Commit dc55e35f authored by Alexey Gladkov's avatar Alexey Gladkov Committed by Eric W. Biederman
Browse files

ipc: Store mqueue sysctls in the ipc namespace 



Right now, the mqueue sysctls take ipc namespaces into account in a
rather hacky way. This works in most cases, but does not respect the
user namespace.

Within the user namespace, the user cannot change the /proc/sys/fs/mqueue/*
parametres. This poses a problem in the rootless containers.

To solve this I changed the implementation of the mqueue sysctls just
like some other sysctls.

So far, the changes do not provide additional access to files. This will
be done in a future patch.

v3:
* Don't implemenet set_permissions to keep the current behavior.

v2:
* Fixed compilation problem if CONFIG_POSIX_MQUEUE_SYSCTL is not
  specified.

Reported-by: default avatarkernel test robot <lkp@intel.com>
Signed-off-by: default avatarAlexey Gladkov <legion@kernel.org>
Link: https://lkml.kernel.org/r/b0ccbb2489119f1f20c737cf1930c3a9c4e4243a.1644862280.git.legion@kernel.org


Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent ffb217a1

include/linux/ipc_namespace.h

+12 −4
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
#include <linux/ns_common.h>

#include <linux/refcount.h>

#include <linux/rhashtable-types.h>

#include <linux/sysctl.h>



struct user_namespace;
@@ -63,6 +64,9 @@ struct ipc_namespace { 
	unsigned int    mq_msg_default;

	unsigned int    mq_msgsize_default;



	struct ctl_table_set	mq_set;

	struct ctl_table_header	*mq_sysctls;



	/* user_ns which owns the ipc ns */

	struct user_namespace *user_ns;

	struct ucounts *ucounts;
@@ -169,14 +173,18 @@ static inline void put_ipc_ns(struct ipc_namespace *ns) 


#ifdef CONFIG_POSIX_MQUEUE_SYSCTL



struct ctl_table_header;

extern struct ctl_table_header *mq_register_sysctl_table(void);

void retire_mq_sysctls(struct ipc_namespace *ns);

bool setup_mq_sysctls(struct ipc_namespace *ns);



#else /* CONFIG_POSIX_MQUEUE_SYSCTL */



static inline struct ctl_table_header *mq_register_sysctl_table(void)

static inline void retire_mq_sysctls(struct ipc_namespace *ns)

{

	return NULL;

}



static inline bool setup_mq_sysctls(struct ipc_namespace *ns)

{

	return true;

}



#endif /* CONFIG_POSIX_MQUEUE_SYSCTL */

ipc/mq_sysctl.c

+66 −55
Original line number Diff line number Diff line
@@ -9,39 +9,9 @@ 
#include <linux/ipc_namespace.h>

#include <linux/sysctl.h>



#ifdef CONFIG_PROC_SYSCTL

static void *get_mq(struct ctl_table *table)

{

	char *which = table->data;

	struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;

	which = (which - (char *)&init_ipc_ns) + (char *)ipc_ns;

	return which;

}



static int proc_mq_dointvec(struct ctl_table *table, int write,

			    void *buffer, size_t *lenp, loff_t *ppos)

{

	struct ctl_table mq_table;

	memcpy(&mq_table, table, sizeof(mq_table));

	mq_table.data = get_mq(table);



	return proc_dointvec(&mq_table, write, buffer, lenp, ppos);

}



static int proc_mq_dointvec_minmax(struct ctl_table *table, int write,

		void *buffer, size_t *lenp, loff_t *ppos)

{

	struct ctl_table mq_table;

	memcpy(&mq_table, table, sizeof(mq_table));

	mq_table.data = get_mq(table);



	return proc_dointvec_minmax(&mq_table, write, buffer,

					lenp, ppos);

}

#else

#define proc_mq_dointvec NULL

#define proc_mq_dointvec_minmax NULL

#endif

#include <linux/stat.h>

#include <linux/capability.h>

#include <linux/slab.h>



static int msg_max_limit_min = MIN_MSGMAX;

static int msg_max_limit_max = HARD_MSGMAX;
@@ -55,14 +25,14 @@ static struct ctl_table mq_sysctls[] = { 
		.data		= &init_ipc_ns.mq_queues_max,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_mq_dointvec,

		.proc_handler	= proc_dointvec,

	},

	{

		.procname	= "msg_max",

		.data		= &init_ipc_ns.mq_msg_max,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_mq_dointvec_minmax,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &msg_max_limit_min,

		.extra2		= &msg_max_limit_max,

	},
@@ -71,7 +41,7 @@ static struct ctl_table mq_sysctls[] = { 
		.data		= &init_ipc_ns.mq_msgsize_max,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_mq_dointvec_minmax,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &msg_maxsize_limit_min,

		.extra2		= &msg_maxsize_limit_max,

	},
@@ -80,7 +50,7 @@ static struct ctl_table mq_sysctls[] = { 
		.data		= &init_ipc_ns.mq_msg_default,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_mq_dointvec_minmax,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &msg_max_limit_min,

		.extra2		= &msg_max_limit_max,

	},
@@ -89,32 +59,73 @@ static struct ctl_table mq_sysctls[] = { 
		.data		= &init_ipc_ns.mq_msgsize_default,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_mq_dointvec_minmax,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &msg_maxsize_limit_min,

		.extra2		= &msg_maxsize_limit_max,

	},

	{}

};



static struct ctl_table mq_sysctl_dir[] = {

static struct ctl_table_set *set_lookup(struct ctl_table_root *root)

{

		.procname	= "mqueue",

		.mode		= 0555,

		.child		= mq_sysctls,

	},

	{}

};

	return &current->nsproxy->ipc_ns->mq_set;

}



static struct ctl_table mq_sysctl_root[] = {

static int set_is_seen(struct ctl_table_set *set)

{

		.procname	= "fs",

		.mode		= 0555,

		.child		= mq_sysctl_dir,

	},

	{}

	return &current->nsproxy->ipc_ns->mq_set == set;

}



static struct ctl_table_root set_root = {

	.lookup = set_lookup,

};



struct ctl_table_header *mq_register_sysctl_table(void)

bool setup_mq_sysctls(struct ipc_namespace *ns)

{

	return register_sysctl_table(mq_sysctl_root);

	struct ctl_table *tbl;



	setup_sysctl_set(&ns->mq_set, &set_root, set_is_seen);



	tbl = kmemdup(mq_sysctls, sizeof(mq_sysctls), GFP_KERNEL);

	if (tbl) {

		int i;



		for (i = 0; i < ARRAY_SIZE(mq_sysctls); i++) {

			if (tbl[i].data == &init_ipc_ns.mq_queues_max)

				tbl[i].data = &ns->mq_queues_max;



			else if (tbl[i].data == &init_ipc_ns.mq_msg_max)

				tbl[i].data = &ns->mq_msg_max;



			else if (tbl[i].data == &init_ipc_ns.mq_msgsize_max)

				tbl[i].data = &ns->mq_msgsize_max;



			else if (tbl[i].data == &init_ipc_ns.mq_msg_default)

				tbl[i].data = &ns->mq_msg_default;



			else if (tbl[i].data == &init_ipc_ns.mq_msgsize_default)

				tbl[i].data = &ns->mq_msgsize_default;

			else

				tbl[i].data = NULL;

		}



		ns->mq_sysctls = __register_sysctl_table(&ns->mq_set, "fs/mqueue", tbl);

	}

	if (!ns->mq_sysctls) {

		kfree(tbl);

		retire_sysctl_set(&ns->mq_set);

		return false;

	}



	return true;

}



void retire_mq_sysctls(struct ipc_namespace *ns)

{

	struct ctl_table *tbl;



	tbl = ns->mq_sysctls->ctl_table_arg;

	unregister_sysctl_table(ns->mq_sysctls);

	retire_sysctl_set(&ns->mq_set);

	kfree(tbl);

}

ipc/mqueue.c

+4 −6
Original line number Diff line number Diff line
@@ -163,8 +163,6 @@ static void remove_notification(struct mqueue_inode_info *info); 


static struct kmem_cache *mqueue_inode_cachep;



static struct ctl_table_header *mq_sysctl_table;



static inline struct mqueue_inode_info *MQUEUE_I(struct inode *inode)

{

	return container_of(inode, struct mqueue_inode_info, vfs_inode);
@@ -1713,8 +1711,10 @@ static int __init init_mqueue_fs(void) 
	if (mqueue_inode_cachep == NULL)

		return -ENOMEM;



	/* ignore failures - they are not fatal */

	mq_sysctl_table = mq_register_sysctl_table();

	if (!setup_mq_sysctls(&init_ipc_ns)) {

		pr_warn("sysctl registration failed\n");

		return -ENOMEM;

	}



	error = register_filesystem(&mqueue_fs_type);

	if (error)
@@ -1731,8 +1731,6 @@ static int __init init_mqueue_fs(void) 
out_filesystem:

	unregister_filesystem(&mqueue_fs_type);

out_sysctl:

	if (mq_sysctl_table)

		unregister_sysctl_table(mq_sysctl_table);

	kmem_cache_destroy(mqueue_inode_cachep);

	return error;

}

ipc/namespace.c

+6 −0
Original line number Diff line number Diff line
@@ -59,6 +59,10 @@ static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns, 
	if (err)

		goto fail_put;



	err = -ENOMEM;

	if (!setup_mq_sysctls(ns))

		goto fail_put;



	sem_init_ns(ns);

	msg_init_ns(ns);

	shm_init_ns(ns);
@@ -125,6 +129,8 @@ static void free_ipc_ns(struct ipc_namespace *ns) 
	msg_exit_ns(ns);

	shm_exit_ns(ns);



	retire_mq_sysctls(ns);



	dec_ipc_namespaces(ns->ucounts);

	put_user_ns(ns->user_ns);

	ns_free_inum(&ns->ns);