1b2441318SGreg Kroah-Hartman/* SPDX-License-Identifier: GPL-2.0 */
2ab516013SSerge E. Hallyn#ifndef _LINUX_NSPROXY_H
3ab516013SSerge E. Hallyn#define _LINUX_NSPROXY_H
4ab516013SSerge E. Hallyn
5ab516013SSerge E. Hallyn#include <linux/spinlock.h>
6ab516013SSerge E. Hallyn#include <linux/sched.h>
7ab516013SSerge E. Hallyn
86b3286edSKirill Korotaevstruct mnt_namespace;
94865ecf1SSerge E. Hallynstruct uts_namespace;
1025b21cb2SKirill Korotaevstruct ipc_namespace;
119a575a92SCedric Le Goaterstruct pid_namespace;
12a79a908fSAditya Kalistruct cgroup_namespace;
135ad4e53bSAl Virostruct fs_struct;
141651e14eSSerge E. Hallyn
15ab516013SSerge E. Hallyn/*
16ab516013SSerge E. Hallyn * A structure to contain pointers to all per-process
17ab516013SSerge E. Hallyn * namespaces - fs (mount), uts, network, sysvipc, etc.
18ab516013SSerge E. Hallyn *
19c2b1df2eSAndy Lutomirski * The pid namespace is an exception -- it's accessed using
20c2b1df2eSAndy Lutomirski * task_active_pid_ns.  The pid namespace here is the
21c2b1df2eSAndy Lutomirski * namespace that children will use.
22c2b1df2eSAndy Lutomirski *
23ab516013SSerge E. Hallyn * 'count' is the number of tasks holding a reference.
24ab516013SSerge E. Hallyn * The count for each namespace, then, will be the number
25ab516013SSerge E. Hallyn * of nsproxies pointing to it, not the number of tasks.
26ab516013SSerge E. Hallyn *
27ab516013SSerge E. Hallyn * The nsproxy is shared by tasks which share all namespaces.
28ab516013SSerge E. Hallyn * As soon as a single namespace is cloned or unshared, the
29ab516013SSerge E. Hallyn * nsproxy is copied.
30ab516013SSerge E. Hallyn */
31ab516013SSerge E. Hallynstruct nsproxy {
32ab516013SSerge E. Hallyn	atomic_t count;
334865ecf1SSerge E. Hallyn	struct uts_namespace *uts_ns;
3425b21cb2SKirill Korotaev	struct ipc_namespace *ipc_ns;
356b3286edSKirill Korotaev	struct mnt_namespace *mnt_ns;
36c2b1df2eSAndy Lutomirski	struct pid_namespace *pid_ns_for_children;
37772698f6SEric W. Biederman	struct net 	     *net_ns;
38769071acSAndrei Vagin	struct time_namespace *time_ns;
39769071acSAndrei Vagin	struct time_namespace *time_ns_for_children;
40a79a908fSAditya Kali	struct cgroup_namespace *cgroup_ns;
41ab516013SSerge E. Hallyn};
42ab516013SSerge E. Hallynextern struct nsproxy init_nsproxy;
43ab516013SSerge E. Hallyn
44f2a8d52eSChristian Brauner/*
45f2a8d52eSChristian Brauner * A structure to encompass all bits needed to install
46f2a8d52eSChristian Brauner * a partial or complete new set of namespaces.
47f2a8d52eSChristian Brauner *
48f2a8d52eSChristian Brauner * If a new user namespace is requested cred will
49f2a8d52eSChristian Brauner * point to a modifiable set of credentials. If a pointer
50f2a8d52eSChristian Brauner * to a modifiable set is needed nsset_cred() must be
51f2a8d52eSChristian Brauner * used and tested.
52f2a8d52eSChristian Brauner */
53f2a8d52eSChristian Braunerstruct nsset {
54f2a8d52eSChristian Brauner	unsigned flags;
55f2a8d52eSChristian Brauner	struct nsproxy *nsproxy;
56f2a8d52eSChristian Brauner	struct fs_struct *fs;
57f2a8d52eSChristian Brauner	const struct cred *cred;
58f2a8d52eSChristian Brauner};
59f2a8d52eSChristian Brauner
60f2a8d52eSChristian Braunerstatic inline struct cred *nsset_cred(struct nsset *set)
61f2a8d52eSChristian Brauner{
62f2a8d52eSChristian Brauner	if (set->flags & CLONE_NEWUSER)
63f2a8d52eSChristian Brauner		return (struct cred *)set->cred;
64f2a8d52eSChristian Brauner
65f2a8d52eSChristian Brauner	return NULL;
66f2a8d52eSChristian Brauner}
67f2a8d52eSChristian Brauner
68cf7b708cSPavel Emelyanov/*
69cf7b708cSPavel Emelyanov * the namespaces access rules are:
70cf7b708cSPavel Emelyanov *
71cf7b708cSPavel Emelyanov *  1. only current task is allowed to change tsk->nsproxy pointer or
72728dba3aSEric W. Biederman *     any pointer on the nsproxy itself.  Current must hold the task_lock
73728dba3aSEric W. Biederman *     when changing tsk->nsproxy.
74cf7b708cSPavel Emelyanov *
75cf7b708cSPavel Emelyanov *  2. when accessing (i.e. reading) current task's namespaces - no
76cf7b708cSPavel Emelyanov *     precautions should be taken - just dereference the pointers
77cf7b708cSPavel Emelyanov *
78cf7b708cSPavel Emelyanov *  3. the access to other task namespaces is performed like this
79728dba3aSEric W. Biederman *     task_lock(task);
80728dba3aSEric W. Biederman *     nsproxy = task->nsproxy;
81cf7b708cSPavel Emelyanov *     if (nsproxy != NULL) {
82cf7b708cSPavel Emelyanov *             / *
83cf7b708cSPavel Emelyanov *               * work with the namespaces here
84cf7b708cSPavel Emelyanov *               * e.g. get the reference on one of them
85cf7b708cSPavel Emelyanov *               * /
86cf7b708cSPavel Emelyanov *     } / *
87728dba3aSEric W. Biederman *         * NULL task->nsproxy means that this task is
88cf7b708cSPavel Emelyanov *         * almost dead (zombie)
89cf7b708cSPavel Emelyanov *         * /
90728dba3aSEric W. Biederman *     task_unlock(task);
91cf7b708cSPavel Emelyanov *
92cf7b708cSPavel Emelyanov */
93cf7b708cSPavel Emelyanov
94213dd266SEric W. Biedermanint copy_namespaces(unsigned long flags, struct task_struct *tsk);
95cf7b708cSPavel Emelyanovvoid exit_task_namespaces(struct task_struct *tsk);
96cf7b708cSPavel Emelyanovvoid switch_task_namespaces(struct task_struct *tsk, struct nsproxy *new);
97ab516013SSerge E. Hallynvoid free_nsproxy(struct nsproxy *ns);
98e3222c4eSBadari Pulavartyint unshare_nsproxy_namespaces(unsigned long, struct nsproxy **,
99b2e0d987SEric W. Biederman	struct cred *, struct fs_struct *);
10066577193SAl Viroint __init nsproxy_cache_init(void);
101ab516013SSerge E. Hallyn
102444f378bSLinus Torvaldsstatic inline void put_nsproxy(struct nsproxy *ns)
103ab516013SSerge E. Hallyn{
104444f378bSLinus Torvalds	if (atomic_dec_and_test(&ns->count)) {
105ab516013SSerge E. Hallyn		free_nsproxy(ns);
106444f378bSLinus Torvalds	}
107ab516013SSerge E. Hallyn}
108ab516013SSerge E. Hallyn
109cf7b708cSPavel Emelyanovstatic inline void get_nsproxy(struct nsproxy *ns)
110ab516013SSerge E. Hallyn{
111cf7b708cSPavel Emelyanov	atomic_inc(&ns->count);
112ab516013SSerge E. Hallyn}
113858d72eaSSerge E. Hallyn
114ab516013SSerge E. Hallyn#endif