~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/core/net_namespace.c

Version: ~ [ linux-5.13-rc5 ] ~ [ linux-5.12.9 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.42 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.124 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.193 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.235 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.271 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.271 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  2 
  3 #include <linux/workqueue.h>
  4 #include <linux/rtnetlink.h>
  5 #include <linux/cache.h>
  6 #include <linux/slab.h>
  7 #include <linux/list.h>
  8 #include <linux/delay.h>
  9 #include <linux/sched.h>
 10 #include <linux/idr.h>
 11 #include <linux/rculist.h>
 12 #include <linux/nsproxy.h>
 13 #include <linux/fs.h>
 14 #include <linux/proc_ns.h>
 15 #include <linux/file.h>
 16 #include <linux/export.h>
 17 #include <linux/user_namespace.h>
 18 #include <linux/net_namespace.h>
 19 #include <net/sock.h>
 20 #include <net/netlink.h>
 21 #include <net/net_namespace.h>
 22 #include <net/netns/generic.h>
 23 
 24 /*
 25  *      Our network namespace constructor/destructor lists
 26  */
 27 
 28 static LIST_HEAD(pernet_list);
 29 static struct list_head *first_device = &pernet_list;
 30 DEFINE_MUTEX(net_mutex);
 31 
 32 LIST_HEAD(net_namespace_list);
 33 EXPORT_SYMBOL_GPL(net_namespace_list);
 34 
 35 struct net init_net = {
 36         .dev_base_head = LIST_HEAD_INIT(init_net.dev_base_head),
 37 };
 38 EXPORT_SYMBOL(init_net);
 39 
 40 #define INITIAL_NET_GEN_PTRS    13 /* +1 for len +2 for rcu_head */
 41 
 42 static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
 43 
 44 static struct net_generic *net_alloc_generic(void)
 45 {
 46         struct net_generic *ng;
 47         size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
 48 
 49         ng = kzalloc(generic_size, GFP_KERNEL);
 50         if (ng)
 51                 ng->len = max_gen_ptrs;
 52 
 53         return ng;
 54 }
 55 
 56 static int net_assign_generic(struct net *net, int id, void *data)
 57 {
 58         struct net_generic *ng, *old_ng;
 59 
 60         BUG_ON(!mutex_is_locked(&net_mutex));
 61         BUG_ON(id == 0);
 62 
 63         old_ng = rcu_dereference_protected(net->gen,
 64                                            lockdep_is_held(&net_mutex));
 65         ng = old_ng;
 66         if (old_ng->len >= id)
 67                 goto assign;
 68 
 69         ng = net_alloc_generic();
 70         if (ng == NULL)
 71                 return -ENOMEM;
 72 
 73         /*
 74          * Some synchronisation notes:
 75          *
 76          * The net_generic explores the net->gen array inside rcu
 77          * read section. Besides once set the net->gen->ptr[x]
 78          * pointer never changes (see rules in netns/generic.h).
 79          *
 80          * That said, we simply duplicate this array and schedule
 81          * the old copy for kfree after a grace period.
 82          */
 83 
 84         memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
 85 
 86         rcu_assign_pointer(net->gen, ng);
 87         kfree_rcu(old_ng, rcu);
 88 assign:
 89         ng->ptr[id - 1] = data;
 90         return 0;
 91 }
 92 
 93 static int ops_init(const struct pernet_operations *ops, struct net *net)
 94 {
 95         int err = -ENOMEM;
 96         void *data = NULL;
 97 
 98         if (ops->id && ops->size) {
 99                 data = kzalloc(ops->size, GFP_KERNEL);
100                 if (!data)
101                         goto out;
102 
103                 err = net_assign_generic(net, *ops->id, data);
104                 if (err)
105                         goto cleanup;
106         }
107         err = 0;
108         if (ops->init)
109                 err = ops->init(net);
110         if (!err)
111                 return 0;
112 
113 cleanup:
114         kfree(data);
115 
116 out:
117         return err;
118 }
119 
120 static void ops_free(const struct pernet_operations *ops, struct net *net)
121 {
122         if (ops->id && ops->size) {
123                 int id = *ops->id;
124                 kfree(net_generic(net, id));
125         }
126 }
127 
128 static void ops_exit_list(const struct pernet_operations *ops,
129                           struct list_head *net_exit_list)
130 {
131         struct net *net;
132         if (ops->exit) {
133                 list_for_each_entry(net, net_exit_list, exit_list)
134                         ops->exit(net);
135         }
136         if (ops->exit_batch)
137                 ops->exit_batch(net_exit_list);
138 }
139 
140 static void ops_free_list(const struct pernet_operations *ops,
141                           struct list_head *net_exit_list)
142 {
143         struct net *net;
144         if (ops->size && ops->id) {
145                 list_for_each_entry(net, net_exit_list, exit_list)
146                         ops_free(ops, net);
147         }
148 }
149 
150 /* should be called with nsid_lock held */
151 static int alloc_netid(struct net *net, struct net *peer, int reqid)
152 {
153         int min = 0, max = 0;
154 
155         if (reqid >= 0) {
156                 min = reqid;
157                 max = reqid + 1;
158         }
159 
160         return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC);
161 }
162 
163 /* This function is used by idr_for_each(). If net is equal to peer, the
164  * function returns the id so that idr_for_each() stops. Because we cannot
165  * returns the id 0 (idr_for_each() will not stop), we return the magic value
166  * NET_ID_ZERO (-1) for it.
167  */
168 #define NET_ID_ZERO -1
169 static int net_eq_idr(int id, void *net, void *peer)
170 {
171         if (net_eq(net, peer))
172                 return id ? : NET_ID_ZERO;
173         return 0;
174 }
175 
176 /* Should be called with nsid_lock held. If a new id is assigned, the bool alloc
177  * is set to true, thus the caller knows that the new id must be notified via
178  * rtnl.
179  */
180 static int __peernet2id_alloc(struct net *net, struct net *peer, bool *alloc)
181 {
182         int id = idr_for_each(&net->netns_ids, net_eq_idr, peer);
183         bool alloc_it = *alloc;
184 
185         *alloc = false;
186 
187         /* Magic value for id 0. */
188         if (id == NET_ID_ZERO)
189                 return 0;
190         if (id > 0)
191                 return id;
192 
193         if (alloc_it) {
194                 id = alloc_netid(net, peer, -1);
195                 *alloc = true;
196                 return id >= 0 ? id : NETNSA_NSID_NOT_ASSIGNED;
197         }
198 
199         return NETNSA_NSID_NOT_ASSIGNED;
200 }
201 
202 /* should be called with nsid_lock held */
203 static int __peernet2id(struct net *net, struct net *peer)
204 {
205         bool no = false;
206 
207         return __peernet2id_alloc(net, peer, &no);
208 }
209 
210 static void rtnl_net_notifyid(struct net *net, int cmd, int id);
211 /* This function returns the id of a peer netns. If no id is assigned, one will
212  * be allocated and returned.
213  */
214 int peernet2id_alloc(struct net *net, struct net *peer)
215 {
216         unsigned long flags;
217         bool alloc;
218         int id;
219 
220         if (atomic_read(&net->count) == 0)
221                 return NETNSA_NSID_NOT_ASSIGNED;
222         spin_lock_irqsave(&net->nsid_lock, flags);
223         alloc = atomic_read(&peer->count) == 0 ? false : true;
224         id = __peernet2id_alloc(net, peer, &alloc);
225         spin_unlock_irqrestore(&net->nsid_lock, flags);
226         if (alloc && id >= 0)
227                 rtnl_net_notifyid(net, RTM_NEWNSID, id);
228         return id;
229 }
230 EXPORT_SYMBOL(peernet2id_alloc);
231 
232 /* This function returns, if assigned, the id of a peer netns. */
233 int peernet2id(struct net *net, struct net *peer)
234 {
235         unsigned long flags;
236         int id;
237 
238         spin_lock_irqsave(&net->nsid_lock, flags);
239         id = __peernet2id(net, peer);
240         spin_unlock_irqrestore(&net->nsid_lock, flags);
241         return id;
242 }
243 
244 /* This function returns true is the peer netns has an id assigned into the
245  * current netns.
246  */
247 bool peernet_has_id(struct net *net, struct net *peer)
248 {
249         return peernet2id(net, peer) >= 0;
250 }
251 
252 struct net *get_net_ns_by_id(struct net *net, int id)
253 {
254         unsigned long flags;
255         struct net *peer;
256 
257         if (id < 0)
258                 return NULL;
259 
260         rcu_read_lock();
261         spin_lock_irqsave(&net->nsid_lock, flags);
262         peer = idr_find(&net->netns_ids, id);
263         if (peer)
264                 get_net(peer);
265         spin_unlock_irqrestore(&net->nsid_lock, flags);
266         rcu_read_unlock();
267 
268         return peer;
269 }
270 
271 /*
272  * setup_net runs the initializers for the network namespace object.
273  */
274 static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
275 {
276         /* Must be called with net_mutex held */
277         const struct pernet_operations *ops, *saved_ops;
278         int error = 0;
279         LIST_HEAD(net_exit_list);
280 
281         atomic_set(&net->count, 1);
282         atomic_set(&net->passive, 1);
283         net->dev_base_seq = 1;
284         net->user_ns = user_ns;
285         idr_init(&net->netns_ids);
286         spin_lock_init(&net->nsid_lock);
287 
288         list_for_each_entry(ops, &pernet_list, list) {
289                 error = ops_init(ops, net);
290                 if (error < 0)
291                         goto out_undo;
292         }
293 out:
294         return error;
295 
296 out_undo:
297         /* Walk through the list backwards calling the exit functions
298          * for the pernet modules whose init functions did not fail.
299          */
300         list_add(&net->exit_list, &net_exit_list);
301         saved_ops = ops;
302         list_for_each_entry_continue_reverse(ops, &pernet_list, list)
303                 ops_exit_list(ops, &net_exit_list);
304 
305         ops = saved_ops;
306         list_for_each_entry_continue_reverse(ops, &pernet_list, list)
307                 ops_free_list(ops, &net_exit_list);
308 
309         rcu_barrier();
310         goto out;
311 }
312 
313 
314 #ifdef CONFIG_NET_NS
315 static struct kmem_cache *net_cachep;
316 static struct workqueue_struct *netns_wq;
317 
318 static struct net *net_alloc(void)
319 {
320         struct net *net = NULL;
321         struct net_generic *ng;
322 
323         ng = net_alloc_generic();
324         if (!ng)
325                 goto out;
326 
327         net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
328         if (!net)
329                 goto out_free;
330 
331         rcu_assign_pointer(net->gen, ng);
332 out:
333         return net;
334 
335 out_free:
336         kfree(ng);
337         goto out;
338 }
339 
340 static void net_free(struct net *net)
341 {
342         kfree(rcu_access_pointer(net->gen));
343         kmem_cache_free(net_cachep, net);
344 }
345 
346 void net_drop_ns(void *p)
347 {
348         struct net *ns = p;
349         if (ns && atomic_dec_and_test(&ns->passive))
350                 net_free(ns);
351 }
352 
353 struct net *copy_net_ns(unsigned long flags,
354                         struct user_namespace *user_ns, struct net *old_net)
355 {
356         struct net *net;
357         int rv;
358 
359         if (!(flags & CLONE_NEWNET))
360                 return get_net(old_net);
361 
362         net = net_alloc();
363         if (!net)
364                 return ERR_PTR(-ENOMEM);
365 
366         get_user_ns(user_ns);
367 
368         mutex_lock(&net_mutex);
369         rv = setup_net(net, user_ns);
370         if (rv == 0) {
371                 rtnl_lock();
372                 list_add_tail_rcu(&net->list, &net_namespace_list);
373                 rtnl_unlock();
374         }
375         mutex_unlock(&net_mutex);
376         if (rv < 0) {
377                 put_user_ns(user_ns);
378                 net_drop_ns(net);
379                 return ERR_PTR(rv);
380         }
381         return net;
382 }
383 
384 static DEFINE_SPINLOCK(cleanup_list_lock);
385 static LIST_HEAD(cleanup_list);  /* Must hold cleanup_list_lock to touch */
386 
387 static void cleanup_net(struct work_struct *work)
388 {
389         const struct pernet_operations *ops;
390         struct net *net, *tmp;
391         struct list_head net_kill_list;
392         LIST_HEAD(net_exit_list);
393 
394         /* Atomically snapshot the list of namespaces to cleanup */
395         spin_lock_irq(&cleanup_list_lock);
396         list_replace_init(&cleanup_list, &net_kill_list);
397         spin_unlock_irq(&cleanup_list_lock);
398 
399         mutex_lock(&net_mutex);
400 
401         /* Don't let anyone else find us. */
402         rtnl_lock();
403         list_for_each_entry(net, &net_kill_list, cleanup_list) {
404                 list_del_rcu(&net->list);
405                 list_add_tail(&net->exit_list, &net_exit_list);
406                 for_each_net(tmp) {
407                         int id;
408 
409                         spin_lock_irq(&tmp->nsid_lock);
410                         id = __peernet2id(tmp, net);
411                         if (id >= 0)
412                                 idr_remove(&tmp->netns_ids, id);
413                         spin_unlock_irq(&tmp->nsid_lock);
414                         if (id >= 0)
415                                 rtnl_net_notifyid(tmp, RTM_DELNSID, id);
416                 }
417                 spin_lock_irq(&net->nsid_lock);
418                 idr_destroy(&net->netns_ids);
419                 spin_unlock_irq(&net->nsid_lock);
420 
421         }
422         rtnl_unlock();
423 
424         /*
425          * Another CPU might be rcu-iterating the list, wait for it.
426          * This needs to be before calling the exit() notifiers, so
427          * the rcu_barrier() below isn't sufficient alone.
428          */
429         synchronize_rcu();
430 
431         /* Run all of the network namespace exit methods */
432         list_for_each_entry_reverse(ops, &pernet_list, list)
433                 ops_exit_list(ops, &net_exit_list);
434 
435         /* Free the net generic variables */
436         list_for_each_entry_reverse(ops, &pernet_list, list)
437                 ops_free_list(ops, &net_exit_list);
438 
439         mutex_unlock(&net_mutex);
440 
441         /* Ensure there are no outstanding rcu callbacks using this
442          * network namespace.
443          */
444         rcu_barrier();
445 
446         /* Finally it is safe to free my network namespace structure */
447         list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
448                 list_del_init(&net->exit_list);
449                 put_user_ns(net->user_ns);
450                 net_drop_ns(net);
451         }
452 }
453 static DECLARE_WORK(net_cleanup_work, cleanup_net);
454 
455 void __put_net(struct net *net)
456 {
457         /* Cleanup the network namespace in process context */
458         unsigned long flags;
459 
460         spin_lock_irqsave(&cleanup_list_lock, flags);
461         list_add(&net->cleanup_list, &cleanup_list);
462         spin_unlock_irqrestore(&cleanup_list_lock, flags);
463 
464         queue_work(netns_wq, &net_cleanup_work);
465 }
466 EXPORT_SYMBOL_GPL(__put_net);
467 
468 struct net *get_net_ns_by_fd(int fd)
469 {
470         struct file *file;
471         struct ns_common *ns;
472         struct net *net;
473 
474         file = proc_ns_fget(fd);
475         if (IS_ERR(file))
476                 return ERR_CAST(file);
477 
478         ns = get_proc_ns(file_inode(file));
479         if (ns->ops == &netns_operations)
480                 net = get_net(container_of(ns, struct net, ns));
481         else
482                 net = ERR_PTR(-EINVAL);
483 
484         fput(file);
485         return net;
486 }
487 
488 #else
489 struct net *get_net_ns_by_fd(int fd)
490 {
491         return ERR_PTR(-EINVAL);
492 }
493 #endif
494 EXPORT_SYMBOL_GPL(get_net_ns_by_fd);
495 
496 struct net *get_net_ns_by_pid(pid_t pid)
497 {
498         struct task_struct *tsk;
499         struct net *net;
500 
501         /* Lookup the network namespace */
502         net = ERR_PTR(-ESRCH);
503         rcu_read_lock();
504         tsk = find_task_by_vpid(pid);
505         if (tsk) {
506                 struct nsproxy *nsproxy;
507                 task_lock(tsk);
508                 nsproxy = tsk->nsproxy;
509                 if (nsproxy)
510                         net = get_net(nsproxy->net_ns);
511                 task_unlock(tsk);
512         }
513         rcu_read_unlock();
514         return net;
515 }
516 EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
517 
518 static __net_init int net_ns_net_init(struct net *net)
519 {
520 #ifdef CONFIG_NET_NS
521         net->ns.ops = &netns_operations;
522 #endif
523         return ns_alloc_inum(&net->ns);
524 }
525 
526 static __net_exit void net_ns_net_exit(struct net *net)
527 {
528         ns_free_inum(&net->ns);
529 }
530 
531 static struct pernet_operations __net_initdata net_ns_ops = {
532         .init = net_ns_net_init,
533         .exit = net_ns_net_exit,
534 };
535 
536 static struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = {
537         [NETNSA_NONE]           = { .type = NLA_UNSPEC },
538         [NETNSA_NSID]           = { .type = NLA_S32 },
539         [NETNSA_PID]            = { .type = NLA_U32 },
540         [NETNSA_FD]             = { .type = NLA_U32 },
541 };
542 
543 static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh)
544 {
545         struct net *net = sock_net(skb->sk);
546         struct nlattr *tb[NETNSA_MAX + 1];
547         unsigned long flags;
548         struct net *peer;
549         int nsid, err;
550 
551         err = nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, NETNSA_MAX,
552                           rtnl_net_policy);
553         if (err < 0)
554                 return err;
555         if (!tb[NETNSA_NSID])
556                 return -EINVAL;
557         nsid = nla_get_s32(tb[NETNSA_NSID]);
558 
559         if (tb[NETNSA_PID])
560                 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
561         else if (tb[NETNSA_FD])
562                 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
563         else
564                 return -EINVAL;
565         if (IS_ERR(peer))
566                 return PTR_ERR(peer);
567 
568         spin_lock_irqsave(&net->nsid_lock, flags);
569         if (__peernet2id(net, peer) >= 0) {
570                 spin_unlock_irqrestore(&net->nsid_lock, flags);
571                 err = -EEXIST;
572                 goto out;
573         }
574 
575         err = alloc_netid(net, peer, nsid);
576         spin_unlock_irqrestore(&net->nsid_lock, flags);
577         if (err >= 0) {
578                 rtnl_net_notifyid(net, RTM_NEWNSID, err);
579                 err = 0;
580         }
581 out:
582         put_net(peer);
583         return err;
584 }
585 
586 static int rtnl_net_get_size(void)
587 {
588         return NLMSG_ALIGN(sizeof(struct rtgenmsg))
589                + nla_total_size(sizeof(s32)) /* NETNSA_NSID */
590                ;
591 }
592 
593 static int rtnl_net_fill(struct sk_buff *skb, u32 portid, u32 seq, int flags,
594                          int cmd, struct net *net, int nsid)
595 {
596         struct nlmsghdr *nlh;
597         struct rtgenmsg *rth;
598 
599         nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rth), flags);
600         if (!nlh)
601                 return -EMSGSIZE;
602 
603         rth = nlmsg_data(nlh);
604         rth->rtgen_family = AF_UNSPEC;
605 
606         if (nla_put_s32(skb, NETNSA_NSID, nsid))
607                 goto nla_put_failure;
608 
609         nlmsg_end(skb, nlh);
610         return 0;
611 
612 nla_put_failure:
613         nlmsg_cancel(skb, nlh);
614         return -EMSGSIZE;
615 }
616 
617 static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh)
618 {
619         struct net *net = sock_net(skb->sk);
620         struct nlattr *tb[NETNSA_MAX + 1];
621         struct sk_buff *msg;
622         struct net *peer;
623         int err, id;
624 
625         err = nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, NETNSA_MAX,
626                           rtnl_net_policy);
627         if (err < 0)
628                 return err;
629         if (tb[NETNSA_PID])
630                 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
631         else if (tb[NETNSA_FD])
632                 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
633         else
634                 return -EINVAL;
635 
636         if (IS_ERR(peer))
637                 return PTR_ERR(peer);
638 
639         msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
640         if (!msg) {
641                 err = -ENOMEM;
642                 goto out;
643         }
644 
645         id = peernet2id(net, peer);
646         err = rtnl_net_fill(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq, 0,
647                             RTM_NEWNSID, net, id);
648         if (err < 0)
649                 goto err_out;
650 
651         err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid);
652         goto out;
653 
654 err_out:
655         nlmsg_free(msg);
656 out:
657         put_net(peer);
658         return err;
659 }
660 
661 struct rtnl_net_dump_cb {
662         struct net *net;
663         struct sk_buff *skb;
664         struct netlink_callback *cb;
665         int idx;
666         int s_idx;
667 };
668 
669 static int rtnl_net_dumpid_one(int id, void *peer, void *data)
670 {
671         struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data;
672         int ret;
673 
674         if (net_cb->idx < net_cb->s_idx)
675                 goto cont;
676 
677         ret = rtnl_net_fill(net_cb->skb, NETLINK_CB(net_cb->cb->skb).portid,
678                             net_cb->cb->nlh->nlmsg_seq, NLM_F_MULTI,
679                             RTM_NEWNSID, net_cb->net, id);
680         if (ret < 0)
681                 return ret;
682 
683 cont:
684         net_cb->idx++;
685         return 0;
686 }
687 
688 static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
689 {
690         struct net *net = sock_net(skb->sk);
691         struct rtnl_net_dump_cb net_cb = {
692                 .net = net,
693                 .skb = skb,
694                 .cb = cb,
695                 .idx = 0,
696                 .s_idx = cb->args[0],
697         };
698         unsigned long flags;
699 
700         spin_lock_irqsave(&net->nsid_lock, flags);
701         idr_for_each(&net->netns_ids, rtnl_net_dumpid_one, &net_cb);
702         spin_unlock_irqrestore(&net->nsid_lock, flags);
703 
704         cb->args[0] = net_cb.idx;
705         return skb->len;
706 }
707 
708 static void rtnl_net_notifyid(struct net *net, int cmd, int id)
709 {
710         struct sk_buff *msg;
711         int err = -ENOMEM;
712 
713         msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
714         if (!msg)
715                 goto out;
716 
717         err = rtnl_net_fill(msg, 0, 0, 0, cmd, net, id);
718         if (err < 0)
719                 goto err_out;
720 
721         rtnl_notify(msg, net, 0, RTNLGRP_NSID, NULL, 0);
722         return;
723 
724 err_out:
725         nlmsg_free(msg);
726 out:
727         rtnl_set_sk_err(net, RTNLGRP_NSID, err);
728 }
729 
730 static int __init net_ns_init(void)
731 {
732         struct net_generic *ng;
733 
734 #ifdef CONFIG_NET_NS
735         net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
736                                         SMP_CACHE_BYTES,
737                                         SLAB_PANIC, NULL);
738 
739         /* Create workqueue for cleanup */
740         netns_wq = create_singlethread_workqueue("netns");
741         if (!netns_wq)
742                 panic("Could not create netns workq");
743 #endif
744 
745         ng = net_alloc_generic();
746         if (!ng)
747                 panic("Could not allocate generic netns");
748 
749         rcu_assign_pointer(init_net.gen, ng);
750 
751         mutex_lock(&net_mutex);
752         if (setup_net(&init_net, &init_user_ns))
753                 panic("Could not setup the initial network namespace");
754 
755         rtnl_lock();
756         list_add_tail_rcu(&init_net.list, &net_namespace_list);
757         rtnl_unlock();
758 
759         mutex_unlock(&net_mutex);
760 
761         register_pernet_subsys(&net_ns_ops);
762 
763         rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL, NULL);
764         rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid,
765                       NULL);
766 
767         return 0;
768 }
769 
770 pure_initcall(net_ns_init);
771 
772 #ifdef CONFIG_NET_NS
773 static int __register_pernet_operations(struct list_head *list,
774                                         struct pernet_operations *ops)
775 {
776         struct net *net;
777         int error;
778         LIST_HEAD(net_exit_list);
779 
780         list_add_tail(&ops->list, list);
781         if (ops->init || (ops->id && ops->size)) {
782                 for_each_net(net) {
783                         error = ops_init(ops, net);
784                         if (error)
785                                 goto out_undo;
786                         list_add_tail(&net->exit_list, &net_exit_list);
787                 }
788         }
789         return 0;
790 
791 out_undo:
792         /* If I have an error cleanup all namespaces I initialized */
793         list_del(&ops->list);
794         ops_exit_list(ops, &net_exit_list);
795         ops_free_list(ops, &net_exit_list);
796         return error;
797 }
798 
799 static void __unregister_pernet_operations(struct pernet_operations *ops)
800 {
801         struct net *net;
802         LIST_HEAD(net_exit_list);
803 
804         list_del(&ops->list);
805         for_each_net(net)
806                 list_add_tail(&net->exit_list, &net_exit_list);
807         ops_exit_list(ops, &net_exit_list);
808         ops_free_list(ops, &net_exit_list);
809 }
810 
811 #else
812 
813 static int __register_pernet_operations(struct list_head *list,
814                                         struct pernet_operations *ops)
815 {
816         return ops_init(ops, &init_net);
817 }
818 
819 static void __unregister_pernet_operations(struct pernet_operations *ops)
820 {
821         LIST_HEAD(net_exit_list);
822         list_add(&init_net.exit_list, &net_exit_list);
823         ops_exit_list(ops, &net_exit_list);
824         ops_free_list(ops, &net_exit_list);
825 }
826 
827 #endif /* CONFIG_NET_NS */
828 
829 static DEFINE_IDA(net_generic_ids);
830 
831 static int register_pernet_operations(struct list_head *list,
832                                       struct pernet_operations *ops)
833 {
834         int error;
835 
836         if (ops->id) {
837 again:
838                 error = ida_get_new_above(&net_generic_ids, 1, ops->id);
839                 if (error < 0) {
840                         if (error == -EAGAIN) {
841                                 ida_pre_get(&net_generic_ids, GFP_KERNEL);
842                                 goto again;
843                         }
844                         return error;
845                 }
846                 max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
847         }
848         error = __register_pernet_operations(list, ops);
849         if (error) {
850                 rcu_barrier();
851                 if (ops->id)
852                         ida_remove(&net_generic_ids, *ops->id);
853         }
854 
855         return error;
856 }
857 
858 static void unregister_pernet_operations(struct pernet_operations *ops)
859 {
860         
861         __unregister_pernet_operations(ops);
862         rcu_barrier();
863         if (ops->id)
864                 ida_remove(&net_generic_ids, *ops->id);
865 }
866 
867 /**
868  *      register_pernet_subsys - register a network namespace subsystem
869  *      @ops:  pernet operations structure for the subsystem
870  *
871  *      Register a subsystem which has init and exit functions
872  *      that are called when network namespaces are created and
873  *      destroyed respectively.
874  *
875  *      When registered all network namespace init functions are
876  *      called for every existing network namespace.  Allowing kernel
877  *      modules to have a race free view of the set of network namespaces.
878  *
879  *      When a new network namespace is created all of the init
880  *      methods are called in the order in which they were registered.
881  *
882  *      When a network namespace is destroyed all of the exit methods
883  *      are called in the reverse of the order with which they were
884  *      registered.
885  */
886 int register_pernet_subsys(struct pernet_operations *ops)
887 {
888         int error;
889         mutex_lock(&net_mutex);
890         error =  register_pernet_operations(first_device, ops);
891         mutex_unlock(&net_mutex);
892         return error;
893 }
894 EXPORT_SYMBOL_GPL(register_pernet_subsys);
895 
896 /**
897  *      unregister_pernet_subsys - unregister a network namespace subsystem
898  *      @ops: pernet operations structure to manipulate
899  *
900  *      Remove the pernet operations structure from the list to be
901  *      used when network namespaces are created or destroyed.  In
902  *      addition run the exit method for all existing network
903  *      namespaces.
904  */
905 void unregister_pernet_subsys(struct pernet_operations *ops)
906 {
907         mutex_lock(&net_mutex);
908         unregister_pernet_operations(ops);
909         mutex_unlock(&net_mutex);
910 }
911 EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
912 
913 /**
914  *      register_pernet_device - register a network namespace device
915  *      @ops:  pernet operations structure for the subsystem
916  *
917  *      Register a device which has init and exit functions
918  *      that are called when network namespaces are created and
919  *      destroyed respectively.
920  *
921  *      When registered all network namespace init functions are
922  *      called for every existing network namespace.  Allowing kernel
923  *      modules to have a race free view of the set of network namespaces.
924  *
925  *      When a new network namespace is created all of the init
926  *      methods are called in the order in which they were registered.
927  *
928  *      When a network namespace is destroyed all of the exit methods
929  *      are called in the reverse of the order with which they were
930  *      registered.
931  */
932 int register_pernet_device(struct pernet_operations *ops)
933 {
934         int error;
935         mutex_lock(&net_mutex);
936         error = register_pernet_operations(&pernet_list, ops);
937         if (!error && (first_device == &pernet_list))
938                 first_device = &ops->list;
939         mutex_unlock(&net_mutex);
940         return error;
941 }
942 EXPORT_SYMBOL_GPL(register_pernet_device);
943 
944 /**
945  *      unregister_pernet_device - unregister a network namespace netdevice
946  *      @ops: pernet operations structure to manipulate
947  *
948  *      Remove the pernet operations structure from the list to be
949  *      used when network namespaces are created or destroyed.  In
950  *      addition run the exit method for all existing network
951  *      namespaces.
952  */
953 void unregister_pernet_device(struct pernet_operations *ops)
954 {
955         mutex_lock(&net_mutex);
956         if (&ops->list == first_device)
957                 first_device = first_device->next;
958         unregister_pernet_operations(ops);
959         mutex_unlock(&net_mutex);
960 }
961 EXPORT_SYMBOL_GPL(unregister_pernet_device);
962 
963 #ifdef CONFIG_NET_NS
964 static struct ns_common *netns_get(struct task_struct *task)
965 {
966         struct net *net = NULL;
967         struct nsproxy *nsproxy;
968 
969         task_lock(task);
970         nsproxy = task->nsproxy;
971         if (nsproxy)
972                 net = get_net(nsproxy->net_ns);
973         task_unlock(task);
974 
975         return net ? &net->ns : NULL;
976 }
977 
978 static inline struct net *to_net_ns(struct ns_common *ns)
979 {
980         return container_of(ns, struct net, ns);
981 }
982 
983 static void netns_put(struct ns_common *ns)
984 {
985         put_net(to_net_ns(ns));
986 }
987 
988 static int netns_install(struct nsproxy *nsproxy, struct ns_common *ns)
989 {
990         struct net *net = to_net_ns(ns);
991 
992         if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
993             !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
994                 return -EPERM;
995 
996         put_net(nsproxy->net_ns);
997         nsproxy->net_ns = get_net(net);
998         return 0;
999 }
1000 
1001 const struct proc_ns_operations netns_operations = {
1002         .name           = "net",
1003         .type           = CLONE_NEWNET,
1004         .get            = netns_get,
1005         .put            = netns_put,
1006         .install        = netns_install,
1007 };
1008 #endif
1009 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp