Loading...
Note: File does not exist in v4.10.11.
1// SPDX-License-Identifier: GPL-2.0
2#include <linux/anon_inodes.h>
3#include <linux/file.h>
4#include <linux/fs.h>
5#include <linux/cgroup.h>
6#include <linux/magic.h>
7#include <linux/mount.h>
8#include <linux/pid.h>
9#include <linux/pidfs.h>
10#include <linux/pid_namespace.h>
11#include <linux/poll.h>
12#include <linux/proc_fs.h>
13#include <linux/proc_ns.h>
14#include <linux/pseudo_fs.h>
15#include <linux/ptrace.h>
16#include <linux/seq_file.h>
17#include <uapi/linux/pidfd.h>
18#include <linux/ipc_namespace.h>
19#include <linux/time_namespace.h>
20#include <linux/utsname.h>
21#include <net/net_namespace.h>
22
23#include "internal.h"
24#include "mount.h"
25
26#ifdef CONFIG_PROC_FS
27/**
28 * pidfd_show_fdinfo - print information about a pidfd
29 * @m: proc fdinfo file
30 * @f: file referencing a pidfd
31 *
32 * Pid:
33 * This function will print the pid that a given pidfd refers to in the
34 * pid namespace of the procfs instance.
35 * If the pid namespace of the process is not a descendant of the pid
36 * namespace of the procfs instance 0 will be shown as its pid. This is
37 * similar to calling getppid() on a process whose parent is outside of
38 * its pid namespace.
39 *
40 * NSpid:
41 * If pid namespaces are supported then this function will also print
42 * the pid of a given pidfd refers to for all descendant pid namespaces
43 * starting from the current pid namespace of the instance, i.e. the
44 * Pid field and the first entry in the NSpid field will be identical.
45 * If the pid namespace of the process is not a descendant of the pid
46 * namespace of the procfs instance 0 will be shown as its first NSpid
47 * entry and no others will be shown.
48 * Note that this differs from the Pid and NSpid fields in
49 * /proc/<pid>/status where Pid and NSpid are always shown relative to
50 * the pid namespace of the procfs instance. The difference becomes
51 * obvious when sending around a pidfd between pid namespaces from a
52 * different branch of the tree, i.e. where no ancestral relation is
53 * present between the pid namespaces:
54 * - create two new pid namespaces ns1 and ns2 in the initial pid
55 * namespace (also take care to create new mount namespaces in the
56 * new pid namespace and mount procfs)
57 * - create a process with a pidfd in ns1
58 * - send pidfd from ns1 to ns2
59 * - read /proc/self/fdinfo/<pidfd> and observe that both Pid and NSpid
60 * have exactly one entry, which is 0
61 */
62static void pidfd_show_fdinfo(struct seq_file *m, struct file *f)
63{
64 struct pid *pid = pidfd_pid(f);
65 struct pid_namespace *ns;
66 pid_t nr = -1;
67
68 if (likely(pid_has_task(pid, PIDTYPE_PID))) {
69 ns = proc_pid_ns(file_inode(m->file)->i_sb);
70 nr = pid_nr_ns(pid, ns);
71 }
72
73 seq_put_decimal_ll(m, "Pid:\t", nr);
74
75#ifdef CONFIG_PID_NS
76 seq_put_decimal_ll(m, "\nNSpid:\t", nr);
77 if (nr > 0) {
78 int i;
79
80 /* If nr is non-zero it means that 'pid' is valid and that
81 * ns, i.e. the pid namespace associated with the procfs
82 * instance, is in the pid namespace hierarchy of pid.
83 * Start at one below the already printed level.
84 */
85 for (i = ns->level + 1; i <= pid->level; i++)
86 seq_put_decimal_ll(m, "\t", pid->numbers[i].nr);
87 }
88#endif
89 seq_putc(m, '\n');
90}
91#endif
92
93/*
94 * Poll support for process exit notification.
95 */
96static __poll_t pidfd_poll(struct file *file, struct poll_table_struct *pts)
97{
98 struct pid *pid = pidfd_pid(file);
99 bool thread = file->f_flags & PIDFD_THREAD;
100 struct task_struct *task;
101 __poll_t poll_flags = 0;
102
103 poll_wait(file, &pid->wait_pidfd, pts);
104 /*
105 * Depending on PIDFD_THREAD, inform pollers when the thread
106 * or the whole thread-group exits.
107 */
108 guard(rcu)();
109 task = pid_task(pid, PIDTYPE_PID);
110 if (!task)
111 poll_flags = EPOLLIN | EPOLLRDNORM | EPOLLHUP;
112 else if (task->exit_state && (thread || thread_group_empty(task)))
113 poll_flags = EPOLLIN | EPOLLRDNORM;
114
115 return poll_flags;
116}
117
118static long pidfd_info(struct task_struct *task, unsigned int cmd, unsigned long arg)
119{
120 struct pidfd_info __user *uinfo = (struct pidfd_info __user *)arg;
121 size_t usize = _IOC_SIZE(cmd);
122 struct pidfd_info kinfo = {};
123 struct user_namespace *user_ns;
124 const struct cred *c;
125 __u64 mask;
126#ifdef CONFIG_CGROUPS
127 struct cgroup *cgrp;
128#endif
129
130 if (!uinfo)
131 return -EINVAL;
132 if (usize < PIDFD_INFO_SIZE_VER0)
133 return -EINVAL; /* First version, no smaller struct possible */
134
135 if (copy_from_user(&mask, &uinfo->mask, sizeof(mask)))
136 return -EFAULT;
137
138 c = get_task_cred(task);
139 if (!c)
140 return -ESRCH;
141
142 /* Unconditionally return identifiers and credentials, the rest only on request */
143
144 user_ns = current_user_ns();
145 kinfo.ruid = from_kuid_munged(user_ns, c->uid);
146 kinfo.rgid = from_kgid_munged(user_ns, c->gid);
147 kinfo.euid = from_kuid_munged(user_ns, c->euid);
148 kinfo.egid = from_kgid_munged(user_ns, c->egid);
149 kinfo.suid = from_kuid_munged(user_ns, c->suid);
150 kinfo.sgid = from_kgid_munged(user_ns, c->sgid);
151 kinfo.fsuid = from_kuid_munged(user_ns, c->fsuid);
152 kinfo.fsgid = from_kgid_munged(user_ns, c->fsgid);
153 kinfo.mask |= PIDFD_INFO_CREDS;
154 put_cred(c);
155
156#ifdef CONFIG_CGROUPS
157 rcu_read_lock();
158 cgrp = task_dfl_cgroup(task);
159 kinfo.cgroupid = cgroup_id(cgrp);
160 kinfo.mask |= PIDFD_INFO_CGROUPID;
161 rcu_read_unlock();
162#endif
163
164 /*
165 * Copy pid/tgid last, to reduce the chances the information might be
166 * stale. Note that it is not possible to ensure it will be valid as the
167 * task might return as soon as the copy_to_user finishes, but that's ok
168 * and userspace expects that might happen and can act accordingly, so
169 * this is just best-effort. What we can do however is checking that all
170 * the fields are set correctly, or return ESRCH to avoid providing
171 * incomplete information. */
172
173 kinfo.ppid = task_ppid_nr_ns(task, NULL);
174 kinfo.tgid = task_tgid_vnr(task);
175 kinfo.pid = task_pid_vnr(task);
176 kinfo.mask |= PIDFD_INFO_PID;
177
178 if (kinfo.pid == 0 || kinfo.tgid == 0 || (kinfo.ppid == 0 && kinfo.pid != 1))
179 return -ESRCH;
180
181 /*
182 * If userspace and the kernel have the same struct size it can just
183 * be copied. If userspace provides an older struct, only the bits that
184 * userspace knows about will be copied. If userspace provides a new
185 * struct, only the bits that the kernel knows about will be copied.
186 */
187 if (copy_to_user(uinfo, &kinfo, min(usize, sizeof(kinfo))))
188 return -EFAULT;
189
190 return 0;
191}
192
193static bool pidfs_ioctl_valid(unsigned int cmd)
194{
195 switch (cmd) {
196 case FS_IOC_GETVERSION:
197 case PIDFD_GET_CGROUP_NAMESPACE:
198 case PIDFD_GET_IPC_NAMESPACE:
199 case PIDFD_GET_MNT_NAMESPACE:
200 case PIDFD_GET_NET_NAMESPACE:
201 case PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE:
202 case PIDFD_GET_TIME_NAMESPACE:
203 case PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE:
204 case PIDFD_GET_UTS_NAMESPACE:
205 case PIDFD_GET_USER_NAMESPACE:
206 case PIDFD_GET_PID_NAMESPACE:
207 return true;
208 }
209
210 /* Extensible ioctls require some more careful checks. */
211 switch (_IOC_NR(cmd)) {
212 case _IOC_NR(PIDFD_GET_INFO):
213 /*
214 * Try to prevent performing a pidfd ioctl when someone
215 * erronously mistook the file descriptor for a pidfd.
216 * This is not perfect but will catch most cases.
217 */
218 return (_IOC_TYPE(cmd) == _IOC_TYPE(PIDFD_GET_INFO));
219 }
220
221 return false;
222}
223
224static long pidfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
225{
226 struct task_struct *task __free(put_task) = NULL;
227 struct nsproxy *nsp __free(put_nsproxy) = NULL;
228 struct pid *pid = pidfd_pid(file);
229 struct ns_common *ns_common = NULL;
230 struct pid_namespace *pid_ns;
231
232 if (!pidfs_ioctl_valid(cmd))
233 return -ENOIOCTLCMD;
234
235 task = get_pid_task(pid, PIDTYPE_PID);
236 if (!task)
237 return -ESRCH;
238
239 /* Extensible IOCTL that does not open namespace FDs, take a shortcut */
240 if (_IOC_NR(cmd) == _IOC_NR(PIDFD_GET_INFO))
241 return pidfd_info(task, cmd, arg);
242
243 if (arg)
244 return -EINVAL;
245
246 scoped_guard(task_lock, task) {
247 nsp = task->nsproxy;
248 if (nsp)
249 get_nsproxy(nsp);
250 }
251 if (!nsp)
252 return -ESRCH; /* just pretend it didn't exist */
253
254 /*
255 * We're trying to open a file descriptor to the namespace so perform a
256 * filesystem cred ptrace check. Also, we mirror nsfs behavior.
257 */
258 if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
259 return -EACCES;
260
261 switch (cmd) {
262 /* Namespaces that hang of nsproxy. */
263 case PIDFD_GET_CGROUP_NAMESPACE:
264 if (IS_ENABLED(CONFIG_CGROUPS)) {
265 get_cgroup_ns(nsp->cgroup_ns);
266 ns_common = to_ns_common(nsp->cgroup_ns);
267 }
268 break;
269 case PIDFD_GET_IPC_NAMESPACE:
270 if (IS_ENABLED(CONFIG_IPC_NS)) {
271 get_ipc_ns(nsp->ipc_ns);
272 ns_common = to_ns_common(nsp->ipc_ns);
273 }
274 break;
275 case PIDFD_GET_MNT_NAMESPACE:
276 get_mnt_ns(nsp->mnt_ns);
277 ns_common = to_ns_common(nsp->mnt_ns);
278 break;
279 case PIDFD_GET_NET_NAMESPACE:
280 if (IS_ENABLED(CONFIG_NET_NS)) {
281 ns_common = to_ns_common(nsp->net_ns);
282 get_net_ns(ns_common);
283 }
284 break;
285 case PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE:
286 if (IS_ENABLED(CONFIG_PID_NS)) {
287 get_pid_ns(nsp->pid_ns_for_children);
288 ns_common = to_ns_common(nsp->pid_ns_for_children);
289 }
290 break;
291 case PIDFD_GET_TIME_NAMESPACE:
292 if (IS_ENABLED(CONFIG_TIME_NS)) {
293 get_time_ns(nsp->time_ns);
294 ns_common = to_ns_common(nsp->time_ns);
295 }
296 break;
297 case PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE:
298 if (IS_ENABLED(CONFIG_TIME_NS)) {
299 get_time_ns(nsp->time_ns_for_children);
300 ns_common = to_ns_common(nsp->time_ns_for_children);
301 }
302 break;
303 case PIDFD_GET_UTS_NAMESPACE:
304 if (IS_ENABLED(CONFIG_UTS_NS)) {
305 get_uts_ns(nsp->uts_ns);
306 ns_common = to_ns_common(nsp->uts_ns);
307 }
308 break;
309 /* Namespaces that don't hang of nsproxy. */
310 case PIDFD_GET_USER_NAMESPACE:
311 if (IS_ENABLED(CONFIG_USER_NS)) {
312 rcu_read_lock();
313 ns_common = to_ns_common(get_user_ns(task_cred_xxx(task, user_ns)));
314 rcu_read_unlock();
315 }
316 break;
317 case PIDFD_GET_PID_NAMESPACE:
318 if (IS_ENABLED(CONFIG_PID_NS)) {
319 rcu_read_lock();
320 pid_ns = task_active_pid_ns(task);
321 if (pid_ns)
322 ns_common = to_ns_common(get_pid_ns(pid_ns));
323 rcu_read_unlock();
324 }
325 break;
326 default:
327 return -ENOIOCTLCMD;
328 }
329
330 if (!ns_common)
331 return -EOPNOTSUPP;
332
333 /* open_namespace() unconditionally consumes the reference */
334 return open_namespace(ns_common);
335}
336
337static const struct file_operations pidfs_file_operations = {
338 .poll = pidfd_poll,
339#ifdef CONFIG_PROC_FS
340 .show_fdinfo = pidfd_show_fdinfo,
341#endif
342 .unlocked_ioctl = pidfd_ioctl,
343 .compat_ioctl = compat_ptr_ioctl,
344};
345
346struct pid *pidfd_pid(const struct file *file)
347{
348 if (file->f_op != &pidfs_file_operations)
349 return ERR_PTR(-EBADF);
350 return file_inode(file)->i_private;
351}
352
353static struct vfsmount *pidfs_mnt __ro_after_init;
354
355#if BITS_PER_LONG == 32
356/*
357 * Provide a fallback mechanism for 32-bit systems so processes remain
358 * reliably comparable by inode number even on those systems.
359 */
360static DEFINE_IDA(pidfd_inum_ida);
361
362static int pidfs_inum(struct pid *pid, unsigned long *ino)
363{
364 int ret;
365
366 ret = ida_alloc_range(&pidfd_inum_ida, RESERVED_PIDS + 1,
367 UINT_MAX, GFP_ATOMIC);
368 if (ret < 0)
369 return -ENOSPC;
370
371 *ino = ret;
372 return 0;
373}
374
375static inline void pidfs_free_inum(unsigned long ino)
376{
377 if (ino > 0)
378 ida_free(&pidfd_inum_ida, ino);
379}
380#else
381static inline int pidfs_inum(struct pid *pid, unsigned long *ino)
382{
383 *ino = pid->ino;
384 return 0;
385}
386#define pidfs_free_inum(ino) ((void)(ino))
387#endif
388
389/*
390 * The vfs falls back to simple_setattr() if i_op->setattr() isn't
391 * implemented. Let's reject it completely until we have a clean
392 * permission concept for pidfds.
393 */
394static int pidfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
395 struct iattr *attr)
396{
397 return -EOPNOTSUPP;
398}
399
400
401/*
402 * User space expects pidfs inodes to have no file type in st_mode.
403 *
404 * In particular, 'lsof' has this legacy logic:
405 *
406 * type = s->st_mode & S_IFMT;
407 * switch (type) {
408 * ...
409 * case 0:
410 * if (!strcmp(p, "anon_inode"))
411 * Lf->ntype = Ntype = N_ANON_INODE;
412 *
413 * to detect our old anon_inode logic.
414 *
415 * Rather than mess with our internal sane inode data, just fix it
416 * up here in getattr() by masking off the format bits.
417 */
418static int pidfs_getattr(struct mnt_idmap *idmap, const struct path *path,
419 struct kstat *stat, u32 request_mask,
420 unsigned int query_flags)
421{
422 struct inode *inode = d_inode(path->dentry);
423
424 generic_fillattr(&nop_mnt_idmap, request_mask, inode, stat);
425 stat->mode &= ~S_IFMT;
426 return 0;
427}
428
429static const struct inode_operations pidfs_inode_operations = {
430 .getattr = pidfs_getattr,
431 .setattr = pidfs_setattr,
432};
433
434static void pidfs_evict_inode(struct inode *inode)
435{
436 struct pid *pid = inode->i_private;
437
438 clear_inode(inode);
439 put_pid(pid);
440 pidfs_free_inum(inode->i_ino);
441}
442
443static const struct super_operations pidfs_sops = {
444 .drop_inode = generic_delete_inode,
445 .evict_inode = pidfs_evict_inode,
446 .statfs = simple_statfs,
447};
448
449/*
450 * 'lsof' has knowledge of out historical anon_inode use, and expects
451 * the pidfs dentry name to start with 'anon_inode'.
452 */
453static char *pidfs_dname(struct dentry *dentry, char *buffer, int buflen)
454{
455 return dynamic_dname(buffer, buflen, "anon_inode:[pidfd]");
456}
457
458static const struct dentry_operations pidfs_dentry_operations = {
459 .d_delete = always_delete_dentry,
460 .d_dname = pidfs_dname,
461 .d_prune = stashed_dentry_prune,
462};
463
464static int pidfs_init_inode(struct inode *inode, void *data)
465{
466 inode->i_private = data;
467 inode->i_flags |= S_PRIVATE;
468 inode->i_mode |= S_IRWXU;
469 inode->i_op = &pidfs_inode_operations;
470 inode->i_fop = &pidfs_file_operations;
471 /*
472 * Inode numbering for pidfs start at RESERVED_PIDS + 1. This
473 * avoids collisions with the root inode which is 1 for pseudo
474 * filesystems.
475 */
476 return pidfs_inum(data, &inode->i_ino);
477}
478
479static void pidfs_put_data(void *data)
480{
481 struct pid *pid = data;
482 put_pid(pid);
483}
484
485static const struct stashed_operations pidfs_stashed_ops = {
486 .init_inode = pidfs_init_inode,
487 .put_data = pidfs_put_data,
488};
489
490static int pidfs_init_fs_context(struct fs_context *fc)
491{
492 struct pseudo_fs_context *ctx;
493
494 ctx = init_pseudo(fc, PID_FS_MAGIC);
495 if (!ctx)
496 return -ENOMEM;
497
498 ctx->ops = &pidfs_sops;
499 ctx->dops = &pidfs_dentry_operations;
500 fc->s_fs_info = (void *)&pidfs_stashed_ops;
501 return 0;
502}
503
504static struct file_system_type pidfs_type = {
505 .name = "pidfs",
506 .init_fs_context = pidfs_init_fs_context,
507 .kill_sb = kill_anon_super,
508};
509
510struct file *pidfs_alloc_file(struct pid *pid, unsigned int flags)
511{
512
513 struct file *pidfd_file;
514 struct path path;
515 int ret;
516
517 ret = path_from_stashed(&pid->stashed, pidfs_mnt, get_pid(pid), &path);
518 if (ret < 0)
519 return ERR_PTR(ret);
520
521 pidfd_file = dentry_open(&path, flags, current_cred());
522 path_put(&path);
523 return pidfd_file;
524}
525
526void __init pidfs_init(void)
527{
528 pidfs_mnt = kern_mount(&pidfs_type);
529 if (IS_ERR(pidfs_mnt))
530 panic("Failed to mount pidfs pseudo filesystem");
531}