Skip to content

Commit 1f5c135

Browse files
legionusebiederm
legionus
authored and
ebiederm
committed
ipc: Store ipc sysctls in the ipc namespace
The ipc sysctls are not available for modification inside the user namespace. Following the mqueue sysctls, we changed the implementation to be more userns friendly. So far, the changes do not provide additional access to files. This will be done in a future patch. Signed-off-by: Alexey Gladkov <legion@kernel.org> Link: https://lkml.kernel.org/r/be6f9d014276f4dddd0c3aa05a86052856c1c555.1644862280.git.legion@kernel.org Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
1 parent dc55e35 commit 1f5c135

File tree

3 files changed

+147
-67
lines changed

3 files changed

+147
-67
lines changed

‎include/linux/ipc_namespace.h

+21
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@ struct ipc_namespace {
6767
struct ctl_table_set mq_set;
6868
struct ctl_table_header *mq_sysctls;
6969

70+
struct ctl_table_set ipc_set;
71+
struct ctl_table_header *ipc_sysctls;
72+
7073
/* user_ns which owns the ipc ns */
7174
struct user_namespace *user_ns;
7275
struct ucounts *ucounts;
@@ -188,4 +191,22 @@ static inline bool setup_mq_sysctls(struct ipc_namespace *ns)
188191
}
189192

190193
#endif /* CONFIG_POSIX_MQUEUE_SYSCTL */
194+
195+
#ifdef CONFIG_SYSVIPC_SYSCTL
196+
197+
bool setup_ipc_sysctls(struct ipc_namespace *ns);
198+
void retire_ipc_sysctls(struct ipc_namespace *ns);
199+
200+
#else /* CONFIG_SYSVIPC_SYSCTL */
201+
202+
static inline void retire_ipc_sysctls(struct ipc_namespace *ns)
203+
{
204+
}
205+
206+
static inline bool setup_ipc_sysctls(struct ipc_namespace *ns)
207+
{
208+
return true;
209+
}
210+
211+
#endif /* CONFIG_SYSVIPC_SYSCTL */
191212
#endif

‎ipc/ipc_sysctl.c

+122-67
Original file line numberDiff line numberDiff line change
@@ -13,43 +13,22 @@
1313
#include <linux/capability.h>
1414
#include <linux/ipc_namespace.h>
1515
#include <linux/msg.h>
16+
#include <linux/slab.h>
1617
#include "util.h"
1718

18-
static void *get_ipc(struct ctl_table *table)
19-
{
20-
char *which = table->data;
21-
struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
22-
which = (which - (char *)&init_ipc_ns) + (char *)ipc_ns;
23-
return which;
24-
}
25-
26-
static int proc_ipc_dointvec(struct ctl_table *table, int write,
27-
void *buffer, size_t *lenp, loff_t *ppos)
28-
{
29-
struct ctl_table ipc_table;
30-
31-
memcpy(&ipc_table, table, sizeof(ipc_table));
32-
ipc_table.data = get_ipc(table);
33-
34-
return proc_dointvec(&ipc_table, write, buffer, lenp, ppos);
35-
}
36-
37-
static int proc_ipc_dointvec_minmax(struct ctl_table *table, int write,
19+
static int proc_ipc_dointvec_minmax_orphans(struct ctl_table *table, int write,
3820
void *buffer, size_t *lenp, loff_t *ppos)
3921
{
22+
struct ipc_namespace *ns = table->extra1;
4023
struct ctl_table ipc_table;
24+
int err;
4125

4226
memcpy(&ipc_table, table, sizeof(ipc_table));
43-
ipc_table.data = get_ipc(table);
4427

45-
return proc_dointvec_minmax(&ipc_table, write, buffer, lenp, ppos);
46-
}
28+
ipc_table.extra1 = SYSCTL_ZERO;
29+
ipc_table.extra2 = SYSCTL_ONE;
4730

48-
static int proc_ipc_dointvec_minmax_orphans(struct ctl_table *table, int write,
49-
void *buffer, size_t *lenp, loff_t *ppos)
50-
{
51-
struct ipc_namespace *ns = current->nsproxy->ipc_ns;
52-
int err = proc_ipc_dointvec_minmax(table, write, buffer, lenp, ppos);
31+
err = proc_dointvec_minmax(&ipc_table, write, buffer, lenp, ppos);
5332

5433
if (err < 0)
5534
return err;
@@ -58,17 +37,6 @@ static int proc_ipc_dointvec_minmax_orphans(struct ctl_table *table, int write,
5837
return err;
5938
}
6039

61-
static int proc_ipc_doulongvec_minmax(struct ctl_table *table, int write,
62-
void *buffer, size_t *lenp, loff_t *ppos)
63-
{
64-
struct ctl_table ipc_table;
65-
memcpy(&ipc_table, table, sizeof(ipc_table));
66-
ipc_table.data = get_ipc(table);
67-
68-
return proc_doulongvec_minmax(&ipc_table, write, buffer,
69-
lenp, ppos);
70-
}
71-
7240
static int proc_ipc_auto_msgmni(struct ctl_table *table, int write,
7341
void *buffer, size_t *lenp, loff_t *ppos)
7442
{
@@ -87,11 +55,17 @@ static int proc_ipc_auto_msgmni(struct ctl_table *table, int write,
8755
static int proc_ipc_sem_dointvec(struct ctl_table *table, int write,
8856
void *buffer, size_t *lenp, loff_t *ppos)
8957
{
58+
struct ipc_namespace *ns = table->extra1;
59+
struct ctl_table ipc_table;
9060
int ret, semmni;
91-
struct ipc_namespace *ns = current->nsproxy->ipc_ns;
61+
62+
memcpy(&ipc_table, table, sizeof(ipc_table));
63+
64+
ipc_table.extra1 = NULL;
65+
ipc_table.extra2 = NULL;
9266

9367
semmni = ns->sem_ctls[3];
94-
ret = proc_ipc_dointvec(table, write, buffer, lenp, ppos);
68+
ret = proc_dointvec(table, write, buffer, lenp, ppos);
9569

9670
if (!ret)
9771
ret = sem_check_semmni(current->nsproxy->ipc_ns);
@@ -108,40 +82,46 @@ static int proc_ipc_sem_dointvec(struct ctl_table *table, int write,
10882
static int proc_ipc_dointvec_minmax_checkpoint_restore(struct ctl_table *table,
10983
int write, void *buffer, size_t *lenp, loff_t *ppos)
11084
{
111-
struct user_namespace *user_ns = current->nsproxy->ipc_ns->user_ns;
85+
struct ipc_namespace *ns = table->extra1;
86+
struct ctl_table ipc_table;
11287

113-
if (write && !checkpoint_restore_ns_capable(user_ns))
88+
if (write && !checkpoint_restore_ns_capable(ns->user_ns))
11489
return -EPERM;
11590

116-
return proc_ipc_dointvec_minmax(table, write, buffer, lenp, ppos);
91+
memcpy(&ipc_table, table, sizeof(ipc_table));
92+
93+
ipc_table.extra1 = SYSCTL_ZERO;
94+
ipc_table.extra2 = SYSCTL_INT_MAX;
95+
96+
return proc_dointvec_minmax(&ipc_table, write, buffer, lenp, ppos);
11797
}
11898
#endif
11999

120100
int ipc_mni = IPCMNI;
121101
int ipc_mni_shift = IPCMNI_SHIFT;
122102
int ipc_min_cycle = RADIX_TREE_MAP_SIZE;
123103

124-
static struct ctl_table ipc_kern_table[] = {
104+
static struct ctl_table ipc_sysctls[] = {
125105
{
126106
.procname = "shmmax",
127107
.data = &init_ipc_ns.shm_ctlmax,
128108
.maxlen = sizeof(init_ipc_ns.shm_ctlmax),
129109
.mode = 0644,
130-
.proc_handler = proc_ipc_doulongvec_minmax,
110+
.proc_handler = proc_doulongvec_minmax,
131111
},
132112
{
133113
.procname = "shmall",
134114
.data = &init_ipc_ns.shm_ctlall,
135115
.maxlen = sizeof(init_ipc_ns.shm_ctlall),
136116
.mode = 0644,
137-
.proc_handler = proc_ipc_doulongvec_minmax,
117+
.proc_handler = proc_doulongvec_minmax,
138118
},
139119
{
140120
.procname = "shmmni",
141121
.data = &init_ipc_ns.shm_ctlmni,
142122
.maxlen = sizeof(init_ipc_ns.shm_ctlmni),
143123
.mode = 0644,
144-
.proc_handler = proc_ipc_dointvec_minmax,
124+
.proc_handler = proc_dointvec_minmax,
145125
.extra1 = SYSCTL_ZERO,
146126
.extra2 = &ipc_mni,
147127
},
@@ -151,15 +131,13 @@ static struct ctl_table ipc_kern_table[] = {
151131
.maxlen = sizeof(init_ipc_ns.shm_rmid_forced),
152132
.mode = 0644,
153133
.proc_handler = proc_ipc_dointvec_minmax_orphans,
154-
.extra1 = SYSCTL_ZERO,
155-
.extra2 = SYSCTL_ONE,
156134
},
157135
{
158136
.procname = "msgmax",
159137
.data = &init_ipc_ns.msg_ctlmax,
160138
.maxlen = sizeof(init_ipc_ns.msg_ctlmax),
161139
.mode = 0644,
162-
.proc_handler = proc_ipc_dointvec_minmax,
140+
.proc_handler = proc_dointvec_minmax,
163141
.extra1 = SYSCTL_ZERO,
164142
.extra2 = SYSCTL_INT_MAX,
165143
},
@@ -168,7 +146,7 @@ static struct ctl_table ipc_kern_table[] = {
168146
.data = &init_ipc_ns.msg_ctlmni,
169147
.maxlen = sizeof(init_ipc_ns.msg_ctlmni),
170148
.mode = 0644,
171-
.proc_handler = proc_ipc_dointvec_minmax,
149+
.proc_handler = proc_dointvec_minmax,
172150
.extra1 = SYSCTL_ZERO,
173151
.extra2 = &ipc_mni,
174152
},
@@ -186,7 +164,7 @@ static struct ctl_table ipc_kern_table[] = {
186164
.data = &init_ipc_ns.msg_ctlmnb,
187165
.maxlen = sizeof(init_ipc_ns.msg_ctlmnb),
188166
.mode = 0644,
189-
.proc_handler = proc_ipc_dointvec_minmax,
167+
.proc_handler = proc_dointvec_minmax,
190168
.extra1 = SYSCTL_ZERO,
191169
.extra2 = SYSCTL_INT_MAX,
192170
},
@@ -204,43 +182,120 @@ static struct ctl_table ipc_kern_table[] = {
204182
.maxlen = sizeof(init_ipc_ns.ids[IPC_SEM_IDS].next_id),
205183
.mode = 0666,
206184
.proc_handler = proc_ipc_dointvec_minmax_checkpoint_restore,
207-
.extra1 = SYSCTL_ZERO,
208-
.extra2 = SYSCTL_INT_MAX,
209185
},
210186
{
211187
.procname = "msg_next_id",
212188
.data = &init_ipc_ns.ids[IPC_MSG_IDS].next_id,
213189
.maxlen = sizeof(init_ipc_ns.ids[IPC_MSG_IDS].next_id),
214190
.mode = 0666,
215191
.proc_handler = proc_ipc_dointvec_minmax_checkpoint_restore,
216-
.extra1 = SYSCTL_ZERO,
217-
.extra2 = SYSCTL_INT_MAX,
218192
},
219193
{
220194
.procname = "shm_next_id",
221195
.data = &init_ipc_ns.ids[IPC_SHM_IDS].next_id,
222196
.maxlen = sizeof(init_ipc_ns.ids[IPC_SHM_IDS].next_id),
223197
.mode = 0666,
224198
.proc_handler = proc_ipc_dointvec_minmax_checkpoint_restore,
225-
.extra1 = SYSCTL_ZERO,
226-
.extra2 = SYSCTL_INT_MAX,
227199
},
228200
#endif
229201
{}
230202
};
231203

232-
static struct ctl_table ipc_root_table[] = {
233-
{
234-
.procname = "kernel",
235-
.mode = 0555,
236-
.child = ipc_kern_table,
237-
},
238-
{}
204+
static struct ctl_table_set *set_lookup(struct ctl_table_root *root)
205+
{
206+
return &current->nsproxy->ipc_ns->ipc_set;
207+
}
208+
209+
static int set_is_seen(struct ctl_table_set *set)
210+
{
211+
return &current->nsproxy->ipc_ns->ipc_set == set;
212+
}
213+
214+
static struct ctl_table_root set_root = {
215+
.lookup = set_lookup,
239216
};
240217

218+
bool setup_ipc_sysctls(struct ipc_namespace *ns)
219+
{
220+
struct ctl_table *tbl;
221+
222+
setup_sysctl_set(&ns->ipc_set, &set_root, set_is_seen);
223+
224+
tbl = kmemdup(ipc_sysctls, sizeof(ipc_sysctls), GFP_KERNEL);
225+
if (tbl) {
226+
int i;
227+
228+
for (i = 0; i < ARRAY_SIZE(ipc_sysctls); i++) {
229+
if (tbl[i].data == &init_ipc_ns.shm_ctlmax) {
230+
tbl[i].data = &ns->shm_ctlmax;
231+
232+
} else if (tbl[i].data == &init_ipc_ns.shm_ctlall) {
233+
tbl[i].data = &ns->shm_ctlall;
234+
235+
} else if (tbl[i].data == &init_ipc_ns.shm_ctlmni) {
236+
tbl[i].data = &ns->shm_ctlmni;
237+
238+
} else if (tbl[i].data == &init_ipc_ns.shm_rmid_forced) {
239+
tbl[i].data = &ns->shm_rmid_forced;
240+
tbl[i].extra1 = ns;
241+
242+
} else if (tbl[i].data == &init_ipc_ns.msg_ctlmax) {
243+
tbl[i].data = &ns->msg_ctlmax;
244+
245+
} else if (tbl[i].data == &init_ipc_ns.msg_ctlmni) {
246+
tbl[i].data = &ns->msg_ctlmni;
247+
248+
} else if (tbl[i].data == &init_ipc_ns.msg_ctlmnb) {
249+
tbl[i].data = &ns->msg_ctlmnb;
250+
251+
} else if (tbl[i].data == &init_ipc_ns.sem_ctls) {
252+
tbl[i].data = &ns->sem_ctls;
253+
tbl[i].extra1 = ns;
254+
#ifdef CONFIG_CHECKPOINT_RESTORE
255+
} else if (tbl[i].data == &init_ipc_ns.ids[IPC_SEM_IDS].next_id) {
256+
tbl[i].data = &ns->ids[IPC_SEM_IDS].next_id;
257+
tbl[i].extra1 = ns;
258+
259+
} else if (tbl[i].data == &init_ipc_ns.ids[IPC_MSG_IDS].next_id) {
260+
tbl[i].data = &ns->ids[IPC_MSG_IDS].next_id;
261+
tbl[i].extra1 = ns;
262+
263+
} else if (tbl[i].data == &init_ipc_ns.ids[IPC_SHM_IDS].next_id) {
264+
tbl[i].data = &ns->ids[IPC_SHM_IDS].next_id;
265+
tbl[i].extra1 = ns;
266+
#endif
267+
} else {
268+
tbl[i].data = NULL;
269+
}
270+
}
271+
272+
ns->ipc_sysctls = __register_sysctl_table(&ns->ipc_set, "kernel", tbl);
273+
}
274+
if (!ns->ipc_sysctls) {
275+
kfree(tbl);
276+
retire_sysctl_set(&ns->ipc_set);
277+
return false;
278+
}
279+
280+
return true;
281+
}
282+
283+
void retire_ipc_sysctls(struct ipc_namespace *ns)
284+
{
285+
struct ctl_table *tbl;
286+
287+
tbl = ns->ipc_sysctls->ctl_table_arg;
288+
unregister_sysctl_table(ns->ipc_sysctls);
289+
retire_sysctl_set(&ns->ipc_set);
290+
kfree(tbl);
291+
}
292+
241293
static int __init ipc_sysctl_init(void)
242294
{
243-
register_sysctl_table(ipc_root_table);
295+
if (!setup_ipc_sysctls(&init_ipc_ns)) {
296+
pr_warn("ipc sysctl registration failed\n");
297+
return -ENOMEM;
298+
}
244299
return 0;
245300
}
246301

‎ipc/namespace.c

+4
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,9 @@ static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
6363
if (!setup_mq_sysctls(ns))
6464
goto fail_put;
6565

66+
if (!setup_ipc_sysctls(ns))
67+
goto fail_put;
68+
6669
sem_init_ns(ns);
6770
msg_init_ns(ns);
6871
shm_init_ns(ns);
@@ -130,6 +133,7 @@ static void free_ipc_ns(struct ipc_namespace *ns)
130133
shm_exit_ns(ns);
131134

132135
retire_mq_sysctls(ns);
136+
retire_ipc_sysctls(ns);
133137

134138
dec_ipc_namespaces(ns->ucounts);
135139
put_user_ns(ns->user_ns);

0 commit comments

Comments
 (0)