1// SPDX-License-Identifier: GPL-2.0
2#include <linux/mount.h>
3#include <linux/pseudo_fs.h>
4#include <linux/file.h>
5#include <linux/fs.h>
6#include <linux/proc_fs.h>
7#include <linux/proc_ns.h>
8#include <linux/magic.h>
9#include <linux/ktime.h>
10#include <linux/seq_file.h>
11#include <linux/user_namespace.h>
12#include <linux/nsfs.h>
13#include <linux/uaccess.h>
14
15#include "internal.h"
16
17static struct vfsmount *nsfs_mnt;
18
19static long ns_ioctl(struct file *filp, unsigned int ioctl,
20			unsigned long arg);
21static const struct file_operations ns_file_operations = {
22	.llseek		= no_llseek,
23	.unlocked_ioctl = ns_ioctl,
24	.compat_ioctl   = compat_ptr_ioctl,
25};
26
27static char *ns_dname(struct dentry *dentry, char *buffer, int buflen)
28{
29	struct inode *inode = d_inode(dentry);
30	struct ns_common *ns = inode->i_private;
31	const struct proc_ns_operations *ns_ops = ns->ops;
32
33	return dynamic_dname(buffer, buflen, "%s:[%lu]",
34		ns_ops->name, inode->i_ino);
35}
36
37const struct dentry_operations ns_dentry_operations = {
38	.d_delete	= always_delete_dentry,
39	.d_dname	= ns_dname,
40	.d_prune	= stashed_dentry_prune,
41};
42
43static void nsfs_evict(struct inode *inode)
44{
45	struct ns_common *ns = inode->i_private;
46	clear_inode(inode);
47	ns->ops->put(ns);
48}
49
50int ns_get_path_cb(struct path *path, ns_get_path_helper_t *ns_get_cb,
51		     void *private_data)
52{
53	struct ns_common *ns;
54
55	ns = ns_get_cb(private_data);
56	if (!ns)
57		return -ENOENT;
58
59	return path_from_stashed(&ns->stashed, nsfs_mnt, ns, path);
60}
61
62struct ns_get_path_task_args {
63	const struct proc_ns_operations *ns_ops;
64	struct task_struct *task;
65};
66
67static struct ns_common *ns_get_path_task(void *private_data)
68{
69	struct ns_get_path_task_args *args = private_data;
70
71	return args->ns_ops->get(args->task);
72}
73
74int ns_get_path(struct path *path, struct task_struct *task,
75		  const struct proc_ns_operations *ns_ops)
76{
77	struct ns_get_path_task_args args = {
78		.ns_ops	= ns_ops,
79		.task	= task,
80	};
81
82	return ns_get_path_cb(path, ns_get_path_task, &args);
83}
84
85int open_related_ns(struct ns_common *ns,
86		   struct ns_common *(*get_ns)(struct ns_common *ns))
87{
88	struct path path = {};
89	struct ns_common *relative;
90	struct file *f;
91	int err;
92	int fd;
93
94	fd = get_unused_fd_flags(O_CLOEXEC);
95	if (fd < 0)
96		return fd;
97
98	relative = get_ns(ns);
99	if (IS_ERR(relative)) {
100		put_unused_fd(fd);
101		return PTR_ERR(relative);
102	}
103
104	err = path_from_stashed(&relative->stashed, nsfs_mnt, relative, &path);
105	if (err < 0) {
106		put_unused_fd(fd);
107		return err;
108	}
109
110	f = dentry_open(&path, O_RDONLY, current_cred());
111	path_put(&path);
112	if (IS_ERR(f)) {
113		put_unused_fd(fd);
114		fd = PTR_ERR(f);
115	} else
116		fd_install(fd, f);
117
118	return fd;
119}
120EXPORT_SYMBOL_GPL(open_related_ns);
121
122static long ns_ioctl(struct file *filp, unsigned int ioctl,
123			unsigned long arg)
124{
125	struct user_namespace *user_ns;
126	struct ns_common *ns = get_proc_ns(file_inode(filp));
127	uid_t __user *argp;
128	uid_t uid;
129
130	switch (ioctl) {
131	case NS_GET_USERNS:
132		return open_related_ns(ns, ns_get_owner);
133	case NS_GET_PARENT:
134		if (!ns->ops->get_parent)
135			return -EINVAL;
136		return open_related_ns(ns, ns->ops->get_parent);
137	case NS_GET_NSTYPE:
138		return ns->ops->type;
139	case NS_GET_OWNER_UID:
140		if (ns->ops->type != CLONE_NEWUSER)
141			return -EINVAL;
142		user_ns = container_of(ns, struct user_namespace, ns);
143		argp = (uid_t __user *) arg;
144		uid = from_kuid_munged(current_user_ns(), user_ns->owner);
145		return put_user(uid, argp);
146	default:
147		return -ENOTTY;
148	}
149}
150
151int ns_get_name(char *buf, size_t size, struct task_struct *task,
152			const struct proc_ns_operations *ns_ops)
153{
154	struct ns_common *ns;
155	int res = -ENOENT;
156	const char *name;
157	ns = ns_ops->get(task);
158	if (ns) {
159		name = ns_ops->real_ns_name ? : ns_ops->name;
160		res = snprintf(buf, size, "%s:[%u]", name, ns->inum);
161		ns_ops->put(ns);
162	}
163	return res;
164}
165
166bool proc_ns_file(const struct file *file)
167{
168	return file->f_op == &ns_file_operations;
169}
170
171/**
172 * ns_match() - Returns true if current namespace matches dev/ino provided.
173 * @ns: current namespace
174 * @dev: dev_t from nsfs that will be matched against current nsfs
175 * @ino: ino_t from nsfs that will be matched against current nsfs
176 *
177 * Return: true if dev and ino matches the current nsfs.
178 */
179bool ns_match(const struct ns_common *ns, dev_t dev, ino_t ino)
180{
181	return (ns->inum == ino) && (nsfs_mnt->mnt_sb->s_dev == dev);
182}
183
184
185static int nsfs_show_path(struct seq_file *seq, struct dentry *dentry)
186{
187	struct inode *inode = d_inode(dentry);
188	const struct ns_common *ns = inode->i_private;
189	const struct proc_ns_operations *ns_ops = ns->ops;
190
191	seq_printf(seq, "%s:[%lu]", ns_ops->name, inode->i_ino);
192	return 0;
193}
194
195static const struct super_operations nsfs_ops = {
196	.statfs = simple_statfs,
197	.evict_inode = nsfs_evict,
198	.show_path = nsfs_show_path,
199};
200
201static int nsfs_init_inode(struct inode *inode, void *data)
202{
203	struct ns_common *ns = data;
204
205	inode->i_private = data;
206	inode->i_mode |= S_IRUGO;
207	inode->i_fop = &ns_file_operations;
208	inode->i_ino = ns->inum;
209	return 0;
210}
211
212static void nsfs_put_data(void *data)
213{
214	struct ns_common *ns = data;
215	ns->ops->put(ns);
216}
217
218static const struct stashed_operations nsfs_stashed_ops = {
219	.init_inode = nsfs_init_inode,
220	.put_data = nsfs_put_data,
221};
222
223static int nsfs_init_fs_context(struct fs_context *fc)
224{
225	struct pseudo_fs_context *ctx = init_pseudo(fc, NSFS_MAGIC);
226	if (!ctx)
227		return -ENOMEM;
228	ctx->ops = &nsfs_ops;
229	ctx->dops = &ns_dentry_operations;
230	fc->s_fs_info = (void *)&nsfs_stashed_ops;
231	return 0;
232}
233
234static struct file_system_type nsfs = {
235	.name = "nsfs",
236	.init_fs_context = nsfs_init_fs_context,
237	.kill_sb = kill_anon_super,
238};
239
240void __init nsfs_init(void)
241{
242	nsfs_mnt = kern_mount(&nsfs);
243	if (IS_ERR(nsfs_mnt))
244		panic("can't set nsfs up\n");
245	nsfs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;
246}
247