1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/anon_inodes.h>
3 #include <linux/file.h>
4 #include <linux/fs.h>
5 #include <linux/magic.h>
6 #include <linux/mount.h>
7 #include <linux/pid.h>
8 #include <linux/pidfs.h>
9 #include <linux/pid_namespace.h>
10 #include <linux/poll.h>
11 #include <linux/proc_fs.h>
12 #include <linux/proc_ns.h>
13 #include <linux/pseudo_fs.h>
14 #include <linux/ptrace.h>
15 #include <linux/seq_file.h>
16 #include <uapi/linux/pidfd.h>
17 #include <linux/ipc_namespace.h>
18 #include <linux/time_namespace.h>
19 #include <linux/utsname.h>
20 #include <net/net_namespace.h>
21
22 #include "internal.h"
23 #include "mount.h"
24
25 #ifdef CONFIG_PROC_FS
26 /**
27 * pidfd_show_fdinfo - print information about a pidfd
28 * @m: proc fdinfo file
29 * @f: file referencing a pidfd
30 *
31 * Pid:
32 * This function will print the pid that a given pidfd refers to in the
33 * pid namespace of the procfs instance.
34 * If the pid namespace of the process is not a descendant of the pid
35 * namespace of the procfs instance 0 will be shown as its pid. This is
36 * similar to calling getppid() on a process whose parent is outside of
37 * its pid namespace.
38 *
39 * NSpid:
40 * If pid namespaces are supported then this function will also print
41 * the pid of a given pidfd refers to for all descendant pid namespaces
42 * starting from the current pid namespace of the instance, i.e. the
43 * Pid field and the first entry in the NSpid field will be identical.
44 * If the pid namespace of the process is not a descendant of the pid
45 * namespace of the procfs instance 0 will be shown as its first NSpid
46 * entry and no others will be shown.
47 * Note that this differs from the Pid and NSpid fields in
48 * /proc/<pid>/status where Pid and NSpid are always shown relative to
49 * the pid namespace of the procfs instance. The difference becomes
50 * obvious when sending around a pidfd between pid namespaces from a
51 * different branch of the tree, i.e. where no ancestral relation is
52 * present between the pid namespaces:
53 * - create two new pid namespaces ns1 and ns2 in the initial pid
54 * namespace (also take care to create new mount namespaces in the
55 * new pid namespace and mount procfs)
56 * - create a process with a pidfd in ns1
57 * - send pidfd from ns1 to ns2
58 * - read /proc/self/fdinfo/<pidfd> and observe that both Pid and NSpid
59 * have exactly one entry, which is 0
60 */
pidfd_show_fdinfo(struct seq_file * m,struct file * f)61 static void pidfd_show_fdinfo(struct seq_file *m, struct file *f)
62 {
63 struct pid *pid = pidfd_pid(f);
64 struct pid_namespace *ns;
65 pid_t nr = -1;
66
67 if (likely(pid_has_task(pid, PIDTYPE_PID))) {
68 ns = proc_pid_ns(file_inode(m->file)->i_sb);
69 nr = pid_nr_ns(pid, ns);
70 }
71
72 seq_put_decimal_ll(m, "Pid:\t", nr);
73
74 #ifdef CONFIG_PID_NS
75 seq_put_decimal_ll(m, "\nNSpid:\t", nr);
76 if (nr > 0) {
77 int i;
78
79 /* If nr is non-zero it means that 'pid' is valid and that
80 * ns, i.e. the pid namespace associated with the procfs
81 * instance, is in the pid namespace hierarchy of pid.
82 * Start at one below the already printed level.
83 */
84 for (i = ns->level + 1; i <= pid->level; i++)
85 seq_put_decimal_ll(m, "\t", pid->numbers[i].nr);
86 }
87 #endif
88 seq_putc(m, '\n');
89 }
90 #endif
91
92 /*
93 * Poll support for process exit notification.
94 */
pidfd_poll(struct file * file,struct poll_table_struct * pts)95 static __poll_t pidfd_poll(struct file *file, struct poll_table_struct *pts)
96 {
97 struct pid *pid = pidfd_pid(file);
98 struct task_struct *task;
99 __poll_t poll_flags = 0;
100
101 poll_wait(file, &pid->wait_pidfd, pts);
102 /*
103 * Don't wake waiters if the thread-group leader exited
104 * prematurely. They either get notified when the last subthread
105 * exits or not at all if one of the remaining subthreads execs
106 * and assumes the struct pid of the old thread-group leader.
107 */
108 guard(rcu)();
109 task = pid_task(pid, PIDTYPE_PID);
110 if (!task)
111 poll_flags = EPOLLIN | EPOLLRDNORM | EPOLLHUP;
112 else if (task->exit_state && !delay_group_leader(task))
113 poll_flags = EPOLLIN | EPOLLRDNORM;
114
115 return poll_flags;
116 }
117
pidfd_ioctl(struct file * file,unsigned int cmd,unsigned long arg)118 static long pidfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
119 {
120 struct task_struct *task __free(put_task) = NULL;
121 struct nsproxy *nsp __free(put_nsproxy) = NULL;
122 struct pid *pid = pidfd_pid(file);
123 struct ns_common *ns_common = NULL;
124 struct pid_namespace *pid_ns;
125
126 if (arg)
127 return -EINVAL;
128
129 task = get_pid_task(pid, PIDTYPE_PID);
130 if (!task)
131 return -ESRCH;
132
133 scoped_guard(task_lock, task) {
134 nsp = task->nsproxy;
135 if (nsp)
136 get_nsproxy(nsp);
137 }
138 if (!nsp)
139 return -ESRCH; /* just pretend it didn't exist */
140
141 /*
142 * We're trying to open a file descriptor to the namespace so perform a
143 * filesystem cred ptrace check. Also, we mirror nsfs behavior.
144 */
145 if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
146 return -EACCES;
147
148 switch (cmd) {
149 /* Namespaces that hang of nsproxy. */
150 case PIDFD_GET_CGROUP_NAMESPACE:
151 if (IS_ENABLED(CONFIG_CGROUPS)) {
152 get_cgroup_ns(nsp->cgroup_ns);
153 ns_common = to_ns_common(nsp->cgroup_ns);
154 }
155 break;
156 case PIDFD_GET_IPC_NAMESPACE:
157 if (IS_ENABLED(CONFIG_IPC_NS)) {
158 get_ipc_ns(nsp->ipc_ns);
159 ns_common = to_ns_common(nsp->ipc_ns);
160 }
161 break;
162 case PIDFD_GET_MNT_NAMESPACE:
163 get_mnt_ns(nsp->mnt_ns);
164 ns_common = to_ns_common(nsp->mnt_ns);
165 break;
166 case PIDFD_GET_NET_NAMESPACE:
167 if (IS_ENABLED(CONFIG_NET_NS)) {
168 ns_common = to_ns_common(nsp->net_ns);
169 get_net_ns(ns_common);
170 }
171 break;
172 case PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE:
173 if (IS_ENABLED(CONFIG_PID_NS)) {
174 get_pid_ns(nsp->pid_ns_for_children);
175 ns_common = to_ns_common(nsp->pid_ns_for_children);
176 }
177 break;
178 case PIDFD_GET_TIME_NAMESPACE:
179 if (IS_ENABLED(CONFIG_TIME_NS)) {
180 get_time_ns(nsp->time_ns);
181 ns_common = to_ns_common(nsp->time_ns);
182 }
183 break;
184 case PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE:
185 if (IS_ENABLED(CONFIG_TIME_NS)) {
186 get_time_ns(nsp->time_ns_for_children);
187 ns_common = to_ns_common(nsp->time_ns_for_children);
188 }
189 break;
190 case PIDFD_GET_UTS_NAMESPACE:
191 if (IS_ENABLED(CONFIG_UTS_NS)) {
192 get_uts_ns(nsp->uts_ns);
193 ns_common = to_ns_common(nsp->uts_ns);
194 }
195 break;
196 /* Namespaces that don't hang of nsproxy. */
197 case PIDFD_GET_USER_NAMESPACE:
198 if (IS_ENABLED(CONFIG_USER_NS)) {
199 rcu_read_lock();
200 ns_common = to_ns_common(get_user_ns(task_cred_xxx(task, user_ns)));
201 rcu_read_unlock();
202 }
203 break;
204 case PIDFD_GET_PID_NAMESPACE:
205 if (IS_ENABLED(CONFIG_PID_NS)) {
206 rcu_read_lock();
207 pid_ns = task_active_pid_ns(task);
208 if (pid_ns)
209 ns_common = to_ns_common(get_pid_ns(pid_ns));
210 rcu_read_unlock();
211 }
212 break;
213 default:
214 return -ENOIOCTLCMD;
215 }
216
217 if (!ns_common)
218 return -EOPNOTSUPP;
219
220 /* open_namespace() unconditionally consumes the reference */
221 return open_namespace(ns_common);
222 }
223
224 static const struct file_operations pidfs_file_operations = {
225 .poll = pidfd_poll,
226 #ifdef CONFIG_PROC_FS
227 .show_fdinfo = pidfd_show_fdinfo,
228 #endif
229 .unlocked_ioctl = pidfd_ioctl,
230 .compat_ioctl = compat_ptr_ioctl,
231 };
232
pidfd_pid(const struct file * file)233 struct pid *pidfd_pid(const struct file *file)
234 {
235 if (file->f_op != &pidfs_file_operations)
236 return ERR_PTR(-EBADF);
237 return file_inode(file)->i_private;
238 }
239
240 static struct vfsmount *pidfs_mnt __ro_after_init;
241
242 #if BITS_PER_LONG == 32
243 /*
244 * Provide a fallback mechanism for 32-bit systems so processes remain
245 * reliably comparable by inode number even on those systems.
246 */
247 static DEFINE_IDA(pidfd_inum_ida);
248
pidfs_inum(struct pid * pid,unsigned long * ino)249 static int pidfs_inum(struct pid *pid, unsigned long *ino)
250 {
251 int ret;
252
253 ret = ida_alloc_range(&pidfd_inum_ida, RESERVED_PIDS + 1,
254 UINT_MAX, GFP_ATOMIC);
255 if (ret < 0)
256 return -ENOSPC;
257
258 *ino = ret;
259 return 0;
260 }
261
pidfs_free_inum(unsigned long ino)262 static inline void pidfs_free_inum(unsigned long ino)
263 {
264 if (ino > 0)
265 ida_free(&pidfd_inum_ida, ino);
266 }
267 #else
pidfs_inum(struct pid * pid,unsigned long * ino)268 static inline int pidfs_inum(struct pid *pid, unsigned long *ino)
269 {
270 *ino = pid->ino;
271 return 0;
272 }
273 #define pidfs_free_inum(ino) ((void)(ino))
274 #endif
275
276 /*
277 * The vfs falls back to simple_setattr() if i_op->setattr() isn't
278 * implemented. Let's reject it completely until we have a clean
279 * permission concept for pidfds.
280 */
pidfs_setattr(struct mnt_idmap * idmap,struct dentry * dentry,struct iattr * attr)281 static int pidfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
282 struct iattr *attr)
283 {
284 return -EOPNOTSUPP;
285 }
286
287
288 /*
289 * User space expects pidfs inodes to have no file type in st_mode.
290 *
291 * In particular, 'lsof' has this legacy logic:
292 *
293 * type = s->st_mode & S_IFMT;
294 * switch (type) {
295 * ...
296 * case 0:
297 * if (!strcmp(p, "anon_inode"))
298 * Lf->ntype = Ntype = N_ANON_INODE;
299 *
300 * to detect our old anon_inode logic.
301 *
302 * Rather than mess with our internal sane inode data, just fix it
303 * up here in getattr() by masking off the format bits.
304 */
pidfs_getattr(struct mnt_idmap * idmap,const struct path * path,struct kstat * stat,u32 request_mask,unsigned int query_flags)305 static int pidfs_getattr(struct mnt_idmap *idmap, const struct path *path,
306 struct kstat *stat, u32 request_mask,
307 unsigned int query_flags)
308 {
309 struct inode *inode = d_inode(path->dentry);
310
311 generic_fillattr(&nop_mnt_idmap, request_mask, inode, stat);
312 stat->mode &= ~S_IFMT;
313 return 0;
314 }
315
316 static const struct inode_operations pidfs_inode_operations = {
317 .getattr = pidfs_getattr,
318 .setattr = pidfs_setattr,
319 };
320
pidfs_evict_inode(struct inode * inode)321 static void pidfs_evict_inode(struct inode *inode)
322 {
323 struct pid *pid = inode->i_private;
324
325 clear_inode(inode);
326 put_pid(pid);
327 pidfs_free_inum(inode->i_ino);
328 }
329
330 static const struct super_operations pidfs_sops = {
331 .drop_inode = generic_delete_inode,
332 .evict_inode = pidfs_evict_inode,
333 .statfs = simple_statfs,
334 };
335
336 /*
337 * 'lsof' has knowledge of out historical anon_inode use, and expects
338 * the pidfs dentry name to start with 'anon_inode'.
339 */
pidfs_dname(struct dentry * dentry,char * buffer,int buflen)340 static char *pidfs_dname(struct dentry *dentry, char *buffer, int buflen)
341 {
342 return dynamic_dname(buffer, buflen, "anon_inode:[pidfd]");
343 }
344
345 static const struct dentry_operations pidfs_dentry_operations = {
346 .d_delete = always_delete_dentry,
347 .d_dname = pidfs_dname,
348 .d_prune = stashed_dentry_prune,
349 };
350
pidfs_init_inode(struct inode * inode,void * data)351 static int pidfs_init_inode(struct inode *inode, void *data)
352 {
353 inode->i_private = data;
354 inode->i_flags |= S_PRIVATE;
355 inode->i_mode |= S_IRWXU;
356 inode->i_op = &pidfs_inode_operations;
357 inode->i_fop = &pidfs_file_operations;
358 /*
359 * Inode numbering for pidfs start at RESERVED_PIDS + 1. This
360 * avoids collisions with the root inode which is 1 for pseudo
361 * filesystems.
362 */
363 return pidfs_inum(data, &inode->i_ino);
364 }
365
pidfs_put_data(void * data)366 static void pidfs_put_data(void *data)
367 {
368 struct pid *pid = data;
369 put_pid(pid);
370 }
371
372 static const struct stashed_operations pidfs_stashed_ops = {
373 .init_inode = pidfs_init_inode,
374 .put_data = pidfs_put_data,
375 };
376
pidfs_init_fs_context(struct fs_context * fc)377 static int pidfs_init_fs_context(struct fs_context *fc)
378 {
379 struct pseudo_fs_context *ctx;
380
381 ctx = init_pseudo(fc, PID_FS_MAGIC);
382 if (!ctx)
383 return -ENOMEM;
384
385 fc->s_iflags |= SB_I_NOEXEC;
386 fc->s_iflags |= SB_I_NODEV;
387 ctx->ops = &pidfs_sops;
388 ctx->dops = &pidfs_dentry_operations;
389 fc->s_fs_info = (void *)&pidfs_stashed_ops;
390 return 0;
391 }
392
393 static struct file_system_type pidfs_type = {
394 .name = "pidfs",
395 .init_fs_context = pidfs_init_fs_context,
396 .kill_sb = kill_anon_super,
397 };
398
pidfs_alloc_file(struct pid * pid,unsigned int flags)399 struct file *pidfs_alloc_file(struct pid *pid, unsigned int flags)
400 {
401
402 struct file *pidfd_file;
403 struct path path;
404 int ret;
405
406 ret = path_from_stashed(&pid->stashed, pidfs_mnt, get_pid(pid), &path);
407 if (ret < 0)
408 return ERR_PTR(ret);
409
410 pidfd_file = dentry_open(&path, flags, current_cred());
411 path_put(&path);
412 return pidfd_file;
413 }
414
pidfs_init(void)415 void __init pidfs_init(void)
416 {
417 pidfs_mnt = kern_mount(&pidfs_type);
418 if (IS_ERR(pidfs_mnt))
419 panic("Failed to mount pidfs pseudo filesystem");
420 }
421