pid_namespace.c 7.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319
  1. /*
  2. * Pid namespaces
  3. *
  4. * Authors:
  5. * (C) 2007 Pavel Emelyanov <xemul@openvz.org>, OpenVZ, SWsoft Inc.
  6. * (C) 2007 Sukadev Bhattiprolu <sukadev@us.ibm.com>, IBM
  7. * Many thanks to Oleg Nesterov for comments and help
  8. *
  9. */
  10. #include <linux/pid.h>
  11. #include <linux/pid_namespace.h>
  12. #include <linux/user_namespace.h>
  13. #include <linux/syscalls.h>
  14. #include <linux/err.h>
  15. #include <linux/acct.h>
  16. #include <linux/slab.h>
  17. #include <linux/proc_fs.h>
  18. #include <linux/reboot.h>
  19. #include <linux/export.h>
  20. #define BITS_PER_PAGE (PAGE_SIZE*8)
  21. struct pid_cache {
  22. int nr_ids;
  23. char name[16];
  24. struct kmem_cache *cachep;
  25. struct list_head list;
  26. };
  27. static LIST_HEAD(pid_caches_lh);
  28. static DEFINE_MUTEX(pid_caches_mutex);
  29. static struct kmem_cache *pid_ns_cachep;
  30. /*
  31. * creates the kmem cache to allocate pids from.
  32. * @nr_ids: the number of numerical ids this pid will have to carry
  33. */
  34. static struct kmem_cache *create_pid_cachep(int nr_ids)
  35. {
  36. struct pid_cache *pcache;
  37. struct kmem_cache *cachep;
  38. mutex_lock(&pid_caches_mutex);
  39. list_for_each_entry(pcache, &pid_caches_lh, list)
  40. if (pcache->nr_ids == nr_ids)
  41. goto out;
  42. pcache = kmalloc(sizeof(struct pid_cache), GFP_KERNEL);
  43. if (pcache == NULL)
  44. goto err_alloc;
  45. snprintf(pcache->name, sizeof(pcache->name), "pid_%d", nr_ids);
  46. cachep = kmem_cache_create(pcache->name,
  47. sizeof(struct pid) + (nr_ids - 1) * sizeof(struct upid),
  48. 0, SLAB_HWCACHE_ALIGN, NULL);
  49. if (cachep == NULL)
  50. goto err_cachep;
  51. pcache->nr_ids = nr_ids;
  52. pcache->cachep = cachep;
  53. list_add(&pcache->list, &pid_caches_lh);
  54. out:
  55. mutex_unlock(&pid_caches_mutex);
  56. return pcache->cachep;
  57. err_cachep:
  58. kfree(pcache);
  59. err_alloc:
  60. mutex_unlock(&pid_caches_mutex);
  61. return NULL;
  62. }
  63. static void proc_cleanup_work(struct work_struct *work)
  64. {
  65. struct pid_namespace *ns = container_of(work, struct pid_namespace, proc_work);
  66. pid_ns_release_proc(ns);
  67. }
  68. /* MAX_PID_NS_LEVEL is needed for limiting size of 'struct pid' */
  69. #define MAX_PID_NS_LEVEL 32
  70. static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns,
  71. struct pid_namespace *parent_pid_ns)
  72. {
  73. struct pid_namespace *ns;
  74. unsigned int level = parent_pid_ns->level + 1;
  75. int i;
  76. int err;
  77. if (level > MAX_PID_NS_LEVEL) {
  78. err = -EINVAL;
  79. goto out;
  80. }
  81. err = -ENOMEM;
  82. ns = kmem_cache_zalloc(pid_ns_cachep, GFP_KERNEL);
  83. if (ns == NULL)
  84. goto out;
  85. ns->pidmap[0].page = kzalloc(PAGE_SIZE, GFP_KERNEL);
  86. if (!ns->pidmap[0].page)
  87. goto out_free;
  88. ns->pid_cachep = create_pid_cachep(level + 1);
  89. if (ns->pid_cachep == NULL)
  90. goto out_free_map;
  91. kref_init(&ns->kref);
  92. ns->level = level;
  93. ns->parent = get_pid_ns(parent_pid_ns);
  94. ns->user_ns = get_user_ns(user_ns);
  95. INIT_WORK(&ns->proc_work, proc_cleanup_work);
  96. set_bit(0, ns->pidmap[0].page);
  97. atomic_set(&ns->pidmap[0].nr_free, BITS_PER_PAGE - 1);
  98. for (i = 1; i < PIDMAP_ENTRIES; i++)
  99. atomic_set(&ns->pidmap[i].nr_free, BITS_PER_PAGE);
  100. return ns;
  101. out_free_map:
  102. kfree(ns->pidmap[0].page);
  103. out_free:
  104. kmem_cache_free(pid_ns_cachep, ns);
  105. out:
  106. return ERR_PTR(err);
  107. }
  108. static void destroy_pid_namespace(struct pid_namespace *ns)
  109. {
  110. int i;
  111. for (i = 0; i < PIDMAP_ENTRIES; i++)
  112. kfree(ns->pidmap[i].page);
  113. put_user_ns(ns->user_ns);
  114. kmem_cache_free(pid_ns_cachep, ns);
  115. }
  116. struct pid_namespace *copy_pid_ns(unsigned long flags,
  117. struct user_namespace *user_ns, struct pid_namespace *old_ns)
  118. {
  119. if (!(flags & CLONE_NEWPID))
  120. return get_pid_ns(old_ns);
  121. if (flags & (CLONE_THREAD|CLONE_PARENT))
  122. return ERR_PTR(-EINVAL);
  123. return create_pid_namespace(user_ns, old_ns);
  124. }
  125. static void free_pid_ns(struct kref *kref)
  126. {
  127. struct pid_namespace *ns;
  128. ns = container_of(kref, struct pid_namespace, kref);
  129. destroy_pid_namespace(ns);
  130. }
  131. void put_pid_ns(struct pid_namespace *ns)
  132. {
  133. struct pid_namespace *parent;
  134. while (ns != &init_pid_ns) {
  135. parent = ns->parent;
  136. if (!kref_put(&ns->kref, free_pid_ns))
  137. break;
  138. ns = parent;
  139. }
  140. }
  141. EXPORT_SYMBOL_GPL(put_pid_ns);
  142. void zap_pid_ns_processes(struct pid_namespace *pid_ns)
  143. {
  144. int nr;
  145. int rc;
  146. struct task_struct *task, *me = current;
  147. /* Ignore SIGCHLD causing any terminated children to autoreap */
  148. spin_lock_irq(&me->sighand->siglock);
  149. me->sighand->action[SIGCHLD - 1].sa.sa_handler = SIG_IGN;
  150. spin_unlock_irq(&me->sighand->siglock);
  151. /*
  152. * The last thread in the cgroup-init thread group is terminating.
  153. * Find remaining pid_ts in the namespace, signal and wait for them
  154. * to exit.
  155. *
  156. * Note: This signals each threads in the namespace - even those that
  157. * belong to the same thread group, To avoid this, we would have
  158. * to walk the entire tasklist looking a processes in this
  159. * namespace, but that could be unnecessarily expensive if the
  160. * pid namespace has just a few processes. Or we need to
  161. * maintain a tasklist for each pid namespace.
  162. *
  163. */
  164. read_lock(&tasklist_lock);
  165. nr = next_pidmap(pid_ns, 1);
  166. while (nr > 0) {
  167. rcu_read_lock();
  168. task = pid_task(find_vpid(nr), PIDTYPE_PID);
  169. if (task && !__fatal_signal_pending(task))
  170. send_sig_info(SIGKILL, SEND_SIG_FORCED, task);
  171. rcu_read_unlock();
  172. nr = next_pidmap(pid_ns, nr);
  173. }
  174. read_unlock(&tasklist_lock);
  175. /* Firstly reap the EXIT_ZOMBIE children we may have. */
  176. do {
  177. clear_thread_flag(TIF_SIGPENDING);
  178. rc = sys_wait4(-1, NULL, __WALL, NULL);
  179. } while (rc != -ECHILD);
  180. /*
  181. * sys_wait4() above can't reap the TASK_DEAD children.
  182. * Make sure they all go away, see __unhash_process().
  183. */
  184. for (;;) {
  185. bool need_wait = false;
  186. read_lock(&tasklist_lock);
  187. if (!list_empty(&current->children)) {
  188. __set_current_state(TASK_UNINTERRUPTIBLE);
  189. need_wait = true;
  190. }
  191. read_unlock(&tasklist_lock);
  192. if (!need_wait)
  193. break;
  194. schedule();
  195. }
  196. if (pid_ns->reboot)
  197. current->signal->group_exit_code = pid_ns->reboot;
  198. acct_exit_ns(pid_ns);
  199. return;
  200. }
  201. #ifdef CONFIG_CHECKPOINT_RESTORE
  202. static int pid_ns_ctl_handler(struct ctl_table *table, int write,
  203. void __user *buffer, size_t *lenp, loff_t *ppos)
  204. {
  205. struct pid_namespace *pid_ns = task_active_pid_ns(current);
  206. struct ctl_table tmp = *table;
  207. if (write && !ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN))
  208. return -EPERM;
  209. /*
  210. * Writing directly to ns' last_pid field is OK, since this field
  211. * is volatile in a living namespace anyway and a code writing to
  212. * it should synchronize its usage with external means.
  213. */
  214. tmp.data = &pid_ns->last_pid;
  215. return proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
  216. }
  217. extern int pid_max;
  218. static int zero = 0;
  219. static struct ctl_table pid_ns_ctl_table[] = {
  220. {
  221. .procname = "ns_last_pid",
  222. .maxlen = sizeof(int),
  223. .mode = 0666, /* permissions are checked in the handler */
  224. .proc_handler = pid_ns_ctl_handler,
  225. .extra1 = &zero,
  226. .extra2 = &pid_max,
  227. },
  228. { }
  229. };
  230. static struct ctl_path kern_path[] = { { .procname = "kernel", }, { } };
  231. #endif /* CONFIG_CHECKPOINT_RESTORE */
  232. int reboot_pid_ns(struct pid_namespace *pid_ns, int cmd)
  233. {
  234. if (pid_ns == &init_pid_ns)
  235. return 0;
  236. switch (cmd) {
  237. case LINUX_REBOOT_CMD_RESTART2:
  238. case LINUX_REBOOT_CMD_RESTART:
  239. pid_ns->reboot = SIGHUP;
  240. break;
  241. case LINUX_REBOOT_CMD_POWER_OFF:
  242. case LINUX_REBOOT_CMD_HALT:
  243. pid_ns->reboot = SIGINT;
  244. break;
  245. default:
  246. return -EINVAL;
  247. }
  248. read_lock(&tasklist_lock);
  249. force_sig(SIGKILL, pid_ns->child_reaper);
  250. read_unlock(&tasklist_lock);
  251. do_exit(0);
  252. /* Not reached */
  253. return 0;
  254. }
  255. static __init int pid_namespaces_init(void)
  256. {
  257. pid_ns_cachep = KMEM_CACHE(pid_namespace, SLAB_PANIC);
  258. #ifdef CONFIG_CHECKPOINT_RESTORE
  259. register_sysctl_paths(kern_path, pid_ns_ctl_table);
  260. #endif
  261. return 0;
  262. }
  263. __initcall(pid_namespaces_init);