1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * Copyright (C) 2007 IBM Corporation |
4 | * |
5 | * Author: Cedric Le Goater <clg@fr.ibm.com> |
6 | */ |
7 | |
8 | #include <linux/nsproxy.h> |
9 | #include <linux/ipc_namespace.h> |
10 | #include <linux/sysctl.h> |
11 | |
12 | #include <linux/stat.h> |
13 | #include <linux/capability.h> |
14 | #include <linux/slab.h> |
15 | #include <linux/cred.h> |
16 | |
17 | static int msg_max_limit_min = MIN_MSGMAX; |
18 | static int msg_max_limit_max = HARD_MSGMAX; |
19 | |
20 | static int msg_maxsize_limit_min = MIN_MSGSIZEMAX; |
21 | static int msg_maxsize_limit_max = HARD_MSGSIZEMAX; |
22 | |
23 | static struct ctl_table mq_sysctls[] = { |
24 | { |
25 | .procname = "queues_max" , |
26 | .data = &init_ipc_ns.mq_queues_max, |
27 | .maxlen = sizeof(int), |
28 | .mode = 0644, |
29 | .proc_handler = proc_dointvec, |
30 | }, |
31 | { |
32 | .procname = "msg_max" , |
33 | .data = &init_ipc_ns.mq_msg_max, |
34 | .maxlen = sizeof(int), |
35 | .mode = 0644, |
36 | .proc_handler = proc_dointvec_minmax, |
37 | .extra1 = &msg_max_limit_min, |
38 | .extra2 = &msg_max_limit_max, |
39 | }, |
40 | { |
41 | .procname = "msgsize_max" , |
42 | .data = &init_ipc_ns.mq_msgsize_max, |
43 | .maxlen = sizeof(int), |
44 | .mode = 0644, |
45 | .proc_handler = proc_dointvec_minmax, |
46 | .extra1 = &msg_maxsize_limit_min, |
47 | .extra2 = &msg_maxsize_limit_max, |
48 | }, |
49 | { |
50 | .procname = "msg_default" , |
51 | .data = &init_ipc_ns.mq_msg_default, |
52 | .maxlen = sizeof(int), |
53 | .mode = 0644, |
54 | .proc_handler = proc_dointvec_minmax, |
55 | .extra1 = &msg_max_limit_min, |
56 | .extra2 = &msg_max_limit_max, |
57 | }, |
58 | { |
59 | .procname = "msgsize_default" , |
60 | .data = &init_ipc_ns.mq_msgsize_default, |
61 | .maxlen = sizeof(int), |
62 | .mode = 0644, |
63 | .proc_handler = proc_dointvec_minmax, |
64 | .extra1 = &msg_maxsize_limit_min, |
65 | .extra2 = &msg_maxsize_limit_max, |
66 | }, |
67 | {} |
68 | }; |
69 | |
70 | static struct ctl_table_set *set_lookup(struct ctl_table_root *root) |
71 | { |
72 | return ¤t->nsproxy->ipc_ns->mq_set; |
73 | } |
74 | |
75 | static int set_is_seen(struct ctl_table_set *set) |
76 | { |
77 | return ¤t->nsproxy->ipc_ns->mq_set == set; |
78 | } |
79 | |
80 | static void mq_set_ownership(struct ctl_table_header *head, |
81 | struct ctl_table *table, |
82 | kuid_t *uid, kgid_t *gid) |
83 | { |
84 | struct ipc_namespace *ns = |
85 | container_of(head->set, struct ipc_namespace, mq_set); |
86 | |
87 | kuid_t ns_root_uid = make_kuid(from: ns->user_ns, uid: 0); |
88 | kgid_t ns_root_gid = make_kgid(from: ns->user_ns, gid: 0); |
89 | |
90 | *uid = uid_valid(uid: ns_root_uid) ? ns_root_uid : GLOBAL_ROOT_UID; |
91 | *gid = gid_valid(ns_root_gid) ? ns_root_gid : GLOBAL_ROOT_GID; |
92 | } |
93 | |
94 | static int mq_permissions(struct ctl_table_header *head, struct ctl_table *table) |
95 | { |
96 | int mode = table->mode; |
97 | kuid_t ns_root_uid; |
98 | kgid_t ns_root_gid; |
99 | |
100 | mq_set_ownership(head, table, uid: &ns_root_uid, gid: &ns_root_gid); |
101 | |
102 | if (uid_eq(current_euid(), right: ns_root_uid)) |
103 | mode >>= 6; |
104 | |
105 | else if (in_egroup_p(ns_root_gid)) |
106 | mode >>= 3; |
107 | |
108 | mode &= 7; |
109 | |
110 | return (mode << 6) | (mode << 3) | mode; |
111 | } |
112 | |
113 | static struct ctl_table_root set_root = { |
114 | .lookup = set_lookup, |
115 | .permissions = mq_permissions, |
116 | .set_ownership = mq_set_ownership, |
117 | }; |
118 | |
119 | bool setup_mq_sysctls(struct ipc_namespace *ns) |
120 | { |
121 | struct ctl_table *tbl; |
122 | |
123 | setup_sysctl_set(p: &ns->mq_set, root: &set_root, is_seen: set_is_seen); |
124 | |
125 | tbl = kmemdup(p: mq_sysctls, size: sizeof(mq_sysctls), GFP_KERNEL); |
126 | if (tbl) { |
127 | int i; |
128 | |
129 | for (i = 0; i < ARRAY_SIZE(mq_sysctls); i++) { |
130 | if (tbl[i].data == &init_ipc_ns.mq_queues_max) |
131 | tbl[i].data = &ns->mq_queues_max; |
132 | |
133 | else if (tbl[i].data == &init_ipc_ns.mq_msg_max) |
134 | tbl[i].data = &ns->mq_msg_max; |
135 | |
136 | else if (tbl[i].data == &init_ipc_ns.mq_msgsize_max) |
137 | tbl[i].data = &ns->mq_msgsize_max; |
138 | |
139 | else if (tbl[i].data == &init_ipc_ns.mq_msg_default) |
140 | tbl[i].data = &ns->mq_msg_default; |
141 | |
142 | else if (tbl[i].data == &init_ipc_ns.mq_msgsize_default) |
143 | tbl[i].data = &ns->mq_msgsize_default; |
144 | else |
145 | tbl[i].data = NULL; |
146 | } |
147 | |
148 | ns->mq_sysctls = __register_sysctl_table(set: &ns->mq_set, |
149 | path: "fs/mqueue" , table: tbl, |
150 | ARRAY_SIZE(mq_sysctls)); |
151 | } |
152 | if (!ns->mq_sysctls) { |
153 | kfree(objp: tbl); |
154 | retire_sysctl_set(set: &ns->mq_set); |
155 | return false; |
156 | } |
157 | |
158 | return true; |
159 | } |
160 | |
161 | void retire_mq_sysctls(struct ipc_namespace *ns) |
162 | { |
163 | struct ctl_table *tbl; |
164 | |
165 | tbl = ns->mq_sysctls->ctl_table_arg; |
166 | unregister_sysctl_table(table: ns->mq_sysctls); |
167 | retire_sysctl_set(set: &ns->mq_set); |
168 | kfree(objp: tbl); |
169 | } |
170 | |