1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  Copyright (C) 2007
4  *
5  *  Author: Eric Biederman <ebiederm@xmision.com>
6  */
7 
8 #include <linux/module.h>
9 #include <linux/ipc.h>
10 #include <linux/nsproxy.h>
11 #include <linux/sysctl.h>
12 #include <linux/uaccess.h>
13 #include <linux/capability.h>
14 #include <linux/ipc_namespace.h>
15 #include <linux/msg.h>
16 #include <linux/slab.h>
17 #include <linux/cred.h>
18 #include "util.h"
19 
proc_ipc_dointvec_minmax_orphans(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)20 static int proc_ipc_dointvec_minmax_orphans(const struct ctl_table *table, int write,
21 		void *buffer, size_t *lenp, loff_t *ppos)
22 {
23 	struct ipc_namespace *ns =
24 		container_of(table->data, struct ipc_namespace, shm_rmid_forced);
25 	int err;
26 
27 	err = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
28 
29 	if (err < 0)
30 		return err;
31 	if (ns->shm_rmid_forced)
32 		shm_destroy_orphaned(ns);
33 	return err;
34 }
35 
proc_ipc_auto_msgmni(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)36 static int proc_ipc_auto_msgmni(const struct ctl_table *table, int write,
37 		void *buffer, size_t *lenp, loff_t *ppos)
38 {
39 	struct ctl_table ipc_table;
40 	int dummy = 0;
41 
42 	memcpy(&ipc_table, table, sizeof(ipc_table));
43 	ipc_table.data = &dummy;
44 
45 	if (write)
46 		pr_info_once("writing to auto_msgmni has no effect");
47 
48 	return proc_dointvec_minmax(&ipc_table, write, buffer, lenp, ppos);
49 }
50 
proc_ipc_sem_dointvec(const struct ctl_table * table,int write,void * buffer,size_t * lenp,loff_t * ppos)51 static int proc_ipc_sem_dointvec(const struct ctl_table *table, int write,
52 	void *buffer, size_t *lenp, loff_t *ppos)
53 {
54 	struct ipc_namespace *ns =
55 		container_of(table->data, struct ipc_namespace, sem_ctls);
56 	int ret, semmni;
57 
58 	semmni = ns->sem_ctls[3];
59 	ret = proc_dointvec(table, write, buffer, lenp, ppos);
60 
61 	if (!ret)
62 		ret = sem_check_semmni(ns);
63 
64 	/*
65 	 * Reset the semmni value if an error happens.
66 	 */
67 	if (ret)
68 		ns->sem_ctls[3] = semmni;
69 	return ret;
70 }
71 
72 int ipc_mni = IPCMNI;
73 int ipc_mni_shift = IPCMNI_SHIFT;
74 int ipc_min_cycle = RADIX_TREE_MAP_SIZE;
75 
76 static struct ctl_table ipc_sysctls[] = {
77 	{
78 		.procname	= "shmmax",
79 		.data		= &init_ipc_ns.shm_ctlmax,
80 		.maxlen		= sizeof(init_ipc_ns.shm_ctlmax),
81 		.mode		= 0644,
82 		.proc_handler	= proc_doulongvec_minmax,
83 	},
84 	{
85 		.procname	= "shmall",
86 		.data		= &init_ipc_ns.shm_ctlall,
87 		.maxlen		= sizeof(init_ipc_ns.shm_ctlall),
88 		.mode		= 0644,
89 		.proc_handler	= proc_doulongvec_minmax,
90 	},
91 	{
92 		.procname	= "shmmni",
93 		.data		= &init_ipc_ns.shm_ctlmni,
94 		.maxlen		= sizeof(init_ipc_ns.shm_ctlmni),
95 		.mode		= 0644,
96 		.proc_handler	= proc_dointvec_minmax,
97 		.extra1		= SYSCTL_ZERO,
98 		.extra2		= &ipc_mni,
99 	},
100 	{
101 		.procname	= "shm_rmid_forced",
102 		.data		= &init_ipc_ns.shm_rmid_forced,
103 		.maxlen		= sizeof(init_ipc_ns.shm_rmid_forced),
104 		.mode		= 0644,
105 		.proc_handler	= proc_ipc_dointvec_minmax_orphans,
106 		.extra1		= SYSCTL_ZERO,
107 		.extra2		= SYSCTL_ONE,
108 	},
109 	{
110 		.procname	= "msgmax",
111 		.data		= &init_ipc_ns.msg_ctlmax,
112 		.maxlen		= sizeof(init_ipc_ns.msg_ctlmax),
113 		.mode		= 0644,
114 		.proc_handler	= proc_dointvec_minmax,
115 		.extra1		= SYSCTL_ZERO,
116 		.extra2		= SYSCTL_INT_MAX,
117 	},
118 	{
119 		.procname	= "msgmni",
120 		.data		= &init_ipc_ns.msg_ctlmni,
121 		.maxlen		= sizeof(init_ipc_ns.msg_ctlmni),
122 		.mode		= 0644,
123 		.proc_handler	= proc_dointvec_minmax,
124 		.extra1		= SYSCTL_ZERO,
125 		.extra2		= &ipc_mni,
126 	},
127 	{
128 		.procname	= "auto_msgmni",
129 		.data		= NULL,
130 		.maxlen		= sizeof(int),
131 		.mode		= 0644,
132 		.proc_handler	= proc_ipc_auto_msgmni,
133 		.extra1		= SYSCTL_ZERO,
134 		.extra2		= SYSCTL_ONE,
135 	},
136 	{
137 		.procname	=  "msgmnb",
138 		.data		= &init_ipc_ns.msg_ctlmnb,
139 		.maxlen		= sizeof(init_ipc_ns.msg_ctlmnb),
140 		.mode		= 0644,
141 		.proc_handler	= proc_dointvec_minmax,
142 		.extra1		= SYSCTL_ZERO,
143 		.extra2		= SYSCTL_INT_MAX,
144 	},
145 	{
146 		.procname	= "sem",
147 		.data		= &init_ipc_ns.sem_ctls,
148 		.maxlen		= 4*sizeof(int),
149 		.mode		= 0644,
150 		.proc_handler	= proc_ipc_sem_dointvec,
151 	},
152 #ifdef CONFIG_CHECKPOINT_RESTORE
153 	{
154 		.procname	= "sem_next_id",
155 		.data		= &init_ipc_ns.ids[IPC_SEM_IDS].next_id,
156 		.maxlen		= sizeof(init_ipc_ns.ids[IPC_SEM_IDS].next_id),
157 		.mode		= 0444,
158 		.proc_handler	= proc_dointvec_minmax,
159 		.extra1		= SYSCTL_ZERO,
160 		.extra2		= SYSCTL_INT_MAX,
161 	},
162 	{
163 		.procname	= "msg_next_id",
164 		.data		= &init_ipc_ns.ids[IPC_MSG_IDS].next_id,
165 		.maxlen		= sizeof(init_ipc_ns.ids[IPC_MSG_IDS].next_id),
166 		.mode		= 0444,
167 		.proc_handler	= proc_dointvec_minmax,
168 		.extra1		= SYSCTL_ZERO,
169 		.extra2		= SYSCTL_INT_MAX,
170 	},
171 	{
172 		.procname	= "shm_next_id",
173 		.data		= &init_ipc_ns.ids[IPC_SHM_IDS].next_id,
174 		.maxlen		= sizeof(init_ipc_ns.ids[IPC_SHM_IDS].next_id),
175 		.mode		= 0444,
176 		.proc_handler	= proc_dointvec_minmax,
177 		.extra1		= SYSCTL_ZERO,
178 		.extra2		= SYSCTL_INT_MAX,
179 	},
180 #endif
181 };
182 
set_lookup(struct ctl_table_root * root)183 static struct ctl_table_set *set_lookup(struct ctl_table_root *root)
184 {
185 	return &current->nsproxy->ipc_ns->ipc_set;
186 }
187 
set_is_seen(struct ctl_table_set * set)188 static int set_is_seen(struct ctl_table_set *set)
189 {
190 	return &current->nsproxy->ipc_ns->ipc_set == set;
191 }
192 
ipc_set_ownership(struct ctl_table_header * head,kuid_t * uid,kgid_t * gid)193 static void ipc_set_ownership(struct ctl_table_header *head,
194 			      kuid_t *uid, kgid_t *gid)
195 {
196 	struct ipc_namespace *ns =
197 		container_of(head->set, struct ipc_namespace, ipc_set);
198 
199 	kuid_t ns_root_uid = make_kuid(ns->user_ns, 0);
200 	kgid_t ns_root_gid = make_kgid(ns->user_ns, 0);
201 
202 	*uid = uid_valid(ns_root_uid) ? ns_root_uid : GLOBAL_ROOT_UID;
203 	*gid = gid_valid(ns_root_gid) ? ns_root_gid : GLOBAL_ROOT_GID;
204 }
205 
ipc_permissions(struct ctl_table_header * head,const struct ctl_table * table)206 static int ipc_permissions(struct ctl_table_header *head, const struct ctl_table *table)
207 {
208 	int mode = table->mode;
209 
210 #ifdef CONFIG_CHECKPOINT_RESTORE
211 	struct ipc_namespace *ns =
212 		container_of(head->set, struct ipc_namespace, ipc_set);
213 
214 	if (((table->data == &ns->ids[IPC_SEM_IDS].next_id) ||
215 	     (table->data == &ns->ids[IPC_MSG_IDS].next_id) ||
216 	     (table->data == &ns->ids[IPC_SHM_IDS].next_id)) &&
217 	    checkpoint_restore_ns_capable(ns->user_ns))
218 		mode = 0666;
219 	else
220 #endif
221 	{
222 		kuid_t ns_root_uid;
223 		kgid_t ns_root_gid;
224 
225 		ipc_set_ownership(head, &ns_root_uid, &ns_root_gid);
226 
227 		if (uid_eq(current_euid(), ns_root_uid))
228 			mode >>= 6;
229 
230 		else if (in_egroup_p(ns_root_gid))
231 			mode >>= 3;
232 	}
233 
234 	mode &= 7;
235 
236 	return (mode << 6) | (mode << 3) | mode;
237 }
238 
239 static struct ctl_table_root set_root = {
240 	.lookup = set_lookup,
241 	.permissions = ipc_permissions,
242 	.set_ownership = ipc_set_ownership,
243 };
244 
setup_ipc_sysctls(struct ipc_namespace * ns)245 bool setup_ipc_sysctls(struct ipc_namespace *ns)
246 {
247 	struct ctl_table *tbl;
248 
249 	setup_sysctl_set(&ns->ipc_set, &set_root, set_is_seen);
250 
251 	tbl = kmemdup(ipc_sysctls, sizeof(ipc_sysctls), GFP_KERNEL);
252 	if (tbl) {
253 		int i;
254 
255 		for (i = 0; i < ARRAY_SIZE(ipc_sysctls); i++) {
256 			if (tbl[i].data == &init_ipc_ns.shm_ctlmax)
257 				tbl[i].data = &ns->shm_ctlmax;
258 
259 			else if (tbl[i].data == &init_ipc_ns.shm_ctlall)
260 				tbl[i].data = &ns->shm_ctlall;
261 
262 			else if (tbl[i].data == &init_ipc_ns.shm_ctlmni)
263 				tbl[i].data = &ns->shm_ctlmni;
264 
265 			else if (tbl[i].data == &init_ipc_ns.shm_rmid_forced)
266 				tbl[i].data = &ns->shm_rmid_forced;
267 
268 			else if (tbl[i].data == &init_ipc_ns.msg_ctlmax)
269 				tbl[i].data = &ns->msg_ctlmax;
270 
271 			else if (tbl[i].data == &init_ipc_ns.msg_ctlmni)
272 				tbl[i].data = &ns->msg_ctlmni;
273 
274 			else if (tbl[i].data == &init_ipc_ns.msg_ctlmnb)
275 				tbl[i].data = &ns->msg_ctlmnb;
276 
277 			else if (tbl[i].data == &init_ipc_ns.sem_ctls)
278 				tbl[i].data = &ns->sem_ctls;
279 #ifdef CONFIG_CHECKPOINT_RESTORE
280 			else if (tbl[i].data == &init_ipc_ns.ids[IPC_SEM_IDS].next_id)
281 				tbl[i].data = &ns->ids[IPC_SEM_IDS].next_id;
282 
283 			else if (tbl[i].data == &init_ipc_ns.ids[IPC_MSG_IDS].next_id)
284 				tbl[i].data = &ns->ids[IPC_MSG_IDS].next_id;
285 
286 			else if (tbl[i].data == &init_ipc_ns.ids[IPC_SHM_IDS].next_id)
287 				tbl[i].data = &ns->ids[IPC_SHM_IDS].next_id;
288 #endif
289 			else
290 				tbl[i].data = NULL;
291 		}
292 
293 		ns->ipc_sysctls = __register_sysctl_table(&ns->ipc_set, "kernel", tbl,
294 							  ARRAY_SIZE(ipc_sysctls));
295 	}
296 	if (!ns->ipc_sysctls) {
297 		kfree(tbl);
298 		retire_sysctl_set(&ns->ipc_set);
299 		return false;
300 	}
301 
302 	return true;
303 }
304 
retire_ipc_sysctls(struct ipc_namespace * ns)305 void retire_ipc_sysctls(struct ipc_namespace *ns)
306 {
307 	const struct ctl_table *tbl;
308 
309 	tbl = ns->ipc_sysctls->ctl_table_arg;
310 	unregister_sysctl_table(ns->ipc_sysctls);
311 	retire_sysctl_set(&ns->ipc_set);
312 	kfree(tbl);
313 }
314 
ipc_sysctl_init(void)315 static int __init ipc_sysctl_init(void)
316 {
317 	if (!setup_ipc_sysctls(&init_ipc_ns)) {
318 		pr_warn("ipc sysctl registration failed\n");
319 		return -ENOMEM;
320 	}
321 	return 0;
322 }
323 
324 device_initcall(ipc_sysctl_init);
325 
ipc_mni_extend(char * str)326 static int __init ipc_mni_extend(char *str)
327 {
328 	ipc_mni = IPCMNI_EXTEND;
329 	ipc_mni_shift = IPCMNI_EXTEND_SHIFT;
330 	ipc_min_cycle = IPCMNI_EXTEND_MIN_CYCLE;
331 	pr_info("IPCMNI extended to %d.\n", ipc_mni);
332 	return 0;
333 }
334 early_param("ipcmni_extend", ipc_mni_extend);
335