1 // SPDX-License-Identifier: GPL-2.0-only 2 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 3 4 #include <linux/workqueue.h> 5 #include <linux/rtnetlink.h> 6 #include <linux/cache.h> 7 #include <linux/slab.h> 8 #include <linux/list.h> 9 #include <linux/delay.h> 10 #include <linux/sched.h> 11 #include <linux/idr.h> 12 #include <linux/rculist.h> 13 #include <linux/nsproxy.h> 14 #include <linux/fs.h> 15 #include <linux/proc_ns.h> 16 #include <linux/file.h> 17 #include <linux/export.h> 18 #include <linux/user_namespace.h> 19 #include <linux/net_namespace.h> 20 #include <linux/sched/task.h> 21 #include <linux/uidgid.h> 22 23 #include <net/sock.h> 24 #include <net/netlink.h> 25 #include <net/net_namespace.h> 26 #include <net/netns/generic.h> 27 28 /* 29 * Our network namespace constructor/destructor lists 30 */ 31 32 static LIST_HEAD(pernet_list); 33 static struct list_head *first_device = &pernet_list; 34 35 LIST_HEAD(net_namespace_list); 36 EXPORT_SYMBOL_GPL(net_namespace_list); 37 38 /* Protects net_namespace_list. Nests iside rtnl_lock() */ 39 DECLARE_RWSEM(net_rwsem); 40 EXPORT_SYMBOL_GPL(net_rwsem); 41 42 #ifdef CONFIG_KEYS 43 static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) }; 44 #endif 45 46 struct net init_net = { 47 .count = REFCOUNT_INIT(1), 48 .dev_base_head = LIST_HEAD_INIT(init_net.dev_base_head), 49 #ifdef CONFIG_KEYS 50 .key_domain = &init_net_key_domain, 51 #endif 52 }; 53 EXPORT_SYMBOL(init_net); 54 55 static bool init_net_initialized; 56 /* 57 * pernet_ops_rwsem: protects: pernet_list, net_generic_ids, 58 * init_net_initialized and first_device pointer. 59 * This is internal net namespace object. Please, don't use it 60 * outside. 61 */ 62 DECLARE_RWSEM(pernet_ops_rwsem); 63 EXPORT_SYMBOL_GPL(pernet_ops_rwsem); 64 65 #define MIN_PERNET_OPS_ID \ 66 ((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *)) 67 68 #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */ 69 70 static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS; 71 72 static struct net_generic *net_alloc_generic(void) 73 { 74 struct net_generic *ng; 75 unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]); 76 77 ng = kzalloc(generic_size, GFP_KERNEL); 78 if (ng) 79 ng->s.len = max_gen_ptrs; 80 81 return ng; 82 } 83 84 static int net_assign_generic(struct net *net, unsigned int id, void *data) 85 { 86 struct net_generic *ng, *old_ng; 87 88 BUG_ON(id < MIN_PERNET_OPS_ID); 89 90 old_ng = rcu_dereference_protected(net->gen, 91 lockdep_is_held(&pernet_ops_rwsem)); 92 if (old_ng->s.len > id) { 93 old_ng->ptr[id] = data; 94 return 0; 95 } 96 97 ng = net_alloc_generic(); 98 if (ng == NULL) 99 return -ENOMEM; 100 101 /* 102 * Some synchronisation notes: 103 * 104 * The net_generic explores the net->gen array inside rcu 105 * read section. Besides once set the net->gen->ptr[x] 106 * pointer never changes (see rules in netns/generic.h). 107 * 108 * That said, we simply duplicate this array and schedule 109 * the old copy for kfree after a grace period. 110 */ 111 112 memcpy(&ng->ptr[MIN_PERNET_OPS_ID], &old_ng->ptr[MIN_PERNET_OPS_ID], 113 (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *)); 114 ng->ptr[id] = data; 115 116 rcu_assign_pointer(net->gen, ng); 117 kfree_rcu(old_ng, s.rcu); 118 return 0; 119 } 120 121 static int ops_init(const struct pernet_operations *ops, struct net *net) 122 { 123 int err = -ENOMEM; 124 void *data = NULL; 125 126 if (ops->id && ops->size) { 127 data = kzalloc(ops->size, GFP_KERNEL); 128 if (!data) 129 goto out; 130 131 err = net_assign_generic(net, *ops->id, data); 132 if (err) 133 goto cleanup; 134 } 135 err = 0; 136 if (ops->init) 137 err = ops->init(net); 138 if (!err) 139 return 0; 140 141 cleanup: 142 kfree(data); 143 144 out: 145 return err; 146 } 147 148 static void ops_free(const struct pernet_operations *ops, struct net *net) 149 { 150 if (ops->id && ops->size) { 151 kfree(net_generic(net, *ops->id)); 152 } 153 } 154 155 static void ops_exit_list(const struct pernet_operations *ops, 156 struct list_head *net_exit_list) 157 { 158 struct net *net; 159 if (ops->exit) { 160 list_for_each_entry(net, net_exit_list, exit_list) 161 ops->exit(net); 162 } 163 if (ops->exit_batch) 164 ops->exit_batch(net_exit_list); 165 } 166 167 static void ops_free_list(const struct pernet_operations *ops, 168 struct list_head *net_exit_list) 169 { 170 struct net *net; 171 if (ops->size && ops->id) { 172 list_for_each_entry(net, net_exit_list, exit_list) 173 ops_free(ops, net); 174 } 175 } 176 177 /* should be called with nsid_lock held */ 178 static int alloc_netid(struct net *net, struct net *peer, int reqid) 179 { 180 int min = 0, max = 0; 181 182 if (reqid >= 0) { 183 min = reqid; 184 max = reqid + 1; 185 } 186 187 return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC); 188 } 189 190 /* This function is used by idr_for_each(). If net is equal to peer, the 191 * function returns the id so that idr_for_each() stops. Because we cannot 192 * returns the id 0 (idr_for_each() will not stop), we return the magic value 193 * NET_ID_ZERO (-1) for it. 194 */ 195 #define NET_ID_ZERO -1 196 static int net_eq_idr(int id, void *net, void *peer) 197 { 198 if (net_eq(net, peer)) 199 return id ? : NET_ID_ZERO; 200 return 0; 201 } 202 203 /* Should be called with nsid_lock held. If a new id is assigned, the bool alloc 204 * is set to true, thus the caller knows that the new id must be notified via 205 * rtnl. 206 */ 207 static int __peernet2id_alloc(struct net *net, struct net *peer, bool *alloc) 208 { 209 int id = idr_for_each(&net->netns_ids, net_eq_idr, peer); 210 bool alloc_it = *alloc; 211 212 *alloc = false; 213 214 /* Magic value for id 0. */ 215 if (id == NET_ID_ZERO) 216 return 0; 217 if (id > 0) 218 return id; 219 220 if (alloc_it) { 221 id = alloc_netid(net, peer, -1); 222 *alloc = true; 223 return id >= 0 ? id : NETNSA_NSID_NOT_ASSIGNED; 224 } 225 226 return NETNSA_NSID_NOT_ASSIGNED; 227 } 228 229 /* should be called with nsid_lock held */ 230 static int __peernet2id(struct net *net, struct net *peer) 231 { 232 bool no = false; 233 234 return __peernet2id_alloc(net, peer, &no); 235 } 236 237 static void rtnl_net_notifyid(struct net *net, int cmd, int id); 238 /* This function returns the id of a peer netns. If no id is assigned, one will 239 * be allocated and returned. 240 */ 241 int peernet2id_alloc(struct net *net, struct net *peer) 242 { 243 bool alloc = false, alive = false; 244 int id; 245 246 if (refcount_read(&net->count) == 0) 247 return NETNSA_NSID_NOT_ASSIGNED; 248 spin_lock_bh(&net->nsid_lock); 249 /* 250 * When peer is obtained from RCU lists, we may race with 251 * its cleanup. Check whether it's alive, and this guarantees 252 * we never hash a peer back to net->netns_ids, after it has 253 * just been idr_remove()'d from there in cleanup_net(). 254 */ 255 if (maybe_get_net(peer)) 256 alive = alloc = true; 257 id = __peernet2id_alloc(net, peer, &alloc); 258 spin_unlock_bh(&net->nsid_lock); 259 if (alloc && id >= 0) 260 rtnl_net_notifyid(net, RTM_NEWNSID, id); 261 if (alive) 262 put_net(peer); 263 return id; 264 } 265 EXPORT_SYMBOL_GPL(peernet2id_alloc); 266 267 /* This function returns, if assigned, the id of a peer netns. */ 268 int peernet2id(struct net *net, struct net *peer) 269 { 270 int id; 271 272 spin_lock_bh(&net->nsid_lock); 273 id = __peernet2id(net, peer); 274 spin_unlock_bh(&net->nsid_lock); 275 return id; 276 } 277 EXPORT_SYMBOL(peernet2id); 278 279 /* This function returns true is the peer netns has an id assigned into the 280 * current netns. 281 */ 282 bool peernet_has_id(struct net *net, struct net *peer) 283 { 284 return peernet2id(net, peer) >= 0; 285 } 286 287 struct net *get_net_ns_by_id(struct net *net, int id) 288 { 289 struct net *peer; 290 291 if (id < 0) 292 return NULL; 293 294 rcu_read_lock(); 295 peer = idr_find(&net->netns_ids, id); 296 if (peer) 297 peer = maybe_get_net(peer); 298 rcu_read_unlock(); 299 300 return peer; 301 } 302 303 /* 304 * setup_net runs the initializers for the network namespace object. 305 */ 306 static __net_init int setup_net(struct net *net, struct user_namespace *user_ns) 307 { 308 /* Must be called with pernet_ops_rwsem held */ 309 const struct pernet_operations *ops, *saved_ops; 310 int error = 0; 311 LIST_HEAD(net_exit_list); 312 313 refcount_set(&net->count, 1); 314 refcount_set(&net->passive, 1); 315 get_random_bytes(&net->hash_mix, sizeof(u32)); 316 net->dev_base_seq = 1; 317 net->user_ns = user_ns; 318 idr_init(&net->netns_ids); 319 spin_lock_init(&net->nsid_lock); 320 mutex_init(&net->ipv4.ra_mutex); 321 322 list_for_each_entry(ops, &pernet_list, list) { 323 error = ops_init(ops, net); 324 if (error < 0) 325 goto out_undo; 326 } 327 down_write(&net_rwsem); 328 list_add_tail_rcu(&net->list, &net_namespace_list); 329 up_write(&net_rwsem); 330 out: 331 return error; 332 333 out_undo: 334 /* Walk through the list backwards calling the exit functions 335 * for the pernet modules whose init functions did not fail. 336 */ 337 list_add(&net->exit_list, &net_exit_list); 338 saved_ops = ops; 339 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 340 ops_exit_list(ops, &net_exit_list); 341 342 ops = saved_ops; 343 list_for_each_entry_continue_reverse(ops, &pernet_list, list) 344 ops_free_list(ops, &net_exit_list); 345 346 rcu_barrier(); 347 goto out; 348 } 349 350 static int __net_init net_defaults_init_net(struct net *net) 351 { 352 net->core.sysctl_somaxconn = SOMAXCONN; 353 return 0; 354 } 355 356 static struct pernet_operations net_defaults_ops = { 357 .init = net_defaults_init_net, 358 }; 359 360 static __init int net_defaults_init(void) 361 { 362 if (register_pernet_subsys(&net_defaults_ops)) 363 panic("Cannot initialize net default settings"); 364 365 return 0; 366 } 367 368 core_initcall(net_defaults_init); 369 370 #ifdef CONFIG_NET_NS 371 static struct ucounts *inc_net_namespaces(struct user_namespace *ns) 372 { 373 return inc_ucount(ns, current_euid(), UCOUNT_NET_NAMESPACES); 374 } 375 376 static void dec_net_namespaces(struct ucounts *ucounts) 377 { 378 dec_ucount(ucounts, UCOUNT_NET_NAMESPACES); 379 } 380 381 static struct kmem_cache *net_cachep __ro_after_init; 382 static struct workqueue_struct *netns_wq; 383 384 static struct net *net_alloc(void) 385 { 386 struct net *net = NULL; 387 struct net_generic *ng; 388 389 ng = net_alloc_generic(); 390 if (!ng) 391 goto out; 392 393 net = kmem_cache_zalloc(net_cachep, GFP_KERNEL); 394 if (!net) 395 goto out_free; 396 397 #ifdef CONFIG_KEYS 398 net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL); 399 if (!net->key_domain) 400 goto out_free_2; 401 refcount_set(&net->key_domain->usage, 1); 402 #endif 403 404 rcu_assign_pointer(net->gen, ng); 405 out: 406 return net; 407 408 #ifdef CONFIG_KEYS 409 out_free_2: 410 kmem_cache_free(net_cachep, net); 411 net = NULL; 412 #endif 413 out_free: 414 kfree(ng); 415 goto out; 416 } 417 418 static void net_free(struct net *net) 419 { 420 kfree(rcu_access_pointer(net->gen)); 421 kmem_cache_free(net_cachep, net); 422 } 423 424 void net_drop_ns(void *p) 425 { 426 struct net *ns = p; 427 if (ns && refcount_dec_and_test(&ns->passive)) 428 net_free(ns); 429 } 430 431 struct net *copy_net_ns(unsigned long flags, 432 struct user_namespace *user_ns, struct net *old_net) 433 { 434 struct ucounts *ucounts; 435 struct net *net; 436 int rv; 437 438 if (!(flags & CLONE_NEWNET)) 439 return get_net(old_net); 440 441 ucounts = inc_net_namespaces(user_ns); 442 if (!ucounts) 443 return ERR_PTR(-ENOSPC); 444 445 net = net_alloc(); 446 if (!net) { 447 rv = -ENOMEM; 448 goto dec_ucounts; 449 } 450 refcount_set(&net->passive, 1); 451 net->ucounts = ucounts; 452 get_user_ns(user_ns); 453 454 rv = down_read_killable(&pernet_ops_rwsem); 455 if (rv < 0) 456 goto put_userns; 457 458 rv = setup_net(net, user_ns); 459 460 up_read(&pernet_ops_rwsem); 461 462 if (rv < 0) { 463 put_userns: 464 put_user_ns(user_ns); 465 net_drop_ns(net); 466 dec_ucounts: 467 dec_net_namespaces(ucounts); 468 return ERR_PTR(rv); 469 } 470 return net; 471 } 472 473 /** 474 * net_ns_get_ownership - get sysfs ownership data for @net 475 * @net: network namespace in question (can be NULL) 476 * @uid: kernel user ID for sysfs objects 477 * @gid: kernel group ID for sysfs objects 478 * 479 * Returns the uid/gid pair of root in the user namespace associated with the 480 * given network namespace. 481 */ 482 void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid) 483 { 484 if (net) { 485 kuid_t ns_root_uid = make_kuid(net->user_ns, 0); 486 kgid_t ns_root_gid = make_kgid(net->user_ns, 0); 487 488 if (uid_valid(ns_root_uid)) 489 *uid = ns_root_uid; 490 491 if (gid_valid(ns_root_gid)) 492 *gid = ns_root_gid; 493 } else { 494 *uid = GLOBAL_ROOT_UID; 495 *gid = GLOBAL_ROOT_GID; 496 } 497 } 498 EXPORT_SYMBOL_GPL(net_ns_get_ownership); 499 500 static void unhash_nsid(struct net *net, struct net *last) 501 { 502 struct net *tmp; 503 /* This function is only called from cleanup_net() work, 504 * and this work is the only process, that may delete 505 * a net from net_namespace_list. So, when the below 506 * is executing, the list may only grow. Thus, we do not 507 * use for_each_net_rcu() or net_rwsem. 508 */ 509 for_each_net(tmp) { 510 int id; 511 512 spin_lock_bh(&tmp->nsid_lock); 513 id = __peernet2id(tmp, net); 514 if (id >= 0) 515 idr_remove(&tmp->netns_ids, id); 516 spin_unlock_bh(&tmp->nsid_lock); 517 if (id >= 0) 518 rtnl_net_notifyid(tmp, RTM_DELNSID, id); 519 if (tmp == last) 520 break; 521 } 522 spin_lock_bh(&net->nsid_lock); 523 idr_destroy(&net->netns_ids); 524 spin_unlock_bh(&net->nsid_lock); 525 } 526 527 static LLIST_HEAD(cleanup_list); 528 529 static void cleanup_net(struct work_struct *work) 530 { 531 const struct pernet_operations *ops; 532 struct net *net, *tmp, *last; 533 struct llist_node *net_kill_list; 534 LIST_HEAD(net_exit_list); 535 536 /* Atomically snapshot the list of namespaces to cleanup */ 537 net_kill_list = llist_del_all(&cleanup_list); 538 539 down_read(&pernet_ops_rwsem); 540 541 /* Don't let anyone else find us. */ 542 down_write(&net_rwsem); 543 llist_for_each_entry(net, net_kill_list, cleanup_list) 544 list_del_rcu(&net->list); 545 /* Cache last net. After we unlock rtnl, no one new net 546 * added to net_namespace_list can assign nsid pointer 547 * to a net from net_kill_list (see peernet2id_alloc()). 548 * So, we skip them in unhash_nsid(). 549 * 550 * Note, that unhash_nsid() does not delete nsid links 551 * between net_kill_list's nets, as they've already 552 * deleted from net_namespace_list. But, this would be 553 * useless anyway, as netns_ids are destroyed there. 554 */ 555 last = list_last_entry(&net_namespace_list, struct net, list); 556 up_write(&net_rwsem); 557 558 llist_for_each_entry(net, net_kill_list, cleanup_list) { 559 unhash_nsid(net, last); 560 list_add_tail(&net->exit_list, &net_exit_list); 561 } 562 563 /* 564 * Another CPU might be rcu-iterating the list, wait for it. 565 * This needs to be before calling the exit() notifiers, so 566 * the rcu_barrier() below isn't sufficient alone. 567 */ 568 synchronize_rcu(); 569 570 /* Run all of the network namespace exit methods */ 571 list_for_each_entry_reverse(ops, &pernet_list, list) 572 ops_exit_list(ops, &net_exit_list); 573 574 /* Free the net generic variables */ 575 list_for_each_entry_reverse(ops, &pernet_list, list) 576 ops_free_list(ops, &net_exit_list); 577 578 up_read(&pernet_ops_rwsem); 579 580 /* Ensure there are no outstanding rcu callbacks using this 581 * network namespace. 582 */ 583 rcu_barrier(); 584 585 /* Finally it is safe to free my network namespace structure */ 586 list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) { 587 list_del_init(&net->exit_list); 588 dec_net_namespaces(net->ucounts); 589 key_remove_domain(net->key_domain); 590 put_user_ns(net->user_ns); 591 net_drop_ns(net); 592 } 593 } 594 595 /** 596 * net_ns_barrier - wait until concurrent net_cleanup_work is done 597 * 598 * cleanup_net runs from work queue and will first remove namespaces 599 * from the global list, then run net exit functions. 600 * 601 * Call this in module exit path to make sure that all netns 602 * ->exit ops have been invoked before the function is removed. 603 */ 604 void net_ns_barrier(void) 605 { 606 down_write(&pernet_ops_rwsem); 607 up_write(&pernet_ops_rwsem); 608 } 609 EXPORT_SYMBOL(net_ns_barrier); 610 611 static DECLARE_WORK(net_cleanup_work, cleanup_net); 612 613 void __put_net(struct net *net) 614 { 615 /* Cleanup the network namespace in process context */ 616 if (llist_add(&net->cleanup_list, &cleanup_list)) 617 queue_work(netns_wq, &net_cleanup_work); 618 } 619 EXPORT_SYMBOL_GPL(__put_net); 620 621 struct net *get_net_ns_by_fd(int fd) 622 { 623 struct file *file; 624 struct ns_common *ns; 625 struct net *net; 626 627 file = proc_ns_fget(fd); 628 if (IS_ERR(file)) 629 return ERR_CAST(file); 630 631 ns = get_proc_ns(file_inode(file)); 632 if (ns->ops == &netns_operations) 633 net = get_net(container_of(ns, struct net, ns)); 634 else 635 net = ERR_PTR(-EINVAL); 636 637 fput(file); 638 return net; 639 } 640 641 #else 642 struct net *get_net_ns_by_fd(int fd) 643 { 644 return ERR_PTR(-EINVAL); 645 } 646 #endif 647 EXPORT_SYMBOL_GPL(get_net_ns_by_fd); 648 649 struct net *get_net_ns_by_pid(pid_t pid) 650 { 651 struct task_struct *tsk; 652 struct net *net; 653 654 /* Lookup the network namespace */ 655 net = ERR_PTR(-ESRCH); 656 rcu_read_lock(); 657 tsk = find_task_by_vpid(pid); 658 if (tsk) { 659 struct nsproxy *nsproxy; 660 task_lock(tsk); 661 nsproxy = tsk->nsproxy; 662 if (nsproxy) 663 net = get_net(nsproxy->net_ns); 664 task_unlock(tsk); 665 } 666 rcu_read_unlock(); 667 return net; 668 } 669 EXPORT_SYMBOL_GPL(get_net_ns_by_pid); 670 671 static __net_init int net_ns_net_init(struct net *net) 672 { 673 #ifdef CONFIG_NET_NS 674 net->ns.ops = &netns_operations; 675 #endif 676 return ns_alloc_inum(&net->ns); 677 } 678 679 static __net_exit void net_ns_net_exit(struct net *net) 680 { 681 ns_free_inum(&net->ns); 682 } 683 684 static struct pernet_operations __net_initdata net_ns_ops = { 685 .init = net_ns_net_init, 686 .exit = net_ns_net_exit, 687 }; 688 689 static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = { 690 [NETNSA_NONE] = { .type = NLA_UNSPEC }, 691 [NETNSA_NSID] = { .type = NLA_S32 }, 692 [NETNSA_PID] = { .type = NLA_U32 }, 693 [NETNSA_FD] = { .type = NLA_U32 }, 694 [NETNSA_TARGET_NSID] = { .type = NLA_S32 }, 695 }; 696 697 static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh, 698 struct netlink_ext_ack *extack) 699 { 700 struct net *net = sock_net(skb->sk); 701 struct nlattr *tb[NETNSA_MAX + 1]; 702 struct nlattr *nla; 703 struct net *peer; 704 int nsid, err; 705 706 err = nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), tb, 707 NETNSA_MAX, rtnl_net_policy, extack); 708 if (err < 0) 709 return err; 710 if (!tb[NETNSA_NSID]) { 711 NL_SET_ERR_MSG(extack, "nsid is missing"); 712 return -EINVAL; 713 } 714 nsid = nla_get_s32(tb[NETNSA_NSID]); 715 716 if (tb[NETNSA_PID]) { 717 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID])); 718 nla = tb[NETNSA_PID]; 719 } else if (tb[NETNSA_FD]) { 720 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD])); 721 nla = tb[NETNSA_FD]; 722 } else { 723 NL_SET_ERR_MSG(extack, "Peer netns reference is missing"); 724 return -EINVAL; 725 } 726 if (IS_ERR(peer)) { 727 NL_SET_BAD_ATTR(extack, nla); 728 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid"); 729 return PTR_ERR(peer); 730 } 731 732 spin_lock_bh(&net->nsid_lock); 733 if (__peernet2id(net, peer) >= 0) { 734 spin_unlock_bh(&net->nsid_lock); 735 err = -EEXIST; 736 NL_SET_BAD_ATTR(extack, nla); 737 NL_SET_ERR_MSG(extack, 738 "Peer netns already has a nsid assigned"); 739 goto out; 740 } 741 742 err = alloc_netid(net, peer, nsid); 743 spin_unlock_bh(&net->nsid_lock); 744 if (err >= 0) { 745 rtnl_net_notifyid(net, RTM_NEWNSID, err); 746 err = 0; 747 } else if (err == -ENOSPC && nsid >= 0) { 748 err = -EEXIST; 749 NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]); 750 NL_SET_ERR_MSG(extack, "The specified nsid is already used"); 751 } 752 out: 753 put_net(peer); 754 return err; 755 } 756 757 static int rtnl_net_get_size(void) 758 { 759 return NLMSG_ALIGN(sizeof(struct rtgenmsg)) 760 + nla_total_size(sizeof(s32)) /* NETNSA_NSID */ 761 + nla_total_size(sizeof(s32)) /* NETNSA_CURRENT_NSID */ 762 ; 763 } 764 765 struct net_fill_args { 766 u32 portid; 767 u32 seq; 768 int flags; 769 int cmd; 770 int nsid; 771 bool add_ref; 772 int ref_nsid; 773 }; 774 775 static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args) 776 { 777 struct nlmsghdr *nlh; 778 struct rtgenmsg *rth; 779 780 nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth), 781 args->flags); 782 if (!nlh) 783 return -EMSGSIZE; 784 785 rth = nlmsg_data(nlh); 786 rth->rtgen_family = AF_UNSPEC; 787 788 if (nla_put_s32(skb, NETNSA_NSID, args->nsid)) 789 goto nla_put_failure; 790 791 if (args->add_ref && 792 nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid)) 793 goto nla_put_failure; 794 795 nlmsg_end(skb, nlh); 796 return 0; 797 798 nla_put_failure: 799 nlmsg_cancel(skb, nlh); 800 return -EMSGSIZE; 801 } 802 803 static int rtnl_net_valid_getid_req(struct sk_buff *skb, 804 const struct nlmsghdr *nlh, 805 struct nlattr **tb, 806 struct netlink_ext_ack *extack) 807 { 808 int i, err; 809 810 if (!netlink_strict_get_check(skb)) 811 return nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), 812 tb, NETNSA_MAX, rtnl_net_policy, 813 extack); 814 815 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb, 816 NETNSA_MAX, rtnl_net_policy, 817 extack); 818 if (err) 819 return err; 820 821 for (i = 0; i <= NETNSA_MAX; i++) { 822 if (!tb[i]) 823 continue; 824 825 switch (i) { 826 case NETNSA_PID: 827 case NETNSA_FD: 828 case NETNSA_NSID: 829 case NETNSA_TARGET_NSID: 830 break; 831 default: 832 NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request"); 833 return -EINVAL; 834 } 835 } 836 837 return 0; 838 } 839 840 static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh, 841 struct netlink_ext_ack *extack) 842 { 843 struct net *net = sock_net(skb->sk); 844 struct nlattr *tb[NETNSA_MAX + 1]; 845 struct net_fill_args fillargs = { 846 .portid = NETLINK_CB(skb).portid, 847 .seq = nlh->nlmsg_seq, 848 .cmd = RTM_NEWNSID, 849 }; 850 struct net *peer, *target = net; 851 struct nlattr *nla; 852 struct sk_buff *msg; 853 int err; 854 855 err = rtnl_net_valid_getid_req(skb, nlh, tb, extack); 856 if (err < 0) 857 return err; 858 if (tb[NETNSA_PID]) { 859 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID])); 860 nla = tb[NETNSA_PID]; 861 } else if (tb[NETNSA_FD]) { 862 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD])); 863 nla = tb[NETNSA_FD]; 864 } else if (tb[NETNSA_NSID]) { 865 peer = get_net_ns_by_id(net, nla_get_s32(tb[NETNSA_NSID])); 866 if (!peer) 867 peer = ERR_PTR(-ENOENT); 868 nla = tb[NETNSA_NSID]; 869 } else { 870 NL_SET_ERR_MSG(extack, "Peer netns reference is missing"); 871 return -EINVAL; 872 } 873 874 if (IS_ERR(peer)) { 875 NL_SET_BAD_ATTR(extack, nla); 876 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid"); 877 return PTR_ERR(peer); 878 } 879 880 if (tb[NETNSA_TARGET_NSID]) { 881 int id = nla_get_s32(tb[NETNSA_TARGET_NSID]); 882 883 target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id); 884 if (IS_ERR(target)) { 885 NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]); 886 NL_SET_ERR_MSG(extack, 887 "Target netns reference is invalid"); 888 err = PTR_ERR(target); 889 goto out; 890 } 891 fillargs.add_ref = true; 892 fillargs.ref_nsid = peernet2id(net, peer); 893 } 894 895 msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL); 896 if (!msg) { 897 err = -ENOMEM; 898 goto out; 899 } 900 901 fillargs.nsid = peernet2id(target, peer); 902 err = rtnl_net_fill(msg, &fillargs); 903 if (err < 0) 904 goto err_out; 905 906 err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid); 907 goto out; 908 909 err_out: 910 nlmsg_free(msg); 911 out: 912 if (fillargs.add_ref) 913 put_net(target); 914 put_net(peer); 915 return err; 916 } 917 918 struct rtnl_net_dump_cb { 919 struct net *tgt_net; 920 struct net *ref_net; 921 struct sk_buff *skb; 922 struct net_fill_args fillargs; 923 int idx; 924 int s_idx; 925 }; 926 927 static int rtnl_net_dumpid_one(int id, void *peer, void *data) 928 { 929 struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data; 930 int ret; 931 932 if (net_cb->idx < net_cb->s_idx) 933 goto cont; 934 935 net_cb->fillargs.nsid = id; 936 if (net_cb->fillargs.add_ref) 937 net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer); 938 ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs); 939 if (ret < 0) 940 return ret; 941 942 cont: 943 net_cb->idx++; 944 return 0; 945 } 946 947 static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk, 948 struct rtnl_net_dump_cb *net_cb, 949 struct netlink_callback *cb) 950 { 951 struct netlink_ext_ack *extack = cb->extack; 952 struct nlattr *tb[NETNSA_MAX + 1]; 953 int err, i; 954 955 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb, 956 NETNSA_MAX, rtnl_net_policy, 957 extack); 958 if (err < 0) 959 return err; 960 961 for (i = 0; i <= NETNSA_MAX; i++) { 962 if (!tb[i]) 963 continue; 964 965 if (i == NETNSA_TARGET_NSID) { 966 struct net *net; 967 968 net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i])); 969 if (IS_ERR(net)) { 970 NL_SET_BAD_ATTR(extack, tb[i]); 971 NL_SET_ERR_MSG(extack, 972 "Invalid target network namespace id"); 973 return PTR_ERR(net); 974 } 975 net_cb->fillargs.add_ref = true; 976 net_cb->ref_net = net_cb->tgt_net; 977 net_cb->tgt_net = net; 978 } else { 979 NL_SET_BAD_ATTR(extack, tb[i]); 980 NL_SET_ERR_MSG(extack, 981 "Unsupported attribute in dump request"); 982 return -EINVAL; 983 } 984 } 985 986 return 0; 987 } 988 989 static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb) 990 { 991 struct rtnl_net_dump_cb net_cb = { 992 .tgt_net = sock_net(skb->sk), 993 .skb = skb, 994 .fillargs = { 995 .portid = NETLINK_CB(cb->skb).portid, 996 .seq = cb->nlh->nlmsg_seq, 997 .flags = NLM_F_MULTI, 998 .cmd = RTM_NEWNSID, 999 }, 1000 .idx = 0, 1001 .s_idx = cb->args[0], 1002 }; 1003 int err = 0; 1004 1005 if (cb->strict_check) { 1006 err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb); 1007 if (err < 0) 1008 goto end; 1009 } 1010 1011 spin_lock_bh(&net_cb.tgt_net->nsid_lock); 1012 if (net_cb.fillargs.add_ref && 1013 !net_eq(net_cb.ref_net, net_cb.tgt_net) && 1014 !spin_trylock_bh(&net_cb.ref_net->nsid_lock)) { 1015 spin_unlock_bh(&net_cb.tgt_net->nsid_lock); 1016 err = -EAGAIN; 1017 goto end; 1018 } 1019 idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb); 1020 if (net_cb.fillargs.add_ref && 1021 !net_eq(net_cb.ref_net, net_cb.tgt_net)) 1022 spin_unlock_bh(&net_cb.ref_net->nsid_lock); 1023 spin_unlock_bh(&net_cb.tgt_net->nsid_lock); 1024 1025 cb->args[0] = net_cb.idx; 1026 end: 1027 if (net_cb.fillargs.add_ref) 1028 put_net(net_cb.tgt_net); 1029 return err < 0 ? err : skb->len; 1030 } 1031 1032 static void rtnl_net_notifyid(struct net *net, int cmd, int id) 1033 { 1034 struct net_fill_args fillargs = { 1035 .cmd = cmd, 1036 .nsid = id, 1037 }; 1038 struct sk_buff *msg; 1039 int err = -ENOMEM; 1040 1041 msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL); 1042 if (!msg) 1043 goto out; 1044 1045 err = rtnl_net_fill(msg, &fillargs); 1046 if (err < 0) 1047 goto err_out; 1048 1049 rtnl_notify(msg, net, 0, RTNLGRP_NSID, NULL, 0); 1050 return; 1051 1052 err_out: 1053 nlmsg_free(msg); 1054 out: 1055 rtnl_set_sk_err(net, RTNLGRP_NSID, err); 1056 } 1057 1058 static int __init net_ns_init(void) 1059 { 1060 struct net_generic *ng; 1061 1062 #ifdef CONFIG_NET_NS 1063 net_cachep = kmem_cache_create("net_namespace", sizeof(struct net), 1064 SMP_CACHE_BYTES, 1065 SLAB_PANIC|SLAB_ACCOUNT, NULL); 1066 1067 /* Create workqueue for cleanup */ 1068 netns_wq = create_singlethread_workqueue("netns"); 1069 if (!netns_wq) 1070 panic("Could not create netns workq"); 1071 #endif 1072 1073 ng = net_alloc_generic(); 1074 if (!ng) 1075 panic("Could not allocate generic netns"); 1076 1077 rcu_assign_pointer(init_net.gen, ng); 1078 1079 down_write(&pernet_ops_rwsem); 1080 if (setup_net(&init_net, &init_user_ns)) 1081 panic("Could not setup the initial network namespace"); 1082 1083 init_net_initialized = true; 1084 up_write(&pernet_ops_rwsem); 1085 1086 if (register_pernet_subsys(&net_ns_ops)) 1087 panic("Could not register network namespace subsystems"); 1088 1089 rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL, 1090 RTNL_FLAG_DOIT_UNLOCKED); 1091 rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid, 1092 RTNL_FLAG_DOIT_UNLOCKED); 1093 1094 return 0; 1095 } 1096 1097 pure_initcall(net_ns_init); 1098 1099 #ifdef CONFIG_NET_NS 1100 static int __register_pernet_operations(struct list_head *list, 1101 struct pernet_operations *ops) 1102 { 1103 struct net *net; 1104 int error; 1105 LIST_HEAD(net_exit_list); 1106 1107 list_add_tail(&ops->list, list); 1108 if (ops->init || (ops->id && ops->size)) { 1109 /* We held write locked pernet_ops_rwsem, and parallel 1110 * setup_net() and cleanup_net() are not possible. 1111 */ 1112 for_each_net(net) { 1113 error = ops_init(ops, net); 1114 if (error) 1115 goto out_undo; 1116 list_add_tail(&net->exit_list, &net_exit_list); 1117 } 1118 } 1119 return 0; 1120 1121 out_undo: 1122 /* If I have an error cleanup all namespaces I initialized */ 1123 list_del(&ops->list); 1124 ops_exit_list(ops, &net_exit_list); 1125 ops_free_list(ops, &net_exit_list); 1126 return error; 1127 } 1128 1129 static void __unregister_pernet_operations(struct pernet_operations *ops) 1130 { 1131 struct net *net; 1132 LIST_HEAD(net_exit_list); 1133 1134 list_del(&ops->list); 1135 /* See comment in __register_pernet_operations() */ 1136 for_each_net(net) 1137 list_add_tail(&net->exit_list, &net_exit_list); 1138 ops_exit_list(ops, &net_exit_list); 1139 ops_free_list(ops, &net_exit_list); 1140 } 1141 1142 #else 1143 1144 static int __register_pernet_operations(struct list_head *list, 1145 struct pernet_operations *ops) 1146 { 1147 if (!init_net_initialized) { 1148 list_add_tail(&ops->list, list); 1149 return 0; 1150 } 1151 1152 return ops_init(ops, &init_net); 1153 } 1154 1155 static void __unregister_pernet_operations(struct pernet_operations *ops) 1156 { 1157 if (!init_net_initialized) { 1158 list_del(&ops->list); 1159 } else { 1160 LIST_HEAD(net_exit_list); 1161 list_add(&init_net.exit_list, &net_exit_list); 1162 ops_exit_list(ops, &net_exit_list); 1163 ops_free_list(ops, &net_exit_list); 1164 } 1165 } 1166 1167 #endif /* CONFIG_NET_NS */ 1168 1169 static DEFINE_IDA(net_generic_ids); 1170 1171 static int register_pernet_operations(struct list_head *list, 1172 struct pernet_operations *ops) 1173 { 1174 int error; 1175 1176 if (ops->id) { 1177 error = ida_alloc_min(&net_generic_ids, MIN_PERNET_OPS_ID, 1178 GFP_KERNEL); 1179 if (error < 0) 1180 return error; 1181 *ops->id = error; 1182 max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1); 1183 } 1184 error = __register_pernet_operations(list, ops); 1185 if (error) { 1186 rcu_barrier(); 1187 if (ops->id) 1188 ida_free(&net_generic_ids, *ops->id); 1189 } 1190 1191 return error; 1192 } 1193 1194 static void unregister_pernet_operations(struct pernet_operations *ops) 1195 { 1196 __unregister_pernet_operations(ops); 1197 rcu_barrier(); 1198 if (ops->id) 1199 ida_free(&net_generic_ids, *ops->id); 1200 } 1201 1202 /** 1203 * register_pernet_subsys - register a network namespace subsystem 1204 * @ops: pernet operations structure for the subsystem 1205 * 1206 * Register a subsystem which has init and exit functions 1207 * that are called when network namespaces are created and 1208 * destroyed respectively. 1209 * 1210 * When registered all network namespace init functions are 1211 * called for every existing network namespace. Allowing kernel 1212 * modules to have a race free view of the set of network namespaces. 1213 * 1214 * When a new network namespace is created all of the init 1215 * methods are called in the order in which they were registered. 1216 * 1217 * When a network namespace is destroyed all of the exit methods 1218 * are called in the reverse of the order with which they were 1219 * registered. 1220 */ 1221 int register_pernet_subsys(struct pernet_operations *ops) 1222 { 1223 int error; 1224 down_write(&pernet_ops_rwsem); 1225 error = register_pernet_operations(first_device, ops); 1226 up_write(&pernet_ops_rwsem); 1227 return error; 1228 } 1229 EXPORT_SYMBOL_GPL(register_pernet_subsys); 1230 1231 /** 1232 * unregister_pernet_subsys - unregister a network namespace subsystem 1233 * @ops: pernet operations structure to manipulate 1234 * 1235 * Remove the pernet operations structure from the list to be 1236 * used when network namespaces are created or destroyed. In 1237 * addition run the exit method for all existing network 1238 * namespaces. 1239 */ 1240 void unregister_pernet_subsys(struct pernet_operations *ops) 1241 { 1242 down_write(&pernet_ops_rwsem); 1243 unregister_pernet_operations(ops); 1244 up_write(&pernet_ops_rwsem); 1245 } 1246 EXPORT_SYMBOL_GPL(unregister_pernet_subsys); 1247 1248 /** 1249 * register_pernet_device - register a network namespace device 1250 * @ops: pernet operations structure for the subsystem 1251 * 1252 * Register a device which has init and exit functions 1253 * that are called when network namespaces are created and 1254 * destroyed respectively. 1255 * 1256 * When registered all network namespace init functions are 1257 * called for every existing network namespace. Allowing kernel 1258 * modules to have a race free view of the set of network namespaces. 1259 * 1260 * When a new network namespace is created all of the init 1261 * methods are called in the order in which they were registered. 1262 * 1263 * When a network namespace is destroyed all of the exit methods 1264 * are called in the reverse of the order with which they were 1265 * registered. 1266 */ 1267 int register_pernet_device(struct pernet_operations *ops) 1268 { 1269 int error; 1270 down_write(&pernet_ops_rwsem); 1271 error = register_pernet_operations(&pernet_list, ops); 1272 if (!error && (first_device == &pernet_list)) 1273 first_device = &ops->list; 1274 up_write(&pernet_ops_rwsem); 1275 return error; 1276 } 1277 EXPORT_SYMBOL_GPL(register_pernet_device); 1278 1279 /** 1280 * unregister_pernet_device - unregister a network namespace netdevice 1281 * @ops: pernet operations structure to manipulate 1282 * 1283 * Remove the pernet operations structure from the list to be 1284 * used when network namespaces are created or destroyed. In 1285 * addition run the exit method for all existing network 1286 * namespaces. 1287 */ 1288 void unregister_pernet_device(struct pernet_operations *ops) 1289 { 1290 down_write(&pernet_ops_rwsem); 1291 if (&ops->list == first_device) 1292 first_device = first_device->next; 1293 unregister_pernet_operations(ops); 1294 up_write(&pernet_ops_rwsem); 1295 } 1296 EXPORT_SYMBOL_GPL(unregister_pernet_device); 1297 1298 #ifdef CONFIG_NET_NS 1299 static struct ns_common *netns_get(struct task_struct *task) 1300 { 1301 struct net *net = NULL; 1302 struct nsproxy *nsproxy; 1303 1304 task_lock(task); 1305 nsproxy = task->nsproxy; 1306 if (nsproxy) 1307 net = get_net(nsproxy->net_ns); 1308 task_unlock(task); 1309 1310 return net ? &net->ns : NULL; 1311 } 1312 1313 static inline struct net *to_net_ns(struct ns_common *ns) 1314 { 1315 return container_of(ns, struct net, ns); 1316 } 1317 1318 static void netns_put(struct ns_common *ns) 1319 { 1320 put_net(to_net_ns(ns)); 1321 } 1322 1323 static int netns_install(struct nsproxy *nsproxy, struct ns_common *ns) 1324 { 1325 struct net *net = to_net_ns(ns); 1326 1327 if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) || 1328 !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) 1329 return -EPERM; 1330 1331 put_net(nsproxy->net_ns); 1332 nsproxy->net_ns = get_net(net); 1333 return 0; 1334 } 1335 1336 static struct user_namespace *netns_owner(struct ns_common *ns) 1337 { 1338 return to_net_ns(ns)->user_ns; 1339 } 1340 1341 const struct proc_ns_operations netns_operations = { 1342 .name = "net", 1343 .type = CLONE_NEWNET, 1344 .get = netns_get, 1345 .put = netns_put, 1346 .install = netns_install, 1347 .owner = netns_owner, 1348 }; 1349 #endif 1350