1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 *  Copyright (C) 2007
4 *
5 *  Author: Eric Biederman <ebiederm@xmision.com>
6 */
7
8#include <linux/module.h>
9#include <linux/ipc.h>
10#include <linux/nsproxy.h>
11#include <linux/sysctl.h>
12#include <linux/uaccess.h>
13#include <linux/capability.h>
14#include <linux/ipc_namespace.h>
15#include <linux/msg.h>
16#include <linux/slab.h>
17#include <linux/cred.h>
18#include "util.h"
19
20static int proc_ipc_dointvec_minmax_orphans(struct ctl_table *table, int write,
21		void *buffer, size_t *lenp, loff_t *ppos)
22{
23	struct ipc_namespace *ns =
24		container_of(table->data, struct ipc_namespace, shm_rmid_forced);
25	int err;
26
27	err = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
28
29	if (err < 0)
30		return err;
31	if (ns->shm_rmid_forced)
32		shm_destroy_orphaned(ns);
33	return err;
34}
35
36static int proc_ipc_auto_msgmni(struct ctl_table *table, int write,
37		void *buffer, size_t *lenp, loff_t *ppos)
38{
39	struct ctl_table ipc_table;
40	int dummy = 0;
41
42	memcpy(&ipc_table, table, sizeof(ipc_table));
43	ipc_table.data = &dummy;
44
45	if (write)
46		pr_info_once("writing to auto_msgmni has no effect");
47
48	return proc_dointvec_minmax(&ipc_table, write, buffer, lenp, ppos);
49}
50
51static int proc_ipc_sem_dointvec(struct ctl_table *table, int write,
52	void *buffer, size_t *lenp, loff_t *ppos)
53{
54	struct ipc_namespace *ns =
55		container_of(table->data, struct ipc_namespace, sem_ctls);
56	int ret, semmni;
57
58	semmni = ns->sem_ctls[3];
59	ret = proc_dointvec(table, write, buffer, lenp, ppos);
60
61	if (!ret)
62		ret = sem_check_semmni(ns);
63
64	/*
65	 * Reset the semmni value if an error happens.
66	 */
67	if (ret)
68		ns->sem_ctls[3] = semmni;
69	return ret;
70}
71
72int ipc_mni = IPCMNI;
73int ipc_mni_shift = IPCMNI_SHIFT;
74int ipc_min_cycle = RADIX_TREE_MAP_SIZE;
75
76static struct ctl_table ipc_sysctls[] = {
77	{
78		.procname	= "shmmax",
79		.data		= &init_ipc_ns.shm_ctlmax,
80		.maxlen		= sizeof(init_ipc_ns.shm_ctlmax),
81		.mode		= 0644,
82		.proc_handler	= proc_doulongvec_minmax,
83	},
84	{
85		.procname	= "shmall",
86		.data		= &init_ipc_ns.shm_ctlall,
87		.maxlen		= sizeof(init_ipc_ns.shm_ctlall),
88		.mode		= 0644,
89		.proc_handler	= proc_doulongvec_minmax,
90	},
91	{
92		.procname	= "shmmni",
93		.data		= &init_ipc_ns.shm_ctlmni,
94		.maxlen		= sizeof(init_ipc_ns.shm_ctlmni),
95		.mode		= 0644,
96		.proc_handler	= proc_dointvec_minmax,
97		.extra1		= SYSCTL_ZERO,
98		.extra2		= &ipc_mni,
99	},
100	{
101		.procname	= "shm_rmid_forced",
102		.data		= &init_ipc_ns.shm_rmid_forced,
103		.maxlen		= sizeof(init_ipc_ns.shm_rmid_forced),
104		.mode		= 0644,
105		.proc_handler	= proc_ipc_dointvec_minmax_orphans,
106		.extra1		= SYSCTL_ZERO,
107		.extra2		= SYSCTL_ONE,
108	},
109	{
110		.procname	= "msgmax",
111		.data		= &init_ipc_ns.msg_ctlmax,
112		.maxlen		= sizeof(init_ipc_ns.msg_ctlmax),
113		.mode		= 0644,
114		.proc_handler	= proc_dointvec_minmax,
115		.extra1		= SYSCTL_ZERO,
116		.extra2		= SYSCTL_INT_MAX,
117	},
118	{
119		.procname	= "msgmni",
120		.data		= &init_ipc_ns.msg_ctlmni,
121		.maxlen		= sizeof(init_ipc_ns.msg_ctlmni),
122		.mode		= 0644,
123		.proc_handler	= proc_dointvec_minmax,
124		.extra1		= SYSCTL_ZERO,
125		.extra2		= &ipc_mni,
126	},
127	{
128		.procname	= "auto_msgmni",
129		.data		= NULL,
130		.maxlen		= sizeof(int),
131		.mode		= 0644,
132		.proc_handler	= proc_ipc_auto_msgmni,
133		.extra1		= SYSCTL_ZERO,
134		.extra2		= SYSCTL_ONE,
135	},
136	{
137		.procname	=  "msgmnb",
138		.data		= &init_ipc_ns.msg_ctlmnb,
139		.maxlen		= sizeof(init_ipc_ns.msg_ctlmnb),
140		.mode		= 0644,
141		.proc_handler	= proc_dointvec_minmax,
142		.extra1		= SYSCTL_ZERO,
143		.extra2		= SYSCTL_INT_MAX,
144	},
145	{
146		.procname	= "sem",
147		.data		= &init_ipc_ns.sem_ctls,
148		.maxlen		= 4*sizeof(int),
149		.mode		= 0644,
150		.proc_handler	= proc_ipc_sem_dointvec,
151	},
152#ifdef CONFIG_CHECKPOINT_RESTORE
153	{
154		.procname	= "sem_next_id",
155		.data		= &init_ipc_ns.ids[IPC_SEM_IDS].next_id,
156		.maxlen		= sizeof(init_ipc_ns.ids[IPC_SEM_IDS].next_id),
157		.mode		= 0444,
158		.proc_handler	= proc_dointvec_minmax,
159		.extra1		= SYSCTL_ZERO,
160		.extra2		= SYSCTL_INT_MAX,
161	},
162	{
163		.procname	= "msg_next_id",
164		.data		= &init_ipc_ns.ids[IPC_MSG_IDS].next_id,
165		.maxlen		= sizeof(init_ipc_ns.ids[IPC_MSG_IDS].next_id),
166		.mode		= 0444,
167		.proc_handler	= proc_dointvec_minmax,
168		.extra1		= SYSCTL_ZERO,
169		.extra2		= SYSCTL_INT_MAX,
170	},
171	{
172		.procname	= "shm_next_id",
173		.data		= &init_ipc_ns.ids[IPC_SHM_IDS].next_id,
174		.maxlen		= sizeof(init_ipc_ns.ids[IPC_SHM_IDS].next_id),
175		.mode		= 0444,
176		.proc_handler	= proc_dointvec_minmax,
177		.extra1		= SYSCTL_ZERO,
178		.extra2		= SYSCTL_INT_MAX,
179	},
180#endif
181	{}
182};
183
184static struct ctl_table_set *set_lookup(struct ctl_table_root *root)
185{
186	return &current->nsproxy->ipc_ns->ipc_set;
187}
188
189static int set_is_seen(struct ctl_table_set *set)
190{
191	return &current->nsproxy->ipc_ns->ipc_set == set;
192}
193
194static void ipc_set_ownership(struct ctl_table_header *head,
195			      kuid_t *uid, kgid_t *gid)
196{
197	struct ipc_namespace *ns =
198		container_of(head->set, struct ipc_namespace, ipc_set);
199
200	kuid_t ns_root_uid = make_kuid(ns->user_ns, 0);
201	kgid_t ns_root_gid = make_kgid(ns->user_ns, 0);
202
203	*uid = uid_valid(ns_root_uid) ? ns_root_uid : GLOBAL_ROOT_UID;
204	*gid = gid_valid(ns_root_gid) ? ns_root_gid : GLOBAL_ROOT_GID;
205}
206
207static int ipc_permissions(struct ctl_table_header *head, const struct ctl_table *table)
208{
209	int mode = table->mode;
210
211#ifdef CONFIG_CHECKPOINT_RESTORE
212	struct ipc_namespace *ns =
213		container_of(head->set, struct ipc_namespace, ipc_set);
214
215	if (((table->data == &ns->ids[IPC_SEM_IDS].next_id) ||
216	     (table->data == &ns->ids[IPC_MSG_IDS].next_id) ||
217	     (table->data == &ns->ids[IPC_SHM_IDS].next_id)) &&
218	    checkpoint_restore_ns_capable(ns->user_ns))
219		mode = 0666;
220	else
221#endif
222	{
223		kuid_t ns_root_uid;
224		kgid_t ns_root_gid;
225
226		ipc_set_ownership(head, &ns_root_uid, &ns_root_gid);
227
228		if (uid_eq(current_euid(), ns_root_uid))
229			mode >>= 6;
230
231		else if (in_egroup_p(ns_root_gid))
232			mode >>= 3;
233	}
234
235	mode &= 7;
236
237	return (mode << 6) | (mode << 3) | mode;
238}
239
240static struct ctl_table_root set_root = {
241	.lookup = set_lookup,
242	.permissions = ipc_permissions,
243	.set_ownership = ipc_set_ownership,
244};
245
246bool setup_ipc_sysctls(struct ipc_namespace *ns)
247{
248	struct ctl_table *tbl;
249
250	setup_sysctl_set(&ns->ipc_set, &set_root, set_is_seen);
251
252	tbl = kmemdup(ipc_sysctls, sizeof(ipc_sysctls), GFP_KERNEL);
253	if (tbl) {
254		int i;
255
256		for (i = 0; i < ARRAY_SIZE(ipc_sysctls); i++) {
257			if (tbl[i].data == &init_ipc_ns.shm_ctlmax)
258				tbl[i].data = &ns->shm_ctlmax;
259
260			else if (tbl[i].data == &init_ipc_ns.shm_ctlall)
261				tbl[i].data = &ns->shm_ctlall;
262
263			else if (tbl[i].data == &init_ipc_ns.shm_ctlmni)
264				tbl[i].data = &ns->shm_ctlmni;
265
266			else if (tbl[i].data == &init_ipc_ns.shm_rmid_forced)
267				tbl[i].data = &ns->shm_rmid_forced;
268
269			else if (tbl[i].data == &init_ipc_ns.msg_ctlmax)
270				tbl[i].data = &ns->msg_ctlmax;
271
272			else if (tbl[i].data == &init_ipc_ns.msg_ctlmni)
273				tbl[i].data = &ns->msg_ctlmni;
274
275			else if (tbl[i].data == &init_ipc_ns.msg_ctlmnb)
276				tbl[i].data = &ns->msg_ctlmnb;
277
278			else if (tbl[i].data == &init_ipc_ns.sem_ctls)
279				tbl[i].data = &ns->sem_ctls;
280#ifdef CONFIG_CHECKPOINT_RESTORE
281			else if (tbl[i].data == &init_ipc_ns.ids[IPC_SEM_IDS].next_id)
282				tbl[i].data = &ns->ids[IPC_SEM_IDS].next_id;
283
284			else if (tbl[i].data == &init_ipc_ns.ids[IPC_MSG_IDS].next_id)
285				tbl[i].data = &ns->ids[IPC_MSG_IDS].next_id;
286
287			else if (tbl[i].data == &init_ipc_ns.ids[IPC_SHM_IDS].next_id)
288				tbl[i].data = &ns->ids[IPC_SHM_IDS].next_id;
289#endif
290			else
291				tbl[i].data = NULL;
292		}
293
294		ns->ipc_sysctls = __register_sysctl_table(&ns->ipc_set, "kernel", tbl,
295							  ARRAY_SIZE(ipc_sysctls));
296	}
297	if (!ns->ipc_sysctls) {
298		kfree(tbl);
299		retire_sysctl_set(&ns->ipc_set);
300		return false;
301	}
302
303	return true;
304}
305
306void retire_ipc_sysctls(struct ipc_namespace *ns)
307{
308	const struct ctl_table *tbl;
309
310	tbl = ns->ipc_sysctls->ctl_table_arg;
311	unregister_sysctl_table(ns->ipc_sysctls);
312	retire_sysctl_set(&ns->ipc_set);
313	kfree(tbl);
314}
315
316static int __init ipc_sysctl_init(void)
317{
318	if (!setup_ipc_sysctls(&init_ipc_ns)) {
319		pr_warn("ipc sysctl registration failed\n");
320		return -ENOMEM;
321	}
322	return 0;
323}
324
325device_initcall(ipc_sysctl_init);
326
327static int __init ipc_mni_extend(char *str)
328{
329	ipc_mni = IPCMNI_EXTEND;
330	ipc_mni_shift = IPCMNI_EXTEND_SHIFT;
331	ipc_min_cycle = IPCMNI_EXTEND_MIN_CYCLE;
332	pr_info("IPCMNI extended to %d.\n", ipc_mni);
333	return 0;
334}
335early_param("ipcmni_extend", ipc_mni_extend);
336