~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/core/net_namespace.c

Version: ~ [ linux-5.7-rc7 ] ~ [ linux-5.6.14 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.42 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.124 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.181 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.224 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.224 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.84 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  2 
  3 #include <linux/workqueue.h>
  4 #include <linux/rtnetlink.h>
  5 #include <linux/cache.h>
  6 #include <linux/slab.h>
  7 #include <linux/list.h>
  8 #include <linux/delay.h>
  9 #include <linux/sched.h>
 10 #include <linux/idr.h>
 11 #include <linux/rculist.h>
 12 #include <linux/nsproxy.h>
 13 #include <linux/fs.h>
 14 #include <linux/proc_ns.h>
 15 #include <linux/file.h>
 16 #include <linux/export.h>
 17 #include <linux/user_namespace.h>
 18 #include <net/net_namespace.h>
 19 #include <net/netns/generic.h>
 20 
 21 /*
 22  *      Our network namespace constructor/destructor lists
 23  */
 24 
 25 static LIST_HEAD(pernet_list);
 26 static struct list_head *first_device = &pernet_list;
 27 DEFINE_MUTEX(net_mutex);
 28 
 29 LIST_HEAD(net_namespace_list);
 30 EXPORT_SYMBOL_GPL(net_namespace_list);
 31 
 32 struct net init_net = {
 33         .dev_base_head = LIST_HEAD_INIT(init_net.dev_base_head),
 34 };
 35 EXPORT_SYMBOL(init_net);
 36 
 37 #define INITIAL_NET_GEN_PTRS    13 /* +1 for len +2 for rcu_head */
 38 
 39 static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
 40 
 41 static struct net_generic *net_alloc_generic(void)
 42 {
 43         struct net_generic *ng;
 44         size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
 45 
 46         ng = kzalloc(generic_size, GFP_KERNEL);
 47         if (ng)
 48                 ng->len = max_gen_ptrs;
 49 
 50         return ng;
 51 }
 52 
 53 static int net_assign_generic(struct net *net, int id, void *data)
 54 {
 55         struct net_generic *ng, *old_ng;
 56 
 57         BUG_ON(!mutex_is_locked(&net_mutex));
 58         BUG_ON(id == 0);
 59 
 60         old_ng = rcu_dereference_protected(net->gen,
 61                                            lockdep_is_held(&net_mutex));
 62         ng = old_ng;
 63         if (old_ng->len >= id)
 64                 goto assign;
 65 
 66         ng = net_alloc_generic();
 67         if (ng == NULL)
 68                 return -ENOMEM;
 69 
 70         /*
 71          * Some synchronisation notes:
 72          *
 73          * The net_generic explores the net->gen array inside rcu
 74          * read section. Besides once set the net->gen->ptr[x]
 75          * pointer never changes (see rules in netns/generic.h).
 76          *
 77          * That said, we simply duplicate this array and schedule
 78          * the old copy for kfree after a grace period.
 79          */
 80 
 81         memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
 82 
 83         rcu_assign_pointer(net->gen, ng);
 84         kfree_rcu(old_ng, rcu);
 85 assign:
 86         ng->ptr[id - 1] = data;
 87         return 0;
 88 }
 89 
 90 static int ops_init(const struct pernet_operations *ops, struct net *net)
 91 {
 92         int err = -ENOMEM;
 93         void *data = NULL;
 94 
 95         if (ops->id && ops->size) {
 96                 data = kzalloc(ops->size, GFP_KERNEL);
 97                 if (!data)
 98                         goto out;
 99 
100                 err = net_assign_generic(net, *ops->id, data);
101                 if (err)
102                         goto cleanup;
103         }
104         err = 0;
105         if (ops->init)
106                 err = ops->init(net);
107         if (!err)
108                 return 0;
109 
110 cleanup:
111         kfree(data);
112 
113 out:
114         return err;
115 }
116 
117 static void ops_free(const struct pernet_operations *ops, struct net *net)
118 {
119         if (ops->id && ops->size) {
120                 int id = *ops->id;
121                 kfree(net_generic(net, id));
122         }
123 }
124 
125 static void ops_exit_list(const struct pernet_operations *ops,
126                           struct list_head *net_exit_list)
127 {
128         struct net *net;
129         if (ops->exit) {
130                 list_for_each_entry(net, net_exit_list, exit_list)
131                         ops->exit(net);
132         }
133         if (ops->exit_batch)
134                 ops->exit_batch(net_exit_list);
135 }
136 
137 static void ops_free_list(const struct pernet_operations *ops,
138                           struct list_head *net_exit_list)
139 {
140         struct net *net;
141         if (ops->size && ops->id) {
142                 list_for_each_entry(net, net_exit_list, exit_list)
143                         ops_free(ops, net);
144         }
145 }
146 
147 /*
148  * setup_net runs the initializers for the network namespace object.
149  */
150 static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
151 {
152         /* Must be called with net_mutex held */
153         const struct pernet_operations *ops, *saved_ops;
154         int error = 0;
155         LIST_HEAD(net_exit_list);
156 
157         atomic_set(&net->count, 1);
158         atomic_set(&net->passive, 1);
159         net->dev_base_seq = 1;
160         net->user_ns = user_ns;
161 
162 #ifdef NETNS_REFCNT_DEBUG
163         atomic_set(&net->use_count, 0);
164 #endif
165 
166         list_for_each_entry(ops, &pernet_list, list) {
167                 error = ops_init(ops, net);
168                 if (error < 0)
169                         goto out_undo;
170         }
171 out:
172         return error;
173 
174 out_undo:
175         /* Walk through the list backwards calling the exit functions
176          * for the pernet modules whose init functions did not fail.
177          */
178         list_add(&net->exit_list, &net_exit_list);
179         saved_ops = ops;
180         list_for_each_entry_continue_reverse(ops, &pernet_list, list)
181                 ops_exit_list(ops, &net_exit_list);
182 
183         ops = saved_ops;
184         list_for_each_entry_continue_reverse(ops, &pernet_list, list)
185                 ops_free_list(ops, &net_exit_list);
186 
187         rcu_barrier();
188         goto out;
189 }
190 
191 
192 #ifdef CONFIG_NET_NS
193 static struct kmem_cache *net_cachep;
194 static struct workqueue_struct *netns_wq;
195 
196 static struct net *net_alloc(void)
197 {
198         struct net *net = NULL;
199         struct net_generic *ng;
200 
201         ng = net_alloc_generic();
202         if (!ng)
203                 goto out;
204 
205         net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
206         if (!net)
207                 goto out_free;
208 
209         rcu_assign_pointer(net->gen, ng);
210 out:
211         return net;
212 
213 out_free:
214         kfree(ng);
215         goto out;
216 }
217 
218 static void net_free(struct net *net)
219 {
220 #ifdef NETNS_REFCNT_DEBUG
221         if (unlikely(atomic_read(&net->use_count) != 0)) {
222                 pr_emerg("network namespace not free! Usage: %d\n",
223                          atomic_read(&net->use_count));
224                 return;
225         }
226 #endif
227         kfree(net->gen);
228         kmem_cache_free(net_cachep, net);
229 }
230 
231 void net_drop_ns(void *p)
232 {
233         struct net *ns = p;
234         if (ns && atomic_dec_and_test(&ns->passive))
235                 net_free(ns);
236 }
237 
238 struct net *copy_net_ns(unsigned long flags,
239                         struct user_namespace *user_ns, struct net *old_net)
240 {
241         struct net *net;
242         int rv;
243 
244         if (!(flags & CLONE_NEWNET))
245                 return get_net(old_net);
246 
247         net = net_alloc();
248         if (!net)
249                 return ERR_PTR(-ENOMEM);
250 
251         get_user_ns(user_ns);
252 
253         mutex_lock(&net_mutex);
254         rv = setup_net(net, user_ns);
255         if (rv == 0) {
256                 rtnl_lock();
257                 list_add_tail_rcu(&net->list, &net_namespace_list);
258                 rtnl_unlock();
259         }
260         mutex_unlock(&net_mutex);
261         if (rv < 0) {
262                 put_user_ns(user_ns);
263                 net_drop_ns(net);
264                 return ERR_PTR(rv);
265         }
266         return net;
267 }
268 
269 static DEFINE_SPINLOCK(cleanup_list_lock);
270 static LIST_HEAD(cleanup_list);  /* Must hold cleanup_list_lock to touch */
271 
272 static void cleanup_net(struct work_struct *work)
273 {
274         const struct pernet_operations *ops;
275         struct net *net, *tmp;
276         struct list_head net_kill_list;
277         LIST_HEAD(net_exit_list);
278 
279         /* Atomically snapshot the list of namespaces to cleanup */
280         spin_lock_irq(&cleanup_list_lock);
281         list_replace_init(&cleanup_list, &net_kill_list);
282         spin_unlock_irq(&cleanup_list_lock);
283 
284         mutex_lock(&net_mutex);
285 
286         /* Don't let anyone else find us. */
287         rtnl_lock();
288         list_for_each_entry(net, &net_kill_list, cleanup_list) {
289                 list_del_rcu(&net->list);
290                 list_add_tail(&net->exit_list, &net_exit_list);
291         }
292         rtnl_unlock();
293 
294         /*
295          * Another CPU might be rcu-iterating the list, wait for it.
296          * This needs to be before calling the exit() notifiers, so
297          * the rcu_barrier() below isn't sufficient alone.
298          */
299         synchronize_rcu();
300 
301         /* Run all of the network namespace exit methods */
302         list_for_each_entry_reverse(ops, &pernet_list, list)
303                 ops_exit_list(ops, &net_exit_list);
304 
305         /* Free the net generic variables */
306         list_for_each_entry_reverse(ops, &pernet_list, list)
307                 ops_free_list(ops, &net_exit_list);
308 
309         mutex_unlock(&net_mutex);
310 
311         /* Ensure there are no outstanding rcu callbacks using this
312          * network namespace.
313          */
314         rcu_barrier();
315 
316         /* Finally it is safe to free my network namespace structure */
317         list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
318                 list_del_init(&net->exit_list);
319                 put_user_ns(net->user_ns);
320                 net_drop_ns(net);
321         }
322 }
323 static DECLARE_WORK(net_cleanup_work, cleanup_net);
324 
325 void __put_net(struct net *net)
326 {
327         /* Cleanup the network namespace in process context */
328         unsigned long flags;
329 
330         spin_lock_irqsave(&cleanup_list_lock, flags);
331         list_add(&net->cleanup_list, &cleanup_list);
332         spin_unlock_irqrestore(&cleanup_list_lock, flags);
333 
334         queue_work(netns_wq, &net_cleanup_work);
335 }
336 EXPORT_SYMBOL_GPL(__put_net);
337 
338 struct net *get_net_ns_by_fd(int fd)
339 {
340         struct proc_ns *ei;
341         struct file *file;
342         struct net *net;
343 
344         file = proc_ns_fget(fd);
345         if (IS_ERR(file))
346                 return ERR_CAST(file);
347 
348         ei = get_proc_ns(file_inode(file));
349         if (ei->ns_ops == &netns_operations)
350                 net = get_net(ei->ns);
351         else
352                 net = ERR_PTR(-EINVAL);
353 
354         fput(file);
355         return net;
356 }
357 
358 #else
359 struct net *get_net_ns_by_fd(int fd)
360 {
361         return ERR_PTR(-EINVAL);
362 }
363 #endif
364 
365 struct net *get_net_ns_by_pid(pid_t pid)
366 {
367         struct task_struct *tsk;
368         struct net *net;
369 
370         /* Lookup the network namespace */
371         net = ERR_PTR(-ESRCH);
372         rcu_read_lock();
373         tsk = find_task_by_vpid(pid);
374         if (tsk) {
375                 struct nsproxy *nsproxy;
376                 task_lock(tsk);
377                 nsproxy = tsk->nsproxy;
378                 if (nsproxy)
379                         net = get_net(nsproxy->net_ns);
380                 task_unlock(tsk);
381         }
382         rcu_read_unlock();
383         return net;
384 }
385 EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
386 
387 static __net_init int net_ns_net_init(struct net *net)
388 {
389         return proc_alloc_inum(&net->proc_inum);
390 }
391 
392 static __net_exit void net_ns_net_exit(struct net *net)
393 {
394         proc_free_inum(net->proc_inum);
395 }
396 
397 static struct pernet_operations __net_initdata net_ns_ops = {
398         .init = net_ns_net_init,
399         .exit = net_ns_net_exit,
400 };
401 
402 static int __init net_ns_init(void)
403 {
404         struct net_generic *ng;
405 
406 #ifdef CONFIG_NET_NS
407         net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
408                                         SMP_CACHE_BYTES,
409                                         SLAB_PANIC, NULL);
410 
411         /* Create workqueue for cleanup */
412         netns_wq = create_singlethread_workqueue("netns");
413         if (!netns_wq)
414                 panic("Could not create netns workq");
415 #endif
416 
417         ng = net_alloc_generic();
418         if (!ng)
419                 panic("Could not allocate generic netns");
420 
421         rcu_assign_pointer(init_net.gen, ng);
422 
423         mutex_lock(&net_mutex);
424         if (setup_net(&init_net, &init_user_ns))
425                 panic("Could not setup the initial network namespace");
426 
427         rtnl_lock();
428         list_add_tail_rcu(&init_net.list, &net_namespace_list);
429         rtnl_unlock();
430 
431         mutex_unlock(&net_mutex);
432 
433         register_pernet_subsys(&net_ns_ops);
434 
435         return 0;
436 }
437 
438 pure_initcall(net_ns_init);
439 
440 #ifdef CONFIG_NET_NS
441 static int __register_pernet_operations(struct list_head *list,
442                                         struct pernet_operations *ops)
443 {
444         struct net *net;
445         int error;
446         LIST_HEAD(net_exit_list);
447 
448         list_add_tail(&ops->list, list);
449         if (ops->init || (ops->id && ops->size)) {
450                 for_each_net(net) {
451                         error = ops_init(ops, net);
452                         if (error)
453                                 goto out_undo;
454                         list_add_tail(&net->exit_list, &net_exit_list);
455                 }
456         }
457         return 0;
458 
459 out_undo:
460         /* If I have an error cleanup all namespaces I initialized */
461         list_del(&ops->list);
462         ops_exit_list(ops, &net_exit_list);
463         ops_free_list(ops, &net_exit_list);
464         return error;
465 }
466 
467 static void __unregister_pernet_operations(struct pernet_operations *ops)
468 {
469         struct net *net;
470         LIST_HEAD(net_exit_list);
471 
472         list_del(&ops->list);
473         for_each_net(net)
474                 list_add_tail(&net->exit_list, &net_exit_list);
475         ops_exit_list(ops, &net_exit_list);
476         ops_free_list(ops, &net_exit_list);
477 }
478 
479 #else
480 
481 static int __register_pernet_operations(struct list_head *list,
482                                         struct pernet_operations *ops)
483 {
484         return ops_init(ops, &init_net);
485 }
486 
487 static void __unregister_pernet_operations(struct pernet_operations *ops)
488 {
489         LIST_HEAD(net_exit_list);
490         list_add(&init_net.exit_list, &net_exit_list);
491         ops_exit_list(ops, &net_exit_list);
492         ops_free_list(ops, &net_exit_list);
493 }
494 
495 #endif /* CONFIG_NET_NS */
496 
497 static DEFINE_IDA(net_generic_ids);
498 
499 static int register_pernet_operations(struct list_head *list,
500                                       struct pernet_operations *ops)
501 {
502         int error;
503 
504         if (ops->id) {
505 again:
506                 error = ida_get_new_above(&net_generic_ids, 1, ops->id);
507                 if (error < 0) {
508                         if (error == -EAGAIN) {
509                                 ida_pre_get(&net_generic_ids, GFP_KERNEL);
510                                 goto again;
511                         }
512                         return error;
513                 }
514                 max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
515         }
516         error = __register_pernet_operations(list, ops);
517         if (error) {
518                 rcu_barrier();
519                 if (ops->id)
520                         ida_remove(&net_generic_ids, *ops->id);
521         }
522 
523         return error;
524 }
525 
526 static void unregister_pernet_operations(struct pernet_operations *ops)
527 {
528         
529         __unregister_pernet_operations(ops);
530         rcu_barrier();
531         if (ops->id)
532                 ida_remove(&net_generic_ids, *ops->id);
533 }
534 
535 /**
536  *      register_pernet_subsys - register a network namespace subsystem
537  *      @ops:  pernet operations structure for the subsystem
538  *
539  *      Register a subsystem which has init and exit functions
540  *      that are called when network namespaces are created and
541  *      destroyed respectively.
542  *
543  *      When registered all network namespace init functions are
544  *      called for every existing network namespace.  Allowing kernel
545  *      modules to have a race free view of the set of network namespaces.
546  *
547  *      When a new network namespace is created all of the init
548  *      methods are called in the order in which they were registered.
549  *
550  *      When a network namespace is destroyed all of the exit methods
551  *      are called in the reverse of the order with which they were
552  *      registered.
553  */
554 int register_pernet_subsys(struct pernet_operations *ops)
555 {
556         int error;
557         mutex_lock(&net_mutex);
558         error =  register_pernet_operations(first_device, ops);
559         mutex_unlock(&net_mutex);
560         return error;
561 }
562 EXPORT_SYMBOL_GPL(register_pernet_subsys);
563 
564 /**
565  *      unregister_pernet_subsys - unregister a network namespace subsystem
566  *      @ops: pernet operations structure to manipulate
567  *
568  *      Remove the pernet operations structure from the list to be
569  *      used when network namespaces are created or destroyed.  In
570  *      addition run the exit method for all existing network
571  *      namespaces.
572  */
573 void unregister_pernet_subsys(struct pernet_operations *ops)
574 {
575         mutex_lock(&net_mutex);
576         unregister_pernet_operations(ops);
577         mutex_unlock(&net_mutex);
578 }
579 EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
580 
581 /**
582  *      register_pernet_device - register a network namespace device
583  *      @ops:  pernet operations structure for the subsystem
584  *
585  *      Register a device which has init and exit functions
586  *      that are called when network namespaces are created and
587  *      destroyed respectively.
588  *
589  *      When registered all network namespace init functions are
590  *      called for every existing network namespace.  Allowing kernel
591  *      modules to have a race free view of the set of network namespaces.
592  *
593  *      When a new network namespace is created all of the init
594  *      methods are called in the order in which they were registered.
595  *
596  *      When a network namespace is destroyed all of the exit methods
597  *      are called in the reverse of the order with which they were
598  *      registered.
599  */
600 int register_pernet_device(struct pernet_operations *ops)
601 {
602         int error;
603         mutex_lock(&net_mutex);
604         error = register_pernet_operations(&pernet_list, ops);
605         if (!error && (first_device == &pernet_list))
606                 first_device = &ops->list;
607         mutex_unlock(&net_mutex);
608         return error;
609 }
610 EXPORT_SYMBOL_GPL(register_pernet_device);
611 
612 /**
613  *      unregister_pernet_device - unregister a network namespace netdevice
614  *      @ops: pernet operations structure to manipulate
615  *
616  *      Remove the pernet operations structure from the list to be
617  *      used when network namespaces are created or destroyed.  In
618  *      addition run the exit method for all existing network
619  *      namespaces.
620  */
621 void unregister_pernet_device(struct pernet_operations *ops)
622 {
623         mutex_lock(&net_mutex);
624         if (&ops->list == first_device)
625                 first_device = first_device->next;
626         unregister_pernet_operations(ops);
627         mutex_unlock(&net_mutex);
628 }
629 EXPORT_SYMBOL_GPL(unregister_pernet_device);
630 
631 #ifdef CONFIG_NET_NS
632 static void *netns_get(struct task_struct *task)
633 {
634         struct net *net = NULL;
635         struct nsproxy *nsproxy;
636 
637         task_lock(task);
638         nsproxy = task->nsproxy;
639         if (nsproxy)
640                 net = get_net(nsproxy->net_ns);
641         task_unlock(task);
642 
643         return net;
644 }
645 
646 static void netns_put(void *ns)
647 {
648         put_net(ns);
649 }
650 
651 static int netns_install(struct nsproxy *nsproxy, void *ns)
652 {
653         struct net *net = ns;
654 
655         if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
656             !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
657                 return -EPERM;
658 
659         put_net(nsproxy->net_ns);
660         nsproxy->net_ns = get_net(net);
661         return 0;
662 }
663 
664 static unsigned int netns_inum(void *ns)
665 {
666         struct net *net = ns;
667         return net->proc_inum;
668 }
669 
670 const struct proc_ns_operations netns_operations = {
671         .name           = "net",
672         .type           = CLONE_NEWNET,
673         .get            = netns_get,
674         .put            = netns_put,
675         .install        = netns_install,
676         .inum           = netns_inum,
677 };
678 #endif
679 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp