_net_rcu() or net_rwsem.
638 */
639 for_each_net(tmp) {
640 int id = 0;
641
642 spin_lock(&tmp->nsid_lock);
643 while ((peer = idr_get_next(&tmp->netns_ids, &id))) {
644 int curr_id = id;
645
646 id++;
647 if (!peer->is_dying)
648 continue;
649
650 idr_remove(&tmp->netns_ids, curr_id);
651 spin_unlock(&tmp->nsid_lock);
652 rtnl_net_notifyid(tmp, RTM_DELNSID, curr_id, 0, NULL,
653 GFP_KERNEL);
654 spin_lock(&tmp->nsid_lock);
655 }
656 spin_unlock(&tmp->nsid_lock);
657 if (tmp == last)
658 break;
659 }
660}
661
662static LLIST_HEAD(cleanup_list);
663
664struct task_struct *cleanup_net_task;
665
666static void cleanup_net(struct work_struct *work)
667{
668 struct llist_node *net_kill_list;
669 struct net *net, *tmp, *last;
670 LIST_HEAD(net_exit_list);
671
672 WRITE_ONCE(cleanup_net_task, current);
673
674 /* Atomically snapshot the list of namespaces to cleanup */
675 net_kill_list = llist_del_all(&cleanup_list);
676
677 down_read(&pernet_ops_rwsem);
678
679 /* Don't let anyone else find us. */
680 down_write(&net_rwsem);
681 llist_for_each_entry(net, net_kill_list, cleanup_list) {
682 ns_tree_remove(net);
683 list_del_rcu(&net->list);
684 net->is_dying = true;
685 }
686 /* Cache last net. After we unlock rtnl, no one new net
687 * added to net_namespace_list can assign nsid pointer
688 * to a net from net_kill_list (see peernet2id_alloc()).
689 * So, we skip them in unhash_nsid().
690 *
691 * Note, that unhash_nsid() does not delete nsid links
692 * between net_kill_list's nets, as they've already
693 * deleted from net_namespace_list. But, this would be
694 * useless anyway, as netns_ids are destroyed there.
695 */
696 last = list_last_entry(&net_namespace_list, struct net, list);
697 up_write(&net_rwsem);
698
699 unhash_nsid(last);
700
701 llist_for_each_entry(net, net_kill_list, cleanup_list) {
702 idr_destroy(&net->netns_ids);
703 list_add_tail(&net->exit_list, &net_exit_list);
704 }
705
706 ops_undo_list(&pernet_list, NULL, &net_exit_list, true);
707
708 up_read(&pernet_ops_rwsem);
709
710 /* Ensure there are no outstanding rcu callbacks using this
711 * network namespace.
712 */
713 rcu_barrier();
714
715 net_complete_free();
716
717 /* Finally it is safe to free my network namespace structure */
718 list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
719 list_del_init(&net->exit_list);
720 ns_common_free(net);
721 dec_net_namespaces(net->ucounts);
722#ifdef CONFIG_KEYS
723 key_remove_domain(net->key_domain);
724#endif
725 put_user_ns(net->user_ns);
726 net_passive_dec(net);
727 }
728 WRITE_ONCE(cleanup_net_task, NULL);
729}
730
731/**
732 * net_ns_barrier - wait until concurrent net_cleanup_work is done
733 *
734 * cleanup_net runs from work queue and will first remove namespaces
735 * from the global list, then run net exit functions.
736 *
737 * Call this in module exit path to make sure that all netns
738 * ->exit ops have been invoked before the function is removed.
739 */
740void net_ns_barrier(void)
741{
742 down_write(&pernet_ops_rwsem);
743 up_write(&pernet_ops_rwsem);
744}
745EXPORT_SYMBOL(net_ns_barrier);
746
747static DECLARE_WORK(net_cleanup_work, cleanup_net);
748
749void __put_net(struct net *net)
750{
751 ref_tracker_dir_exit(&net->refcnt_tracker);
752 /* Cleanup the network namespace in process context */
753 if (llist_add(&net->cleanup_list, &cleanup_list))
754 queue_work(netns_wq, &net_cleanup_work);
755}
756EXPORT_SYMBOL_GPL(__put_net);
757
758/**
759 * get_net_ns - increment the refcount of the network namespace
760 * @ns: common namespace (net)
761 *
762 * Returns the net's common namespace or ERR_PTR() if ref is zero.
763 */
764struct ns_common *get_net_ns(struct ns_common *ns)
765{
766 struct net *net;
767
768 net = maybe_get_net(container_of(ns, struct net, ns));
769 if (net)
770 return &net->ns;
771 return ERR_PTR(-EINVAL);
772}
773EXPORT_SYMBOL_GPL(get_net_ns);
774
775struct net *get_net_ns_by_fd(int fd)
776{
777 CLASS(fd, f)(fd);
778
779 if (fd_empty(f))
780 return ERR_PTR(-EBADF);
781
782 if (proc_ns_file(fd_file(f))) {
783 struct ns_common *ns = get_proc_ns(file_inode(fd_file(f)));
784 if (ns->ops == &netns_operations)
785 return get_net(container_of(ns, struct net, ns));
786 }
787
788 return ERR_PTR(-EINVAL);
789}
790EXPORT_SYMBOL_GPL(get_net_ns_by_fd);
791#endif
792
793struct net *get_net_ns_by_pid(pid_t pid)
794{
795 struct task_struct *tsk;
796 struct net *net;
797
798 /* Lookup the network namespace */
799 net = ERR_PTR(-ESRCH);
800 rcu_read_lock();
801 tsk = find_task_by_vpid(pid);
802 if (tsk) {
803 struct nsproxy *nsproxy;
804 task_lock(tsk);
805 nsproxy = tsk->nsproxy;
806 if (nsproxy)
807 net = get_net(nsproxy->net_ns);
808 task_unlock(tsk);
809 }
810 rcu_read_unlock();
811 return net;
812}
813EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
814
815#ifdef CONFIG_NET_NS_REFCNT_TRACKER
816static void net_ns_net_debugfs(struct net *net)
817{
818 ref_tracker_dir_symlink(&net->refcnt_tracker, "netns-%llx-%u-refcnt",
819 net->net_cookie, net->ns.inum);
820 ref_tracker_dir_symlink(&net->notrefcnt_tracker, "netns-%llx-%u-notrefcnt",
821 net->net_cookie, net->ns.inum);
822}
823
824static int __init init_net_debugfs(void)
825{
826 ref_tracker_dir_debugfs(&init_net.refcnt_tracker);
827 ref_tracker_dir_debugfs(&init_net.notrefcnt_tracker);
828 net_ns_net_debugfs(&init_net);
829 return 0;
830}
831late_initcall(init_net_debugfs);
832#else
833static void net_ns_net_debugfs(struct net *net)
834{
835}
836#endif
837
838static __net_init int net_ns_net_init(struct net *net)
839{
840 net_ns_net_debugfs(net);
841 return 0;
842}
843
844static struct pernet_operations __net_initdata net_ns_ops = {
845 .init = net_ns_net_init,
846};
847
848static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = {
849 [NETNSA_NONE] = { .type = NLA_UNSPEC },
850 [NETNSA_NSID] = { .type = NLA_S32 },
851 [NETNSA_PID] = { .type = NLA_U32 },
852 [NETNSA_FD] = { .type = NLA_U32 },
853 [NETNSA_TARGET_NSID] = { .type = NLA_S32 },
854};
855
856static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
857 struct netlink_ext_ack *extack)
858{
859 struct net *net = sock_net(skb->sk);
860 struct nlattr *tb[NETNSA_MAX + 1];
861 struct nlattr *nla;
862 struct net *peer;
863 int nsid, err;
864
865 err = nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), tb,
866 NETNSA_MAX, rtnl_net_policy, extack);
867 if (err < 0)
868 return err;
869 if (!tb[NETNSA_NSID]) {
870 NL_SET_ERR_MSG(extack, "nsid is missing");
871 return -EINVAL;
872 }
873 nsid = nla_get_s32(tb[NETNSA_NSID]);
874
875 if (tb[NETNSA_PID]) {
876 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
877 nla = tb[NETNSA_PID];
878 } else if (tb[NETNSA_FD]) {
879 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
880 nla = tb[NETNSA_FD];
881 } else {
882 NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
883 return -EINVAL;
884 }
885 if (IS_ERR(peer)) {
886 NL_SET_BAD_ATTR(extack, nla);
887 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
888 return PTR_ERR(peer);
889 }
890
891 spin_lock(&net->nsid_lock);
892 if (__peernet2id(net, peer) >= 0) {
893 spin_unlock(&net->nsid_lock);
894 err = -EEXIST;
895 NL_SET_BAD_ATTR(extack, nla);
896 NL_SET_ERR_MSG(extack,
897 "Peer netns already has a nsid assigned");
898 goto out;
899 }
900
901 err = alloc_netid(net, peer, nsid);
902 spin_unlock(&net->nsid_lock);
903 if (err >= 0) {
904 rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid,
905 nlh, GFP_KERNEL);
906 err = 0;
907 } else if (err == -ENOSPC && nsid >= 0) {
908 err = -EEXIST;
909 NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]);
910 NL_SET_ERR_MSG(extack, "The specified nsid is already used");
911 }
912out:
913 put_net(peer);
914 return err;
915}
916
917static int rtnl_net_get_size(void)
918{
919 return NLMSG_ALIGN(sizeof(struct rtgenmsg))
920 + nla_total_size(sizeof(s32)) /* NETNSA_NSID */
921 + nla_total_size(sizeof(s32)) /* NETNSA_CURRENT_NSID */
922 ;
923}
924
925struct net_fill_args {
926 u32 portid;
927 u32 seq;
928 int flags;
929 int cmd;
930 int nsid;
931 bool add_ref;
932 int ref_nsid;
933};
934
935static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args)
936{
937 struct nlmsghdr *nlh;
938 struct rtgenmsg *rth;
939
940 nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth),
941 args->flags);
942 if (!nlh)
943 return -EMSGSIZE;
944
945 rth = nlmsg_data(nlh);
946 rth->rtgen_family = AF_UNSPEC;
947
948 if (nla_put_s32(skb, NETNSA_NSID, args->nsid))
949 goto nla_put_failure;
950
951 if (args->add_ref &&
952 nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid))
953 goto nla_put_failure;
954
955 nlmsg_end(skb, nlh);
956 return 0;
957
958nla_put_failure:
959 nlmsg_cancel(skb, nlh);
960 return -EMSGSIZE;
961}
962
963static int rtnl_net_valid_getid_req(struct sk_buff *skb,
964 const struct nlmsghdr *nlh,
965 struct nlattr **tb,
966 struct netlink_ext_ack *extack)
967{
968 int i, err;
969
970 if (!netlink_strict_get_check(skb))
971 return nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg),
972 tb, NETNSA_MAX, rtnl_net_policy,
973 extack);
974
975 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
976 NETNSA_MAX, rtnl_net_policy,
977 extack);
978 if (err)
979 return err;
980
981 for (i = 0; i <= NETNSA_MAX; i++) {
982 if (!tb[i])
983 continue;
984
985 switch (i) {
986 case NETNSA_PID:
987 case NETNSA_FD:
988 case NETNSA_NSID:
989 case NETNSA_TARGET_NSID:
990 break;
991 default:
992 NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request");
993 return -EINVAL;
994 }
995 }
996
997 return 0;
998}
999
1000static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
1001 struct netlink_ext_ack *extack)
1002{
1003 struct net *net = sock_net(skb->sk);
1004 struct nlattr *tb[NETNSA_MAX + 1];
1005 struct net_fill_args fillargs = {
1006 .portid = NETLINK_CB(skb).portid,
1007 .seq = nlh->nlmsg_seq,
1008 .cmd = RTM_NEWNSID,
1009 };
1010 struct net *peer, *target = net;
1011 struct nlattr *nla;
1012 struct sk_buff *msg;
1013 int err;
1014
1015 err = rtnl_net_valid_getid_req(skb, nlh, tb, extack);
1016 if (err < 0)
1017 return err;
1018 if (tb[NETNSA_PID]) {
1019 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
1020 nla = tb[NETNSA_PID];
1021 } else if (tb[NETNSA_FD]) {
1022 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
1023 nla = tb[NETNSA_FD];
1024 } else if (tb[NETNSA_NSID]) {
1025 peer = get_net_ns_by_id(net, nla_get_s32(tb[NETNSA_NSID]));
1026 if (!peer)
1027 peer = ERR_PTR(-ENOENT);
1028 nla = tb[NETNSA_NSID];
1029 } else {
1030 NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
1031 return -EINVAL;
1032 }
1033
1034 if (IS_ERR(peer)) {
1035 NL_SET_BAD_ATTR(extack, nla);
1036 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
1037 return PTR_ERR(peer);
1038 }
1039
1040 if (tb[NETNSA_TARGET_NSID]) {
1041 int id = nla_get_s32(tb[NETNSA_TARGET_NSID]);
1042
1043 target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id);
1044 if (IS_ERR(target)) {
1045 NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]);
1046 NL_SET_ERR_MSG(extack,
1047 "Target netns reference is invalid");
1048 err = PTR_ERR(target);
1049 goto out;
1050 }
1051 fillargs.add_ref = true;
1052 fillargs.ref_nsid = peernet2id(net, peer);
1053 }
1054
1055 msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
1056 if (!msg) {
1057 err = -ENOMEM;
1058 goto out;
1059 }
1060
1061 fillargs.nsid = peernet2id(target, peer);
1062 err = rtnl_net_fill(msg, &fillargs);
1063 if (err < 0)
1064 goto err_out;
1065
1066 err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid);
1067 goto out;
1068
1069err_out:
1070 nlmsg_free(msg);
1071out:
1072 if (fillargs.add_ref)
1073 put_net(target);
1074 put_net(peer);
1075 return err;
1076}
1077
1078struct rtnl_net_dump_cb {
1079 struct net *tgt_net;
1080 struct net *ref_net;
1081 struct sk_buff *skb;
1082 struct net_fill_args fillargs;
1083 int idx;
1084 int s_idx;
1085};
1086
1087/* Runs in RCU-critical section. */
1088static int rtnl_net_dumpid_one(int id, void *peer, void *data)
1089{
1090 struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data;
1091 int ret;
1092
1093 if (net_cb->idx < net_cb->s_idx)
1094 goto cont;
1095
1096 net_cb->fillargs.nsid = id;
1097 if (net_cb->fillargs.add_ref)
1098 net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer);
1099 ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs);
1100 if (ret < 0)
1101 return ret;
1102
1103cont:
1104 net_cb->idx++;
1105 return 0;
1106}
1107
1108static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk,
1109 struct rtnl_net_dump_cb *net_cb,
1110 struct netlink_callback *cb)
1111{
1112 struct netlink_ext_ack *extack = cb->extack;
1113 struct nlattr *tb[NETNSA_MAX + 1];
1114 int err, i;
1115
1116 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
1117 NETNSA_MAX, rtnl_net_policy,
1118 extack);
1119 if (err < 0)
1120 return err;
1121
1122 for (i = 0; i <= NETNSA_MAX; i++) {
1123 if (!tb[i])
1124 continue;
1125
1126 if (i == NETNSA_TARGET_NSID) {
1127 struct net *net;
1128
1129 net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i]));
1130 if (IS_ERR(net)) {
1131 NL_SET_BAD_ATTR(extack, tb[i]);
1132 NL_SET_ERR_MSG(extack,
1133 "Invalid target network namespace id");
1134 return PTR_ERR(net);
1135 }
1136 net_cb->fillargs.add_ref = true;
1137 net_cb->ref_net = net_cb->tgt_net;
1138 net_cb->tgt_net = net;
1139 } else {
1140 NL_SET_BAD_ATTR(extack, tb[i]);
1141 NL_SET_ERR_MSG(extack,
1142 "Unsupported attribute in dump request");
1143 return -EINVAL;
1144 }
1145 }
1146
1147 return 0;
1148}
1149
1150static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
1151{
1152 struct rtnl_net_dump_cb net_cb = {
1153 .tgt_net = sock_net(skb->sk),
1154 .skb = skb,
1155 .fillargs = {
1156 .portid = NETLINK_CB(cb->skb).portid,
1157 .seq = cb->nlh->nlmsg_seq,
1158 .flags = NLM_F_MULTI,
1159 .cmd = RTM_NEWNSID,
1160 },
1161 .idx = 0,
1162 .s_idx = cb->args[0],
1163 };
1164 int err = 0;
1165
1166 if (cb->strict_check) {
1167 err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb);
1168 if (err < 0)
1169 goto end;
1170 }
1171
1172 rcu_read_lock();
1173 idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb);
1174 rcu_read_unlock();
1175
1176 cb->args[0] = net_cb.idx;
1177end:
1178 if (net_cb.fillargs.add_ref)
1179 put_net(net_cb.tgt_net);
1180 return err;
1181}
1182
1183static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
1184 struct nlmsghdr *nlh, gfp_t gfp)
1185{
1186 struct net_fill_args fillargs = {
1187 .portid = portid,
1188 .seq = nlh ? nlh->nlmsg_seq : 0,
1189 .cmd = cmd,
1190 .nsid = id,
1191 };
1192 struct sk_buff *msg;
1193 int err = -ENOMEM;
1194
1195 msg = nlmsg_new(rtnl_net_get_size(), gfp);
1196 if (!msg)
1197 goto out;
1198
1199 err = rtnl_net_fill(msg, &fillargs);
1200 if (err < 0)
1201 goto err_out;
1202
1203 rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp);
1204 return;
1205
1206err_out:
1207 nlmsg_free(msg);
1208out:
1209 rtnl_set_sk_err(net, RTNLGRP_NSID, err);
1210}
1211
1212#ifdef CONFIG_NET_NS
1213static void __init netns_ipv4_struct_check(void)
1214{
1215 /* TX readonly hotpath cache lines */
1216 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1217 sysctl_tcp_early_retrans);
1218 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1219 sysctl_tcp_tso_win_divisor);
1220 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1221 sysctl_tcp_tso_rtt_log);
1222 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1223 sysctl_tcp_autocorking);
1224 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1225 sysctl_tcp_min_snd_mss);
1226 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1227 sysctl_tcp_notsent_lowat);
1228 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1229 sysctl_tcp_limit_output_bytes);
1230 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1231 sysctl_tcp_min_rtt_wlen);
1232 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1233 sysctl_tcp_wmem);
1234 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_tx,
1235 sysctl_ip_fwd_use_pmtu);
1236
1237 /* RX readonly hotpath cache line */
1238 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1239 sysctl_tcp_moderate_rcvbuf);
1240 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1241 sysctl_tcp_rcvbuf_low_rtt);
1242 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1243 sysctl_ip_early_demux);
1244 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1245 sysctl_tcp_early_demux);
1246 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1247 sysctl_tcp_l3mdev_accept);
1248 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1249 sysctl_tcp_reordering);
1250 CACHELINE_ASSERT_GROUP_MEMBER(struct netns_ipv4, netns_ipv4_read_rx,
1251 sysctl_tcp_rmem);
1252}
1253#endif
1254
1255static const struct rtnl_msg_handler net_ns_rtnl_msg_handlers[] __initconst = {
1256 {.msgtype = RTM_NEWNSID, .doit = rtnl_net_newid,
1257 .flags = RTNL_FLAG_DOIT_UNLOCKED},
1258 {.msgtype = RTM_GETNSID, .doit = rtnl_net_getid,
1259 .dumpit = rtnl_net_dumpid,
1260 .flags = RTNL_FLAG_DOIT_UNLOCKED | RTNL_FLAG_DUMP_UNLOCKED},
1261};
1262
1263void __init net_ns_init(void)
1264{
1265 struct net_generic *ng;
1266
1267#ifdef CONFIG_NET_NS
1268 netns_ipv4_struct_check();
1269 net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
1270 SMP_CACHE_BYTES,
1271 SLAB_PANIC|SLAB_ACCOUNT, NULL);
1272
1273 /* Create workqueue for cleanup */
1274 netns_wq = create_singlethread_workqueue("netns");
1275 if (!netns_wq)
1276 panic("Could not create netns workq");
1277#endif
1278
1279 ng = net_alloc_generic();
1280 if (!ng)
1281 panic("Could not allocate generic netns");
1282
1283 rcu_assign_pointer(init_net.gen, ng);
1284
1285#ifdef CONFIG_KEYS
1286 init_net.key_domain = &init_net_key_domain;
1287#endif
1288 /*
1289 * This currently cannot fail as the initial network namespace
1290 * has a static inode number.
1291 */
1292 preinit_net(&init_net, &init_user_ns);
1293 if (ns_common_init(&init_net))
1294 panic("Could not preinitialize the initial network namespace");
1295
1296 down_write(&pernet_ops_rwsem);
1297 if (setup_net(&init_net))
1298 panic("Could not setup the initial network namespace");
1299
1300 init_net_initialized = true;
1301 up_write(&pernet_ops_rwsem);
1302
1303 if (register_pernet_subsys(&net_ns_ops))
1304 panic("Could not register network namespace subsystems");
1305
1306 rtnl_register_many(net_ns_rtnl_msg_handlers);
1307}
1308
1309#ifdef CONFIG_NET_NS
1310static int __register_pernet_operations(struct list_head *list,
1311 struct pernet_operations *ops)
1312{
1313 LIST_HEAD(net_exit_list);
1314 struct net *net;
1315 int error;
1316
1317 list_add_tail(&ops->list, list);
1318 if (ops->init || ops->id) {
1319 /* We held write locked pernet_ops_rwsem, and parallel
1320 * setup_net() and cleanup_net() are not possible.
1321 */
1322 for_each_net(net) {
1323 error = ops_init(ops, net);
1324 if (error)
1325 goto out_undo;
1326 list_add_tail(&net->exit_list, &net_exit_list);
1327 }
1328 }
1329 return 0;
1330
1331out_undo:
1332 /* If I have an error cleanup all namespaces I initialized */
1333 list_del(&ops->list);
1334 ops_undo_single(ops, &net_exit_list);
1335 return error;
1336}
1337
1338static void __unregister_pernet_operations(struct pernet_operations *ops)
1339{
1340 LIST_HEAD(net_exit_list);
1341 struct net *net;
1342
1343 /* See comment in __register_pernet_operations() */
1344 for_each_net(net)
1345 list_add_tail(&net->exit_list, &net_exit_list);
1346
1347 list_del(&ops->list);
1348 ops_undo_single(ops, &net_exit_list);
1349}
1350
1351#else
1352
1353static int __register_pernet_operations(struct list_head *list,
1354 struct pernet_operations *ops)
1355{
1356 if (!init_net_initialized) {
1357 list_add_tail(&ops->list, list);
1358 return 0;
1359 }
1360
1361 return ops_init(ops, &init_net);
1362}
1363
1364static void __unregister_pernet_operations(struct pernet_operations *ops)
1365{
1366 if (!init_net_initialized) {
1367 list_del(&ops->list);
1368 } else {
1369 LIST_HEAD(net_exit_list);
1370
1371 list_add(&init_net.exit_list, &net_exit_list);
1372 ops_undo_single(ops, &net_exit_list);
1373 }
1374}
1375
1376#endif /* CONFIG_NET_NS */
1377
1378static DEFINE_IDA(net_generic_ids);
1379
1380static int register_pernet_operations(struct list_head *list,
1381 struct pernet_operations *ops)
1382{
1383 int error;
1384
1385 if (WARN_ON(!!ops->id ^ !!ops->size))
1386 return -EINVAL;
1387
1388 if (ops->id) {
1389 error = ida_alloc_min(&net_generic_ids, MIN_PERNET_OPS_ID,
1390 GFP_KERNEL);
1391 if (error < 0)
1392 return error;
1393 *ops->id = error;
1394 /* This does not require READ_ONCE as writers already hold
1395 * pernet_ops_rwsem. But WRITE_ONCE is needed to protect
1396 * net_alloc_generic.
1397 */
1398 WRITE_ONCE(max_gen_ptrs, max(max_gen_ptrs, *ops->id + 1));
1399 }
1400 error = __register_pernet_operations(list, ops);
1401 if (error) {
1402 rcu_barrier();
1403 if (ops->id)
1404 ida_free(&net_generic_ids, *ops->id);
1405 }
1406
1407 return error;
1408}
1409
1410static void unregister_pernet_operations(struct pernet_operations *ops)
1411{
1412 __unregister_pernet_operations(ops);
1413 rcu_barrier();
1414 if (ops->id)
1415 ida_free(&net_generic_ids, *ops->id);
1416}
1417
1418/**
1419 * register_pernet_subsys - register a network namespace subsystem
1420 * @ops: pernet operations structure for the subsystem
1421 *
1422 * Register a subsystem which has init and exit functions
1423 * that are called when network namespaces are created and
1424 * destroyed respectively.
1425 *
1426 * When registered all network namespace init functions are
1427 * called for every existing network namespace. Allowing kernel
1428 * modules to have a race free view of the set of network namespaces.
1429 *
1430 * When a new network namespace is created all of the init
1431 * methods are called in the order in which they were registered.
1432 *
1433 * When a network namespace is destroyed all of the exit methods
1434 * are called in the reverse of the order with which they were
1435 * registered.
1436 */
1437int register_pernet_subsys(struct pernet_operations *ops)
1438{
1439 int error;
1440 down_write(&pernet_ops_rwsem);
1441 error = register_pernet_operations(first_device, ops);
1442 up_write(&pernet_ops_rwsem);
1443 return error;
1444}
1445EXPORT_SYMBOL_GPL(register_pernet_subsys);
1446
1447/**
1448 * unregister_pernet_subsys - unregister a network namespace subsystem
1449 * @ops: pernet operations structure to manipulate
1450 *
1451 * Remove the pernet operations structure from the list to be
1452 * used when network namespaces are created or destroyed. In
1453 * addition run the exit method for all existing network
1454 * namespaces.
1455 */
1456void unregister_pernet_subsys(struct pernet_operations *ops)
1457{
1458 down_write(&pernet_ops_rwsem);
1459 unregister_pernet_operations(ops);
1460 up_write(&pernet_ops_rwsem);
1461}
1462EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
1463
1464/**
1465 * register_pernet_device - register a network namespace device
1466 * @ops: pernet operations structure for the subsystem
1467 *
1468 * Register a device which has init and exit functions
1469 * that are called when network namespaces are created and
1470 * destroyed respectively.
1471 *
1472 * When registered all network namespace init functions are
1473 * called for every existing network namespace. Allowing kernel
1474 * modules to have a race free view of the set of network namespaces.
1475 *
1476 * When a new network namespace is created all of the init
1477 * methods are called in the order in which they were registered.
1478 *
1479 * When a network namespace is destroyed all of the exit methods
1480 * are called in the reverse of the order with which they were
1481 * registered.
1482 */
1483int register_pernet_device(struct pernet_operations *ops)
1484{
1485 int error;
1486 down_write(&pernet_ops_rwsem);
1487 error = register_pernet_operations(&pernet_list, ops);
1488 if (!error && (first_device == &pernet_list))
1489 first_device = &ops->list;
1490 up_write(&pernet_ops_rwsem);
1491 return error;
1492}
1493EXPORT_SYMBOL_GPL(register_pernet_device);
1494
1495/**
1496 * unregister_pernet_device - unregister a network namespace netdevice
1497 * @ops: pernet operations structure to manipulate
1498 *
1499 * Remove the pernet operations structure from the list to be
1500 * used when network namespaces are created or destroyed. In
1501 * addition run the exit method for all existing network
1502 * namespaces.
1503 */
1504void unregister_pernet_device(struct pernet_operations *ops)
1505{
1506 down_write(&pernet_ops_rwsem);
1507 if (&ops->list == first_device)
1508 first_device = first_device->next;
1509 unregister_pernet_operations(ops);
1510 up_write(&pernet_ops_rwsem);
1511}
1512EXPORT_SYMBOL_GPL(unregister_pernet_device);
1513
1514#ifdef CONFIG_NET_NS
1515static struct ns_common *netns_get(struct task_struct *task)
1516{
1517 struct net *net = NULL;
1518 struct nsproxy *nsproxy;
1519
1520 task_lock(task);
1521 nsproxy = task->nsproxy;
1522 if (nsproxy)
1523 net = get_net(nsproxy->net_ns);
1524 task_unlock(task);
1525
1526 return net ? &net->ns : NULL;
1527}
1528
1529static void netns_put(struct ns_common *ns)
1530{
1531 put_net(to_net_ns(ns));
1532}
1533
1534static int netns_install(struct nsset *nsset, struct ns_common *ns)
1535{
1536 struct nsproxy *nsproxy = nsset->nsproxy;
1537 struct net *net = to_net_ns(ns);
1538
1539 if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
1540 !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
1541 return -EPERM;
1542
1543 put_net(nsproxy->net_ns);
1544 nsproxy->net_ns = get_net(net);
1545 return 0;
1546}
1547
1548static struct user_namespace *netns_owner(struct ns_common *ns)
1549{
1550 return to_net_ns(ns)->user_ns;
1551}
1552
1553const struct proc_ns_operations netns_operations = {
1554 .name = "net",
1555 .get = netns_get,
1556 .put = netns_put,
1557 .install = netns_install,
1558 .owner = netns_owner,
1559};
1560#endif