Commit 98f842e6 authored by Eric W. Biederman's avatar Eric W. Biederman
Browse files

proc: Usable inode numbers for the namespace file descriptors. 



Assign a unique proc inode to each namespace, and use that
inode number to ensure we only allocate at most one proc
inode for every namespace in proc.

A single proc inode per namespace allows userspace to test
to see if two processes are in the same namespace.

This has been a long requested feature and only blocked because
a naive implementation would put the id in a global space and
would ultimately require having a namespace for the names of
namespaces, making migration and certain virtualization tricks
impossible.

We still don't have per superblock inode numbers for proc, which
appears necessary for application unaware checkpoint/restart and
migrations (if the application is using namespace file descriptors)
but that is now allowd by the design if it becomes important.

I have preallocated the ipc and uts initial proc inode numbers so
their structures can be statically initialized.

Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent bf056bfa

fs/mount.h

+1 −0
Original line number Diff line number Diff line
@@ -4,6 +4,7 @@ 


struct mnt_namespace {

	atomic_t		count;

	unsigned int		proc_inum;

	struct mount *	root;

	struct list_head	list;

	struct user_namespace	*user_ns;

fs/namespace.c

+14 −0
Original line number Diff line number Diff line
@@ -2301,6 +2301,7 @@ dput_out: 


static void free_mnt_ns(struct mnt_namespace *ns)

{

	proc_free_inum(ns->proc_inum);

	put_user_ns(ns->user_ns);

	kfree(ns);

}
@@ -2317,10 +2318,16 @@ static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1); 
static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)

{

	struct mnt_namespace *new_ns;

	int ret;



	new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL);

	if (!new_ns)

		return ERR_PTR(-ENOMEM);

	ret = proc_alloc_inum(&new_ns->proc_inum);

	if (ret) {

		kfree(new_ns);

		return ERR_PTR(ret);

	}

	new_ns->seq = atomic64_add_return(1, &mnt_ns_seq);

	atomic_set(&new_ns->count, 1);

	new_ns->root = NULL;
@@ -2799,10 +2806,17 @@ static int mntns_install(struct nsproxy *nsproxy, void *ns) 
	return 0;

}



static unsigned int mntns_inum(void *ns)

{

	struct mnt_namespace *mnt_ns = ns;

	return mnt_ns->proc_inum;

}



const struct proc_ns_operations mntns_operations = {

	.name		= "mnt",

	.type		= CLONE_NEWNS,

	.get		= mntns_get,

	.put		= mntns_put,

	.install	= mntns_install,

	.inum		= mntns_inum,

};

fs/proc/namespaces.c

+14 −10
Original line number Diff line number Diff line
@@ -82,7 +82,7 @@ static struct dentry *proc_ns_get_dentry(struct super_block *sb, 
		return ERR_PTR(-ENOMEM);

	}



	inode = new_inode(sb);

	inode = iget_locked(sb, ns_ops->inum(ns));

	if (!inode) {

		dput(dentry);

		ns_ops->put(ns);
@@ -90,13 +90,17 @@ static struct dentry *proc_ns_get_dentry(struct super_block *sb, 
	}



	ei = PROC_I(inode);

	inode->i_ino = get_next_ino();

	if (inode->i_state & I_NEW) {

		inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;

		inode->i_op = &ns_inode_operations;

		inode->i_mode = S_IFREG | S_IRUGO;

		inode->i_fop = &ns_file_operations;

		ei->ns_ops = ns_ops;

		ei->ns = ns;

		unlock_new_inode(inode);

	} else {

		ns_ops->put(ns);

	}



	d_set_d_op(dentry, &ns_dentry_operations);

	result = d_instantiate_unique(dentry, inode);
@@ -162,12 +166,12 @@ static int proc_ns_readlink(struct dentry *dentry, char __user *buffer, int bufl 
	if (!ns)

		goto out_put_task;



	snprintf(name, sizeof(name), "%s", ns_ops->name);

	snprintf(name, sizeof(name), "%s:[%u]", ns_ops->name, ns_ops->inum(ns));

	len = strlen(name);



	if (len > buflen)

		len = buflen;

	if (copy_to_user(buffer, ns_ops->name, len))

	if (copy_to_user(buffer, name, len))

		len = -EFAULT;



	ns_ops->put(ns);

include/linux/ipc_namespace.h

+2 −0
Original line number Diff line number Diff line
@@ -67,6 +67,8 @@ struct ipc_namespace { 


	/* user_ns which owns the ipc ns */

	struct user_namespace *user_ns;



	unsigned int	proc_inum;

};



extern struct ipc_namespace init_ipc_ns;

include/linux/pid_namespace.h

+1 −0
Original line number Diff line number Diff line
@@ -37,6 +37,7 @@ struct pid_namespace { 
	kgid_t pid_gid;

	int hide_pid;

	int reboot;	/* group exit code if this pidns was rebooted */

	unsigned int proc_inum;

};



extern struct pid_namespace init_pid_ns;

CRA Git | Maintained and supported by SUSTech CRA and CCSE