1/*
  2 *  Copyright (C) 2006 IBM Corporation
  3 *
  4 *  Author: Serge Hallyn <serue@us.ibm.com>
  5 *
  6 *  This program is free software; you can redistribute it and/or
  7 *  modify it under the terms of the GNU General Public License as
  8 *  published by the Free Software Foundation, version 2 of the
  9 *  License.
 10 *
 11 *  Jun 2006 - namespaces support
 12 *             OpenVZ, SWsoft Inc.
 13 *             Pavel Emelianov <xemul@openvz.org>
 14 */
 15
 16#include <linux/slab.h>
 17#include <linux/export.h>
 18#include <linux/nsproxy.h>
 19#include <linux/init_task.h>
 20#include <linux/mnt_namespace.h>
 21#include <linux/utsname.h>
 22#include <linux/pid_namespace.h>
 23#include <net/net_namespace.h>
 24#include <linux/ipc_namespace.h>
 25#include <linux/proc_ns.h>
 26#include <linux/file.h>
 27#include <linux/syscalls.h>
 28
 29static struct kmem_cache *nsproxy_cachep;
 30
 31struct nsproxy init_nsproxy = {
 32	.count			= ATOMIC_INIT(1),
 33	.uts_ns			= &init_uts_ns,
 34#if defined(CONFIG_POSIX_MQUEUE) || defined(CONFIG_SYSVIPC)
 35	.ipc_ns			= &init_ipc_ns,
 36#endif
 37	.mnt_ns			= NULL,
 38	.pid_ns_for_children	= &init_pid_ns,
 39#ifdef CONFIG_NET
 40	.net_ns			= &init_net,
 41#endif
 42};
 43
 44static inline struct nsproxy *create_nsproxy(void)
 45{
 46	struct nsproxy *nsproxy;
 47
 48	nsproxy = kmem_cache_alloc(nsproxy_cachep, GFP_KERNEL);
 49	if (nsproxy)
 50		atomic_set(&nsproxy->count, 1);
 51	return nsproxy;
 52}
 53
 54/*
 55 * Create new nsproxy and all of its the associated namespaces.
 56 * Return the newly created nsproxy.  Do not attach this to the task,
 57 * leave it to the caller to do proper locking and attach it to task.
 58 */
 59static struct nsproxy *create_new_namespaces(unsigned long flags,
 60	struct task_struct *tsk, struct user_namespace *user_ns,
 61	struct fs_struct *new_fs)
 62{
 63	struct nsproxy *new_nsp;
 64	int err;
 65
 66	new_nsp = create_nsproxy();
 67	if (!new_nsp)
 68		return ERR_PTR(-ENOMEM);
 69
 70	new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, user_ns, new_fs);
 71	if (IS_ERR(new_nsp->mnt_ns)) {
 72		err = PTR_ERR(new_nsp->mnt_ns);
 73		goto out_ns;
 74	}
 75
 76	new_nsp->uts_ns = copy_utsname(flags, user_ns, tsk->nsproxy->uts_ns);
 77	if (IS_ERR(new_nsp->uts_ns)) {
 78		err = PTR_ERR(new_nsp->uts_ns);
 79		goto out_uts;
 80	}
 81
 82	new_nsp->ipc_ns = copy_ipcs(flags, user_ns, tsk->nsproxy->ipc_ns);
 83	if (IS_ERR(new_nsp->ipc_ns)) {
 84		err = PTR_ERR(new_nsp->ipc_ns);
 85		goto out_ipc;
 86	}
 87
 88	new_nsp->pid_ns_for_children =
 89		copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns_for_children);
 90	if (IS_ERR(new_nsp->pid_ns_for_children)) {
 91		err = PTR_ERR(new_nsp->pid_ns_for_children);
 92		goto out_pid;
 93	}
 94
 95	new_nsp->net_ns = copy_net_ns(flags, user_ns, tsk->nsproxy->net_ns);
 96	if (IS_ERR(new_nsp->net_ns)) {
 97		err = PTR_ERR(new_nsp->net_ns);
 98		goto out_net;
 99	}
100
101	return new_nsp;
102
103out_net:
104	if (new_nsp->pid_ns_for_children)
105		put_pid_ns(new_nsp->pid_ns_for_children);
106out_pid:
107	if (new_nsp->ipc_ns)
108		put_ipc_ns(new_nsp->ipc_ns);
109out_ipc:
110	if (new_nsp->uts_ns)
111		put_uts_ns(new_nsp->uts_ns);
112out_uts:
113	if (new_nsp->mnt_ns)
114		put_mnt_ns(new_nsp->mnt_ns);
115out_ns:
116	kmem_cache_free(nsproxy_cachep, new_nsp);
117	return ERR_PTR(err);
118}
119
120/*
121 * called from clone.  This now handles copy for nsproxy and all
122 * namespaces therein.
123 */
124int copy_namespaces(unsigned long flags, struct task_struct *tsk)
125{
126	struct nsproxy *old_ns = tsk->nsproxy;
127	struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns);
128	struct nsproxy *new_ns;
 
129
130	if (likely(!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
131			      CLONE_NEWPID | CLONE_NEWNET)))) {
132		get_nsproxy(old_ns);
133		return 0;
134	}
135
136	if (!ns_capable(user_ns, CAP_SYS_ADMIN))
137		return -EPERM;
 
 
 
 
 
 
 
 
138
139	/*
140	 * CLONE_NEWIPC must detach from the undolist: after switching
141	 * to a new ipc namespace, the semaphore arrays from the old
142	 * namespace are unreachable.  In clone parlance, CLONE_SYSVSEM
143	 * means share undolist with parent, so we must forbid using
144	 * it along with CLONE_NEWIPC.
145	 */
146	if ((flags & (CLONE_NEWIPC | CLONE_SYSVSEM)) ==
147		(CLONE_NEWIPC | CLONE_SYSVSEM)) 
148		return -EINVAL;
149
150	new_ns = create_new_namespaces(flags, tsk, user_ns, tsk->fs);
151	if (IS_ERR(new_ns))
152		return  PTR_ERR(new_ns);
 
 
 
153
154	tsk->nsproxy = new_ns;
155	return 0;
 
 
 
156}
157
158void free_nsproxy(struct nsproxy *ns)
159{
160	if (ns->mnt_ns)
161		put_mnt_ns(ns->mnt_ns);
162	if (ns->uts_ns)
163		put_uts_ns(ns->uts_ns);
164	if (ns->ipc_ns)
165		put_ipc_ns(ns->ipc_ns);
166	if (ns->pid_ns_for_children)
167		put_pid_ns(ns->pid_ns_for_children);
168	put_net(ns->net_ns);
169	kmem_cache_free(nsproxy_cachep, ns);
170}
171
172/*
173 * Called from unshare. Unshare all the namespaces part of nsproxy.
174 * On success, returns the new nsproxy.
175 */
176int unshare_nsproxy_namespaces(unsigned long unshare_flags,
177	struct nsproxy **new_nsp, struct cred *new_cred, struct fs_struct *new_fs)
178{
179	struct user_namespace *user_ns;
180	int err = 0;
181
182	if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
183			       CLONE_NEWNET | CLONE_NEWPID)))
184		return 0;
185
186	user_ns = new_cred ? new_cred->user_ns : current_user_ns();
187	if (!ns_capable(user_ns, CAP_SYS_ADMIN))
188		return -EPERM;
189
190	*new_nsp = create_new_namespaces(unshare_flags, current, user_ns,
191					 new_fs ? new_fs : current->fs);
192	if (IS_ERR(*new_nsp)) {
193		err = PTR_ERR(*new_nsp);
194		goto out;
195	}
196
197out:
198	return err;
199}
200
201void switch_task_namespaces(struct task_struct *p, struct nsproxy *new)
202{
203	struct nsproxy *ns;
204
205	might_sleep();
206
207	ns = p->nsproxy;
208
209	rcu_assign_pointer(p->nsproxy, new);
210
211	if (ns && atomic_dec_and_test(&ns->count)) {
212		/*
213		 * wait for others to get what they want from this nsproxy.
214		 *
215		 * cannot release this nsproxy via the call_rcu() since
216		 * put_mnt_ns() will want to sleep
217		 */
218		synchronize_rcu();
219		free_nsproxy(ns);
220	}
221}
222
223void exit_task_namespaces(struct task_struct *p)
224{
225	switch_task_namespaces(p, NULL);
226}
227
228SYSCALL_DEFINE2(setns, int, fd, int, nstype)
229{
230	const struct proc_ns_operations *ops;
231	struct task_struct *tsk = current;
232	struct nsproxy *new_nsproxy;
233	struct proc_ns *ei;
234	struct file *file;
235	int err;
236
 
 
 
237	file = proc_ns_fget(fd);
238	if (IS_ERR(file))
239		return PTR_ERR(file);
240
241	err = -EINVAL;
242	ei = get_proc_ns(file_inode(file));
243	ops = ei->ns_ops;
244	if (nstype && (ops->type != nstype))
245		goto out;
246
247	new_nsproxy = create_new_namespaces(0, tsk, current_user_ns(), tsk->fs);
248	if (IS_ERR(new_nsproxy)) {
249		err = PTR_ERR(new_nsproxy);
250		goto out;
251	}
252
253	err = ops->install(new_nsproxy, ei->ns);
254	if (err) {
255		free_nsproxy(new_nsproxy);
256		goto out;
257	}
258	switch_task_namespaces(tsk, new_nsproxy);
259out:
260	fput(file);
261	return err;
262}
263
264int __init nsproxy_cache_init(void)
265{
266	nsproxy_cachep = KMEM_CACHE(nsproxy, SLAB_PANIC);
267	return 0;
268}

  1/*
  2 *  Copyright (C) 2006 IBM Corporation
  3 *
  4 *  Author: Serge Hallyn <serue@us.ibm.com>
  5 *
  6 *  This program is free software; you can redistribute it and/or
  7 *  modify it under the terms of the GNU General Public License as
  8 *  published by the Free Software Foundation, version 2 of the
  9 *  License.
 10 *
 11 *  Jun 2006 - namespaces support
 12 *             OpenVZ, SWsoft Inc.
 13 *             Pavel Emelianov <xemul@openvz.org>
 14 */
 15
 16#include <linux/slab.h>
 17#include <linux/module.h>
 18#include <linux/nsproxy.h>
 19#include <linux/init_task.h>
 20#include <linux/mnt_namespace.h>
 21#include <linux/utsname.h>
 22#include <linux/pid_namespace.h>
 23#include <net/net_namespace.h>
 24#include <linux/ipc_namespace.h>
 25#include <linux/proc_fs.h>
 26#include <linux/file.h>
 27#include <linux/syscalls.h>
 28
 29static struct kmem_cache *nsproxy_cachep;
 30
 31struct nsproxy init_nsproxy = {
 32	.count	= ATOMIC_INIT(1),
 33	.uts_ns	= &init_uts_ns,
 34#if defined(CONFIG_POSIX_MQUEUE) || defined(CONFIG_SYSVIPC)
 35	.ipc_ns	= &init_ipc_ns,
 36#endif
 37	.mnt_ns	= NULL,
 38	.pid_ns	= &init_pid_ns,
 39#ifdef CONFIG_NET
 40	.net_ns	= &init_net,
 41#endif
 42};
 43
 44static inline struct nsproxy *create_nsproxy(void)
 45{
 46	struct nsproxy *nsproxy;
 47
 48	nsproxy = kmem_cache_alloc(nsproxy_cachep, GFP_KERNEL);
 49	if (nsproxy)
 50		atomic_set(&nsproxy->count, 1);
 51	return nsproxy;
 52}
 53
 54/*
 55 * Create new nsproxy and all of its the associated namespaces.
 56 * Return the newly created nsproxy.  Do not attach this to the task,
 57 * leave it to the caller to do proper locking and attach it to task.
 58 */
 59static struct nsproxy *create_new_namespaces(unsigned long flags,
 60			struct task_struct *tsk, struct fs_struct *new_fs)
 
 61{
 62	struct nsproxy *new_nsp;
 63	int err;
 64
 65	new_nsp = create_nsproxy();
 66	if (!new_nsp)
 67		return ERR_PTR(-ENOMEM);
 68
 69	new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, new_fs);
 70	if (IS_ERR(new_nsp->mnt_ns)) {
 71		err = PTR_ERR(new_nsp->mnt_ns);
 72		goto out_ns;
 73	}
 74
 75	new_nsp->uts_ns = copy_utsname(flags, tsk);
 76	if (IS_ERR(new_nsp->uts_ns)) {
 77		err = PTR_ERR(new_nsp->uts_ns);
 78		goto out_uts;
 79	}
 80
 81	new_nsp->ipc_ns = copy_ipcs(flags, tsk);
 82	if (IS_ERR(new_nsp->ipc_ns)) {
 83		err = PTR_ERR(new_nsp->ipc_ns);
 84		goto out_ipc;
 85	}
 86
 87	new_nsp->pid_ns = copy_pid_ns(flags, task_active_pid_ns(tsk));
 88	if (IS_ERR(new_nsp->pid_ns)) {
 89		err = PTR_ERR(new_nsp->pid_ns);
 
 90		goto out_pid;
 91	}
 92
 93	new_nsp->net_ns = copy_net_ns(flags, tsk->nsproxy->net_ns);
 94	if (IS_ERR(new_nsp->net_ns)) {
 95		err = PTR_ERR(new_nsp->net_ns);
 96		goto out_net;
 97	}
 98
 99	return new_nsp;
100
101out_net:
102	if (new_nsp->pid_ns)
103		put_pid_ns(new_nsp->pid_ns);
104out_pid:
105	if (new_nsp->ipc_ns)
106		put_ipc_ns(new_nsp->ipc_ns);
107out_ipc:
108	if (new_nsp->uts_ns)
109		put_uts_ns(new_nsp->uts_ns);
110out_uts:
111	if (new_nsp->mnt_ns)
112		put_mnt_ns(new_nsp->mnt_ns);
113out_ns:
114	kmem_cache_free(nsproxy_cachep, new_nsp);
115	return ERR_PTR(err);
116}
117
118/*
119 * called from clone.  This now handles copy for nsproxy and all
120 * namespaces therein.
121 */
122int copy_namespaces(unsigned long flags, struct task_struct *tsk)
123{
124	struct nsproxy *old_ns = tsk->nsproxy;
 
125	struct nsproxy *new_ns;
126	int err = 0;
127
128	if (!old_ns)
 
 
129		return 0;
 
130
131	get_nsproxy(old_ns);
132
133	if (!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
134				CLONE_NEWPID | CLONE_NEWNET)))
135		return 0;
136
137	if (!capable(CAP_SYS_ADMIN)) {
138		err = -EPERM;
139		goto out;
140	}
141
142	/*
143	 * CLONE_NEWIPC must detach from the undolist: after switching
144	 * to a new ipc namespace, the semaphore arrays from the old
145	 * namespace are unreachable.  In clone parlance, CLONE_SYSVSEM
146	 * means share undolist with parent, so we must forbid using
147	 * it along with CLONE_NEWIPC.
148	 */
149	if ((flags & CLONE_NEWIPC) && (flags & CLONE_SYSVSEM)) {
150		err = -EINVAL;
151		goto out;
152	}
153
154	new_ns = create_new_namespaces(flags, tsk, tsk->fs);
155	if (IS_ERR(new_ns)) {
156		err = PTR_ERR(new_ns);
157		goto out;
158	}
159
160	tsk->nsproxy = new_ns;
161
162out:
163	put_nsproxy(old_ns);
164	return err;
165}
166
167void free_nsproxy(struct nsproxy *ns)
168{
169	if (ns->mnt_ns)
170		put_mnt_ns(ns->mnt_ns);
171	if (ns->uts_ns)
172		put_uts_ns(ns->uts_ns);
173	if (ns->ipc_ns)
174		put_ipc_ns(ns->ipc_ns);
175	if (ns->pid_ns)
176		put_pid_ns(ns->pid_ns);
177	put_net(ns->net_ns);
178	kmem_cache_free(nsproxy_cachep, ns);
179}
180
181/*
182 * Called from unshare. Unshare all the namespaces part of nsproxy.
183 * On success, returns the new nsproxy.
184 */
185int unshare_nsproxy_namespaces(unsigned long unshare_flags,
186		struct nsproxy **new_nsp, struct fs_struct *new_fs)
187{
 
188	int err = 0;
189
190	if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
191			       CLONE_NEWNET)))
192		return 0;
193
194	if (!capable(CAP_SYS_ADMIN))
 
195		return -EPERM;
196
197	*new_nsp = create_new_namespaces(unshare_flags, current,
198				new_fs ? new_fs : current->fs);
199	if (IS_ERR(*new_nsp)) {
200		err = PTR_ERR(*new_nsp);
201		goto out;
202	}
203
204out:
205	return err;
206}
207
208void switch_task_namespaces(struct task_struct *p, struct nsproxy *new)
209{
210	struct nsproxy *ns;
211
212	might_sleep();
213
214	ns = p->nsproxy;
215
216	rcu_assign_pointer(p->nsproxy, new);
217
218	if (ns && atomic_dec_and_test(&ns->count)) {
219		/*
220		 * wait for others to get what they want from this nsproxy.
221		 *
222		 * cannot release this nsproxy via the call_rcu() since
223		 * put_mnt_ns() will want to sleep
224		 */
225		synchronize_rcu();
226		free_nsproxy(ns);
227	}
228}
229
230void exit_task_namespaces(struct task_struct *p)
231{
232	switch_task_namespaces(p, NULL);
233}
234
235SYSCALL_DEFINE2(setns, int, fd, int, nstype)
236{
237	const struct proc_ns_operations *ops;
238	struct task_struct *tsk = current;
239	struct nsproxy *new_nsproxy;
240	struct proc_inode *ei;
241	struct file *file;
242	int err;
243
244	if (!capable(CAP_SYS_ADMIN))
245		return -EPERM;
246
247	file = proc_ns_fget(fd);
248	if (IS_ERR(file))
249		return PTR_ERR(file);
250
251	err = -EINVAL;
252	ei = PROC_I(file->f_dentry->d_inode);
253	ops = ei->ns_ops;
254	if (nstype && (ops->type != nstype))
255		goto out;
256
257	new_nsproxy = create_new_namespaces(0, tsk, tsk->fs);
258	if (IS_ERR(new_nsproxy)) {
259		err = PTR_ERR(new_nsproxy);
260		goto out;
261	}
262
263	err = ops->install(new_nsproxy, ei->ns);
264	if (err) {
265		free_nsproxy(new_nsproxy);
266		goto out;
267	}
268	switch_task_namespaces(tsk, new_nsproxy);
269out:
270	fput(file);
271	return err;
272}
273
274int __init nsproxy_cache_init(void)
275{
276	nsproxy_cachep = KMEM_CACHE(nsproxy, SLAB_PANIC);
277	return 0;
278}