1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43#include <linux/mm.h>
44#include <linux/shm.h>
45#include <linux/init.h>
46#include <linux/msg.h>
47#include <linux/vmalloc.h>
48#include <linux/slab.h>
49#include <linux/notifier.h>
50#include <linux/capability.h>
51#include <linux/highuid.h>
52#include <linux/security.h>
53#include <linux/rcupdate.h>
54#include <linux/workqueue.h>
55#include <linux/seq_file.h>
56#include <linux/proc_fs.h>
57#include <linux/audit.h>
58#include <linux/nsproxy.h>
59#include <linux/rwsem.h>
60#include <linux/memory.h>
61#include <linux/ipc_namespace.h>
62
63#include <asm/unistd.h>
64
65#include "util.h"
66
67struct ipc_proc_iface {
68 const char *path;
69 const char *header;
70 int ids;
71 int (*show)(struct seq_file *, void *);
72};
73
74
75
76
77
78
79
80
81
82
83
84static int __init ipc_init(void)
85{
86 sem_init();
87 msg_init();
88 shm_init();
89 return 0;
90}
91device_initcall(ipc_init);
92
93
94
95
96
97
98
99
100void ipc_init_ids(struct ipc_ids *ids)
101{
102 ids->in_use = 0;
103 ids->seq = 0;
104 ids->next_id = -1;
105 init_rwsem(&ids->rwsem);
106 idr_init(&ids->ipcs_idr);
107}
108
109#ifdef CONFIG_PROC_FS
110static const struct file_operations sysvipc_proc_fops;
111
112
113
114
115
116
117
118void __init ipc_init_proc_interface(const char *path, const char *header,
119 int ids, int (*show)(struct seq_file *, void *))
120{
121 struct proc_dir_entry *pde;
122 struct ipc_proc_iface *iface;
123
124 iface = kmalloc(sizeof(*iface), GFP_KERNEL);
125 if (!iface)
126 return;
127 iface->path = path;
128 iface->header = header;
129 iface->ids = ids;
130 iface->show = show;
131
132 pde = proc_create_data(path,
133 S_IRUGO,
134 NULL,
135 &sysvipc_proc_fops,
136 iface);
137 if (!pde)
138 kfree(iface);
139}
140#endif
141
142
143
144
145
146
147
148
149
150
151
152static struct kern_ipc_perm *ipc_findkey(struct ipc_ids *ids, key_t key)
153{
154 struct kern_ipc_perm *ipc;
155 int next_id;
156 int total;
157
158 for (total = 0, next_id = 0; total < ids->in_use; next_id++) {
159 ipc = idr_find(&ids->ipcs_idr, next_id);
160
161 if (ipc == NULL)
162 continue;
163
164 if (ipc->key != key) {
165 total++;
166 continue;
167 }
168
169 rcu_read_lock();
170 ipc_lock_object(ipc);
171 return ipc;
172 }
173
174 return NULL;
175}
176
177
178
179
180
181
182
183int ipc_get_maxid(struct ipc_ids *ids)
184{
185 struct kern_ipc_perm *ipc;
186 int max_id = -1;
187 int total, id;
188
189 if (ids->in_use == 0)
190 return -1;
191
192 if (ids->in_use == IPCMNI)
193 return IPCMNI - 1;
194
195
196 total = 0;
197 for (id = 0; id < IPCMNI && total < ids->in_use; id++) {
198 ipc = idr_find(&ids->ipcs_idr, id);
199 if (ipc != NULL) {
200 max_id = id;
201 total++;
202 }
203 }
204 return max_id;
205}
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size)
221{
222 kuid_t euid;
223 kgid_t egid;
224 int id;
225 int next_id = ids->next_id;
226
227 if (size > IPCMNI)
228 size = IPCMNI;
229
230 if (ids->in_use >= size)
231 return -ENOSPC;
232
233 idr_preload(GFP_KERNEL);
234
235 spin_lock_init(&new->lock);
236 new->deleted = false;
237 rcu_read_lock();
238 spin_lock(&new->lock);
239
240 current_euid_egid(&euid, &egid);
241 new->cuid = new->uid = euid;
242 new->gid = new->cgid = egid;
243
244 id = idr_alloc(&ids->ipcs_idr, new,
245 (next_id < 0) ? 0 : ipcid_to_idx(next_id), 0,
246 GFP_NOWAIT);
247 idr_preload_end();
248 if (id < 0) {
249 spin_unlock(&new->lock);
250 rcu_read_unlock();
251 return id;
252 }
253
254 ids->in_use++;
255
256 if (next_id < 0) {
257 new->seq = ids->seq++;
258 if (ids->seq > IPCID_SEQ_MAX)
259 ids->seq = 0;
260 } else {
261 new->seq = ipcid_to_seqx(next_id);
262 ids->next_id = -1;
263 }
264
265 new->id = ipc_buildid(id, new->seq);
266 return id;
267}
268
269
270
271
272
273
274
275
276
277
278
279static int ipcget_new(struct ipc_namespace *ns, struct ipc_ids *ids,
280 const struct ipc_ops *ops, struct ipc_params *params)
281{
282 int err;
283
284 down_write(&ids->rwsem);
285 err = ops->getnew(ns, params);
286 up_write(&ids->rwsem);
287 return err;
288}
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305static int ipc_check_perms(struct ipc_namespace *ns,
306 struct kern_ipc_perm *ipcp,
307 const struct ipc_ops *ops,
308 struct ipc_params *params)
309{
310 int err;
311
312 if (ipcperms(ns, ipcp, params->flg))
313 err = -EACCES;
314 else {
315 err = ops->associate(ipcp, params->flg);
316 if (!err)
317 err = ipcp->id;
318 }
319
320 return err;
321}
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337static int ipcget_public(struct ipc_namespace *ns, struct ipc_ids *ids,
338 const struct ipc_ops *ops, struct ipc_params *params)
339{
340 struct kern_ipc_perm *ipcp;
341 int flg = params->flg;
342 int err;
343
344
345
346
347
348 down_write(&ids->rwsem);
349 ipcp = ipc_findkey(ids, params->key);
350 if (ipcp == NULL) {
351
352 if (!(flg & IPC_CREAT))
353 err = -ENOENT;
354 else
355 err = ops->getnew(ns, params);
356 } else {
357
358
359 if (flg & IPC_CREAT && flg & IPC_EXCL)
360 err = -EEXIST;
361 else {
362 err = 0;
363 if (ops->more_checks)
364 err = ops->more_checks(ipcp, params);
365 if (!err)
366
367
368
369
370 err = ipc_check_perms(ns, ipcp, ops, params);
371 }
372 ipc_unlock(ipcp);
373 }
374 up_write(&ids->rwsem);
375
376 return err;
377}
378
379
380
381
382
383
384
385
386
387
388void ipc_rmid(struct ipc_ids *ids, struct kern_ipc_perm *ipcp)
389{
390 int lid = ipcid_to_idx(ipcp->id);
391
392 idr_remove(&ids->ipcs_idr, lid);
393 ids->in_use--;
394 ipcp->deleted = true;
395}
396
397
398
399
400
401
402
403
404void *ipc_alloc(int size)
405{
406 void *out;
407 if (size > PAGE_SIZE)
408 out = vmalloc(size);
409 else
410 out = kmalloc(size, GFP_KERNEL);
411 return out;
412}
413
414
415
416
417
418
419
420void ipc_free(void *ptr)
421{
422 kvfree(ptr);
423}
424
425
426
427
428
429
430
431
432void *ipc_rcu_alloc(int size)
433{
434
435
436
437 struct ipc_rcu *out = ipc_alloc(sizeof(struct ipc_rcu) + size);
438 if (unlikely(!out))
439 return NULL;
440 atomic_set(&out->refcount, 1);
441 return out + 1;
442}
443
444int ipc_rcu_getref(void *ptr)
445{
446 struct ipc_rcu *p = ((struct ipc_rcu *)ptr) - 1;
447
448 return atomic_inc_not_zero(&p->refcount);
449}
450
451void ipc_rcu_putref(void *ptr, void (*func)(struct rcu_head *head))
452{
453 struct ipc_rcu *p = ((struct ipc_rcu *)ptr) - 1;
454
455 if (!atomic_dec_and_test(&p->refcount))
456 return;
457
458 call_rcu(&p->rcu, func);
459}
460
461void ipc_rcu_free(struct rcu_head *head)
462{
463 struct ipc_rcu *p = container_of(head, struct ipc_rcu, rcu);
464
465 kvfree(p);
466}
467
468
469
470
471
472
473
474
475
476
477
478
479int ipcperms(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp, short flag)
480{
481 kuid_t euid = current_euid();
482 int requested_mode, granted_mode;
483
484 audit_ipc_obj(ipcp);
485 requested_mode = (flag >> 6) | (flag >> 3) | flag;
486 granted_mode = ipcp->mode;
487 if (uid_eq(euid, ipcp->cuid) ||
488 uid_eq(euid, ipcp->uid))
489 granted_mode >>= 6;
490 else if (in_group_p(ipcp->cgid) || in_group_p(ipcp->gid))
491 granted_mode >>= 3;
492
493 if ((requested_mode & ~granted_mode & 0007) &&
494 !ns_capable(ns->user_ns, CAP_IPC_OWNER))
495 return -1;
496
497 return security_ipc_permission(ipcp, flag);
498}
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513void kernel_to_ipc64_perm(struct kern_ipc_perm *in, struct ipc64_perm *out)
514{
515 out->key = in->key;
516 out->uid = from_kuid_munged(current_user_ns(), in->uid);
517 out->gid = from_kgid_munged(current_user_ns(), in->gid);
518 out->cuid = from_kuid_munged(current_user_ns(), in->cuid);
519 out->cgid = from_kgid_munged(current_user_ns(), in->cgid);
520 out->mode = in->mode;
521 out->seq = in->seq;
522}
523
524
525
526
527
528
529
530
531
532void ipc64_perm_to_ipc_perm(struct ipc64_perm *in, struct ipc_perm *out)
533{
534 out->key = in->key;
535 SET_UID(out->uid, in->uid);
536 SET_GID(out->gid, in->gid);
537 SET_UID(out->cuid, in->cuid);
538 SET_GID(out->cgid, in->cgid);
539 out->mode = in->mode;
540 out->seq = in->seq;
541}
542
543
544
545
546
547
548
549
550
551
552
553struct kern_ipc_perm *ipc_obtain_object_idr(struct ipc_ids *ids, int id)
554{
555 struct kern_ipc_perm *out;
556 int lid = ipcid_to_idx(id);
557
558 out = idr_find(&ids->ipcs_idr, lid);
559 if (!out)
560 return ERR_PTR(-EINVAL);
561
562 return out;
563}
564
565
566
567
568
569
570
571
572
573
574struct kern_ipc_perm *ipc_lock(struct ipc_ids *ids, int id)
575{
576 struct kern_ipc_perm *out;
577
578 rcu_read_lock();
579 out = ipc_obtain_object_idr(ids, id);
580 if (IS_ERR(out))
581 goto err;
582
583 spin_lock(&out->lock);
584
585
586
587
588
589
590
591 if (ipc_valid_object(out))
592 return out;
593
594 spin_unlock(&out->lock);
595 out = ERR_PTR(-EIDRM);
596err:
597 rcu_read_unlock();
598 return out;
599}
600
601
602
603
604
605
606
607
608
609
610
611
612struct kern_ipc_perm *ipc_obtain_object_check(struct ipc_ids *ids, int id)
613{
614 struct kern_ipc_perm *out = ipc_obtain_object_idr(ids, id);
615
616 if (IS_ERR(out))
617 goto out;
618
619 if (ipc_checkid(out, id))
620 return ERR_PTR(-EINVAL);
621out:
622 return out;
623}
624
625
626
627
628
629
630
631
632
633
634
635int ipcget(struct ipc_namespace *ns, struct ipc_ids *ids,
636 const struct ipc_ops *ops, struct ipc_params *params)
637{
638 if (params->key == IPC_PRIVATE)
639 return ipcget_new(ns, ids, ops, params);
640 else
641 return ipcget_public(ns, ids, ops, params);
642}
643
644
645
646
647
648
649int ipc_update_perm(struct ipc64_perm *in, struct kern_ipc_perm *out)
650{
651 kuid_t uid = make_kuid(current_user_ns(), in->uid);
652 kgid_t gid = make_kgid(current_user_ns(), in->gid);
653 if (!uid_valid(uid) || !gid_valid(gid))
654 return -EINVAL;
655
656 out->uid = uid;
657 out->gid = gid;
658 out->mode = (out->mode & ~S_IRWXUGO)
659 | (in->mode & S_IRWXUGO);
660
661 return 0;
662}
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682struct kern_ipc_perm *ipcctl_pre_down_nolock(struct ipc_namespace *ns,
683 struct ipc_ids *ids, int id, int cmd,
684 struct ipc64_perm *perm, int extra_perm)
685{
686 kuid_t euid;
687 int err = -EPERM;
688 struct kern_ipc_perm *ipcp;
689
690 ipcp = ipc_obtain_object_check(ids, id);
691 if (IS_ERR(ipcp)) {
692 err = PTR_ERR(ipcp);
693 goto err;
694 }
695
696 audit_ipc_obj(ipcp);
697 if (cmd == IPC_SET)
698 audit_ipc_set_perm(extra_perm, perm->uid,
699 perm->gid, perm->mode);
700
701 euid = current_euid();
702 if (uid_eq(euid, ipcp->cuid) || uid_eq(euid, ipcp->uid) ||
703 ns_capable(ns->user_ns, CAP_SYS_ADMIN))
704 return ipcp;
705err:
706 return ERR_PTR(err);
707}
708
709#ifdef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
710
711
712
713
714
715
716
717
718
719
720int ipc_parse_version(int *cmd)
721{
722 if (*cmd & IPC_64) {
723 *cmd ^= IPC_64;
724 return IPC_64;
725 } else {
726 return IPC_OLD;
727 }
728}
729
730#endif
731
732#ifdef CONFIG_PROC_FS
733struct ipc_proc_iter {
734 struct ipc_namespace *ns;
735 struct ipc_proc_iface *iface;
736};
737
738
739
740
741static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos,
742 loff_t *new_pos)
743{
744 struct kern_ipc_perm *ipc;
745 int total, id;
746
747 total = 0;
748 for (id = 0; id < pos && total < ids->in_use; id++) {
749 ipc = idr_find(&ids->ipcs_idr, id);
750 if (ipc != NULL)
751 total++;
752 }
753
754 if (total >= ids->in_use)
755 return NULL;
756
757 for (; pos < IPCMNI; pos++) {
758 ipc = idr_find(&ids->ipcs_idr, pos);
759 if (ipc != NULL) {
760 *new_pos = pos + 1;
761 rcu_read_lock();
762 ipc_lock_object(ipc);
763 return ipc;
764 }
765 }
766
767
768 return NULL;
769}
770
771static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos)
772{
773 struct ipc_proc_iter *iter = s->private;
774 struct ipc_proc_iface *iface = iter->iface;
775 struct kern_ipc_perm *ipc = it;
776
777
778 if (ipc && ipc != SEQ_START_TOKEN)
779 ipc_unlock(ipc);
780
781 return sysvipc_find_ipc(&iter->ns->ids[iface->ids], *pos, pos);
782}
783
784
785
786
787
788static void *sysvipc_proc_start(struct seq_file *s, loff_t *pos)
789{
790 struct ipc_proc_iter *iter = s->private;
791 struct ipc_proc_iface *iface = iter->iface;
792 struct ipc_ids *ids;
793
794 ids = &iter->ns->ids[iface->ids];
795
796
797
798
799
800 down_read(&ids->rwsem);
801
802
803 if (*pos < 0)
804 return NULL;
805
806
807 if (*pos == 0)
808 return SEQ_START_TOKEN;
809
810
811 return sysvipc_find_ipc(ids, *pos - 1, pos);
812}
813
814static void sysvipc_proc_stop(struct seq_file *s, void *it)
815{
816 struct kern_ipc_perm *ipc = it;
817 struct ipc_proc_iter *iter = s->private;
818 struct ipc_proc_iface *iface = iter->iface;
819 struct ipc_ids *ids;
820
821
822 if (ipc && ipc != SEQ_START_TOKEN)
823 ipc_unlock(ipc);
824
825 ids = &iter->ns->ids[iface->ids];
826
827 up_read(&ids->rwsem);
828}
829
830static int sysvipc_proc_show(struct seq_file *s, void *it)
831{
832 struct ipc_proc_iter *iter = s->private;
833 struct ipc_proc_iface *iface = iter->iface;
834
835 if (it == SEQ_START_TOKEN) {
836 seq_puts(s, iface->header);
837 return 0;
838 }
839
840 return iface->show(s, it);
841}
842
843static const struct seq_operations sysvipc_proc_seqops = {
844 .start = sysvipc_proc_start,
845 .stop = sysvipc_proc_stop,
846 .next = sysvipc_proc_next,
847 .show = sysvipc_proc_show,
848};
849
850static int sysvipc_proc_open(struct inode *inode, struct file *file)
851{
852 struct ipc_proc_iter *iter;
853
854 iter = __seq_open_private(file, &sysvipc_proc_seqops, sizeof(*iter));
855 if (!iter)
856 return -ENOMEM;
857
858 iter->iface = PDE_DATA(inode);
859 iter->ns = get_ipc_ns(current->nsproxy->ipc_ns);
860
861 return 0;
862}
863
864static int sysvipc_proc_release(struct inode *inode, struct file *file)
865{
866 struct seq_file *seq = file->private_data;
867 struct ipc_proc_iter *iter = seq->private;
868 put_ipc_ns(iter->ns);
869 return seq_release_private(inode, file);
870}
871
872static const struct file_operations sysvipc_proc_fops = {
873 .open = sysvipc_proc_open,
874 .read = seq_read,
875 .llseek = seq_lseek,
876 .release = sysvipc_proc_release,
877};
878#endif
879