1
2
3
4
5
6
7#include <linux/time_namespace.h>
8#include <linux/user_namespace.h>
9#include <linux/sched/signal.h>
10#include <linux/sched/task.h>
11#include <linux/clocksource.h>
12#include <linux/seq_file.h>
13#include <linux/proc_ns.h>
14#include <linux/export.h>
15#include <linux/time.h>
16#include <linux/slab.h>
17#include <linux/cred.h>
18#include <linux/err.h>
19#include <linux/mm.h>
20
21#include <vdso/datapage.h>
22
23ktime_t do_timens_ktime_to_host(clockid_t clockid, ktime_t tim,
24 struct timens_offsets *ns_offsets)
25{
26 ktime_t offset;
27
28 switch (clockid) {
29 case CLOCK_MONOTONIC:
30 offset = timespec64_to_ktime(ns_offsets->monotonic);
31 break;
32 case CLOCK_BOOTTIME:
33 case CLOCK_BOOTTIME_ALARM:
34 offset = timespec64_to_ktime(ns_offsets->boottime);
35 break;
36 default:
37 return tim;
38 }
39
40
41
42
43
44 if (tim < offset) {
45
46
47
48
49 tim = 0;
50 } else {
51 tim = ktime_sub(tim, offset);
52 if (unlikely(tim > KTIME_MAX))
53 tim = KTIME_MAX;
54 }
55
56 return tim;
57}
58
59static struct ucounts *inc_time_namespaces(struct user_namespace *ns)
60{
61 return inc_ucount(ns, current_euid(), UCOUNT_TIME_NAMESPACES);
62}
63
64static void dec_time_namespaces(struct ucounts *ucounts)
65{
66 dec_ucount(ucounts, UCOUNT_TIME_NAMESPACES);
67}
68
69
70
71
72
73
74
75
76
77
78static struct time_namespace *clone_time_ns(struct user_namespace *user_ns,
79 struct time_namespace *old_ns)
80{
81 struct time_namespace *ns;
82 struct ucounts *ucounts;
83 int err;
84
85 err = -ENOSPC;
86 ucounts = inc_time_namespaces(user_ns);
87 if (!ucounts)
88 goto fail;
89
90 err = -ENOMEM;
91 ns = kmalloc(sizeof(*ns), GFP_KERNEL);
92 if (!ns)
93 goto fail_dec;
94
95 kref_init(&ns->kref);
96
97 ns->vvar_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
98 if (!ns->vvar_page)
99 goto fail_free;
100
101 err = ns_alloc_inum(&ns->ns);
102 if (err)
103 goto fail_free_page;
104
105 ns->ucounts = ucounts;
106 ns->ns.ops = &timens_operations;
107 ns->user_ns = get_user_ns(user_ns);
108 ns->offsets = old_ns->offsets;
109 ns->frozen_offsets = false;
110 return ns;
111
112fail_free_page:
113 __free_page(ns->vvar_page);
114fail_free:
115 kfree(ns);
116fail_dec:
117 dec_time_namespaces(ucounts);
118fail:
119 return ERR_PTR(err);
120}
121
122
123
124
125
126
127
128
129
130
131
132
133struct time_namespace *copy_time_ns(unsigned long flags,
134 struct user_namespace *user_ns, struct time_namespace *old_ns)
135{
136 if (!(flags & CLONE_NEWTIME))
137 return get_time_ns(old_ns);
138
139 return clone_time_ns(user_ns, old_ns);
140}
141
142static struct timens_offset offset_from_ts(struct timespec64 off)
143{
144 struct timens_offset ret;
145
146 ret.sec = off.tv_sec;
147 ret.nsec = off.tv_nsec;
148
149 return ret;
150}
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179static void timens_setup_vdso_data(struct vdso_data *vdata,
180 struct time_namespace *ns)
181{
182 struct timens_offset *offset = vdata->offset;
183 struct timens_offset monotonic = offset_from_ts(ns->offsets.monotonic);
184 struct timens_offset boottime = offset_from_ts(ns->offsets.boottime);
185
186 vdata->seq = 1;
187 vdata->clock_mode = VDSO_CLOCKMODE_TIMENS;
188 offset[CLOCK_MONOTONIC] = monotonic;
189 offset[CLOCK_MONOTONIC_RAW] = monotonic;
190 offset[CLOCK_MONOTONIC_COARSE] = monotonic;
191 offset[CLOCK_BOOTTIME] = boottime;
192 offset[CLOCK_BOOTTIME_ALARM] = boottime;
193}
194
195
196
197
198
199static DEFINE_MUTEX(offset_lock);
200
201static void timens_set_vvar_page(struct task_struct *task,
202 struct time_namespace *ns)
203{
204 struct vdso_data *vdata;
205 unsigned int i;
206
207 if (ns == &init_time_ns)
208 return;
209
210
211 if (likely(ns->frozen_offsets))
212 return;
213
214 mutex_lock(&offset_lock);
215
216 if (ns->frozen_offsets)
217 goto out;
218
219 ns->frozen_offsets = true;
220 vdata = arch_get_vdso_data(page_address(ns->vvar_page));
221
222 for (i = 0; i < CS_BASES; i++)
223 timens_setup_vdso_data(&vdata[i], ns);
224
225out:
226 mutex_unlock(&offset_lock);
227}
228
229void free_time_ns(struct kref *kref)
230{
231 struct time_namespace *ns;
232
233 ns = container_of(kref, struct time_namespace, kref);
234 dec_time_namespaces(ns->ucounts);
235 put_user_ns(ns->user_ns);
236 ns_free_inum(&ns->ns);
237 __free_page(ns->vvar_page);
238 kfree(ns);
239}
240
241static struct time_namespace *to_time_ns(struct ns_common *ns)
242{
243 return container_of(ns, struct time_namespace, ns);
244}
245
246static struct ns_common *timens_get(struct task_struct *task)
247{
248 struct time_namespace *ns = NULL;
249 struct nsproxy *nsproxy;
250
251 task_lock(task);
252 nsproxy = task->nsproxy;
253 if (nsproxy) {
254 ns = nsproxy->time_ns;
255 get_time_ns(ns);
256 }
257 task_unlock(task);
258
259 return ns ? &ns->ns : NULL;
260}
261
262static struct ns_common *timens_for_children_get(struct task_struct *task)
263{
264 struct time_namespace *ns = NULL;
265 struct nsproxy *nsproxy;
266
267 task_lock(task);
268 nsproxy = task->nsproxy;
269 if (nsproxy) {
270 ns = nsproxy->time_ns_for_children;
271 get_time_ns(ns);
272 }
273 task_unlock(task);
274
275 return ns ? &ns->ns : NULL;
276}
277
278static void timens_put(struct ns_common *ns)
279{
280 put_time_ns(to_time_ns(ns));
281}
282
283void timens_commit(struct task_struct *tsk, struct time_namespace *ns)
284{
285 timens_set_vvar_page(tsk, ns);
286 vdso_join_timens(tsk, ns);
287}
288
289static int timens_install(struct nsset *nsset, struct ns_common *new)
290{
291 struct nsproxy *nsproxy = nsset->nsproxy;
292 struct time_namespace *ns = to_time_ns(new);
293
294 if (!current_is_single_threaded())
295 return -EUSERS;
296
297 if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) ||
298 !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
299 return -EPERM;
300
301 get_time_ns(ns);
302 put_time_ns(nsproxy->time_ns);
303 nsproxy->time_ns = ns;
304
305 get_time_ns(ns);
306 put_time_ns(nsproxy->time_ns_for_children);
307 nsproxy->time_ns_for_children = ns;
308 return 0;
309}
310
311int timens_on_fork(struct nsproxy *nsproxy, struct task_struct *tsk)
312{
313 struct ns_common *nsc = &nsproxy->time_ns_for_children->ns;
314 struct time_namespace *ns = to_time_ns(nsc);
315
316
317 if (nsproxy->time_ns == nsproxy->time_ns_for_children)
318 return 0;
319
320 get_time_ns(ns);
321 put_time_ns(nsproxy->time_ns);
322 nsproxy->time_ns = ns;
323
324 timens_commit(tsk, ns);
325
326 return 0;
327}
328
329static struct user_namespace *timens_owner(struct ns_common *ns)
330{
331 return to_time_ns(ns)->user_ns;
332}
333
334static void show_offset(struct seq_file *m, int clockid, struct timespec64 *ts)
335{
336 char *clock;
337
338 switch (clockid) {
339 case CLOCK_BOOTTIME:
340 clock = "boottime";
341 break;
342 case CLOCK_MONOTONIC:
343 clock = "monotonic";
344 break;
345 default:
346 clock = "unknown";
347 break;
348 }
349 seq_printf(m, "%-10s %10lld %9ld\n", clock, ts->tv_sec, ts->tv_nsec);
350}
351
352void proc_timens_show_offsets(struct task_struct *p, struct seq_file *m)
353{
354 struct ns_common *ns;
355 struct time_namespace *time_ns;
356
357 ns = timens_for_children_get(p);
358 if (!ns)
359 return;
360 time_ns = to_time_ns(ns);
361
362 show_offset(m, CLOCK_MONOTONIC, &time_ns->offsets.monotonic);
363 show_offset(m, CLOCK_BOOTTIME, &time_ns->offsets.boottime);
364 put_time_ns(time_ns);
365}
366
367int proc_timens_set_offset(struct file *file, struct task_struct *p,
368 struct proc_timens_offset *offsets, int noffsets)
369{
370 struct ns_common *ns;
371 struct time_namespace *time_ns;
372 struct timespec64 tp;
373 int i, err;
374
375 ns = timens_for_children_get(p);
376 if (!ns)
377 return -ESRCH;
378 time_ns = to_time_ns(ns);
379
380 if (!file_ns_capable(file, time_ns->user_ns, CAP_SYS_TIME)) {
381 put_time_ns(time_ns);
382 return -EPERM;
383 }
384
385 for (i = 0; i < noffsets; i++) {
386 struct proc_timens_offset *off = &offsets[i];
387
388 switch (off->clockid) {
389 case CLOCK_MONOTONIC:
390 ktime_get_ts64(&tp);
391 break;
392 case CLOCK_BOOTTIME:
393 ktime_get_boottime_ts64(&tp);
394 break;
395 default:
396 err = -EINVAL;
397 goto out;
398 }
399
400 err = -ERANGE;
401
402 if (off->val.tv_sec > KTIME_SEC_MAX ||
403 off->val.tv_sec < -KTIME_SEC_MAX)
404 goto out;
405
406 tp = timespec64_add(tp, off->val);
407
408
409
410
411 if (tp.tv_sec < 0 || tp.tv_sec > KTIME_SEC_MAX / 2)
412 goto out;
413 }
414
415 mutex_lock(&offset_lock);
416 if (time_ns->frozen_offsets) {
417 err = -EACCES;
418 goto out_unlock;
419 }
420
421 err = 0;
422
423 for (i = 0; i < noffsets; i++) {
424 struct proc_timens_offset *off = &offsets[i];
425 struct timespec64 *offset = NULL;
426
427 switch (off->clockid) {
428 case CLOCK_MONOTONIC:
429 offset = &time_ns->offsets.monotonic;
430 break;
431 case CLOCK_BOOTTIME:
432 offset = &time_ns->offsets.boottime;
433 break;
434 }
435
436 *offset = off->val;
437 }
438
439out_unlock:
440 mutex_unlock(&offset_lock);
441out:
442 put_time_ns(time_ns);
443
444 return err;
445}
446
447const struct proc_ns_operations timens_operations = {
448 .name = "time",
449 .type = CLONE_NEWTIME,
450 .get = timens_get,
451 .put = timens_put,
452 .install = timens_install,
453 .owner = timens_owner,
454};
455
456const struct proc_ns_operations timens_for_children_operations = {
457 .name = "time_for_children",
458 .real_ns_name = "time",
459 .type = CLONE_NEWTIME,
460 .get = timens_for_children_get,
461 .put = timens_put,
462 .install = timens_install,
463 .owner = timens_owner,
464};
465
466struct time_namespace init_time_ns = {
467 .kref = KREF_INIT(3),
468 .user_ns = &init_user_ns,
469 .ns.inum = PROC_TIME_INIT_INO,
470 .ns.ops = &timens_operations,
471 .frozen_offsets = true,
472};
473
474static int __init time_ns_init(void)
475{
476 return 0;
477}
478subsys_initcall(time_ns_init);
479