1 // SPDX-License-Identifier: GPL-2.0-only
2 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
4 #include <linux/workqueue.h>
5 #include <linux/rtnetlink.h>
6 #include <linux/cache.h>
7 #include <linux/slab.h>
8 #include <linux/list.h>
9 #include <linux/delay.h>
10 #include <linux/sched.h>
11 #include <linux/idr.h>
12 #include <linux/rculist.h>
13 #include <linux/nsproxy.h>
15 #include <linux/proc_ns.h>
16 #include <linux/file.h>
17 #include <linux/export.h>
18 #include <linux/user_namespace.h>
19 #include <linux/net_namespace.h>
20 #include <linux/sched/task.h>
21 #include <linux/uidgid.h>
22 #include <linux/cookie.h>
25 #include <net/netlink.h>
26 #include <net/net_namespace.h>
27 #include <net/netns/generic.h>
30 * Our network namespace constructor/destructor lists
33 static LIST_HEAD(pernet_list);
34 static struct list_head *first_device = &pernet_list;
36 LIST_HEAD(net_namespace_list);
37 EXPORT_SYMBOL_GPL(net_namespace_list);
39 /* Protects net_namespace_list. Nests iside rtnl_lock() */
40 DECLARE_RWSEM(net_rwsem);
41 EXPORT_SYMBOL_GPL(net_rwsem);
44 static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) };
47 struct net init_net = {
48 .count = REFCOUNT_INIT(1),
49 .dev_base_head = LIST_HEAD_INIT(init_net.dev_base_head),
51 .key_domain = &init_net_key_domain,
54 EXPORT_SYMBOL(init_net);
56 static bool init_net_initialized;
58 * pernet_ops_rwsem: protects: pernet_list, net_generic_ids,
59 * init_net_initialized and first_device pointer.
60 * This is internal net namespace object. Please, don't use it
63 DECLARE_RWSEM(pernet_ops_rwsem);
64 EXPORT_SYMBOL_GPL(pernet_ops_rwsem);
66 #define MIN_PERNET_OPS_ID \
67 ((sizeof(struct net_generic) + sizeof(void *) - 1) / sizeof(void *))
69 #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */
71 static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
73 DEFINE_COOKIE(net_cookie);
75 u64 __net_gen_cookie(struct net *net)
78 u64 res = atomic64_read(&net->net_cookie);
82 res = gen_cookie_next(&net_cookie);
83 atomic64_cmpxchg(&net->net_cookie, 0, res);
87 static struct net_generic *net_alloc_generic(void)
89 unsigned int gen_ptrs = READ_ONCE(max_gen_ptrs);
90 unsigned int generic_size;
91 struct net_generic *ng;
93 generic_size = offsetof(struct net_generic, ptr[gen_ptrs]);
95 ng = kzalloc(generic_size, GFP_KERNEL);
102 static int net_assign_generic(struct net *net, unsigned int id, void *data)
104 struct net_generic *ng, *old_ng;
106 BUG_ON(id < MIN_PERNET_OPS_ID);
108 old_ng = rcu_dereference_protected(net->gen,
109 lockdep_is_held(&pernet_ops_rwsem));
110 if (old_ng->s.len > id) {
111 old_ng->ptr[id] = data;
115 ng = net_alloc_generic();
120 * Some synchronisation notes:
122 * The net_generic explores the net->gen array inside rcu
123 * read section. Besides once set the net->gen->ptr[x]
124 * pointer never changes (see rules in netns/generic.h).
126 * That said, we simply duplicate this array and schedule
127 * the old copy for kfree after a grace period.
130 memcpy(&ng->ptr[MIN_PERNET_OPS_ID], &old_ng->ptr[MIN_PERNET_OPS_ID],
131 (old_ng->s.len - MIN_PERNET_OPS_ID) * sizeof(void *));
134 rcu_assign_pointer(net->gen, ng);
135 kfree_rcu(old_ng, s.rcu);
139 static int ops_init(const struct pernet_operations *ops, struct net *net)
141 struct net_generic *ng;
145 if (ops->id && ops->size) {
146 data = kzalloc(ops->size, GFP_KERNEL);
150 err = net_assign_generic(net, *ops->id, data);
156 err = ops->init(net);
160 if (ops->id && ops->size) {
161 ng = rcu_dereference_protected(net->gen,
162 lockdep_is_held(&pernet_ops_rwsem));
163 ng->ptr[*ops->id] = NULL;
173 static void ops_free(const struct pernet_operations *ops, struct net *net)
175 if (ops->id && ops->size) {
176 kfree(net_generic(net, *ops->id));
180 static void ops_pre_exit_list(const struct pernet_operations *ops,
181 struct list_head *net_exit_list)
186 list_for_each_entry(net, net_exit_list, exit_list)
191 static void ops_exit_list(const struct pernet_operations *ops,
192 struct list_head *net_exit_list)
196 list_for_each_entry(net, net_exit_list, exit_list) {
202 ops->exit_batch(net_exit_list);
205 static void ops_free_list(const struct pernet_operations *ops,
206 struct list_head *net_exit_list)
209 if (ops->size && ops->id) {
210 list_for_each_entry(net, net_exit_list, exit_list)
215 /* should be called with nsid_lock held */
216 static int alloc_netid(struct net *net, struct net *peer, int reqid)
218 int min = 0, max = 0;
225 return idr_alloc(&net->netns_ids, peer, min, max, GFP_ATOMIC);
228 /* This function is used by idr_for_each(). If net is equal to peer, the
229 * function returns the id so that idr_for_each() stops. Because we cannot
230 * returns the id 0 (idr_for_each() will not stop), we return the magic value
231 * NET_ID_ZERO (-1) for it.
233 #define NET_ID_ZERO -1
234 static int net_eq_idr(int id, void *net, void *peer)
236 if (net_eq(net, peer))
237 return id ? : NET_ID_ZERO;
241 /* Must be called from RCU-critical section or with nsid_lock held */
242 static int __peernet2id(const struct net *net, struct net *peer)
244 int id = idr_for_each(&net->netns_ids, net_eq_idr, peer);
246 /* Magic value for id 0. */
247 if (id == NET_ID_ZERO)
252 return NETNSA_NSID_NOT_ASSIGNED;
255 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
256 struct nlmsghdr *nlh, gfp_t gfp);
257 /* This function returns the id of a peer netns. If no id is assigned, one will
258 * be allocated and returned.
260 int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp)
264 if (refcount_read(&net->count) == 0)
265 return NETNSA_NSID_NOT_ASSIGNED;
267 spin_lock_bh(&net->nsid_lock);
268 id = __peernet2id(net, peer);
270 spin_unlock_bh(&net->nsid_lock);
274 /* When peer is obtained from RCU lists, we may race with
275 * its cleanup. Check whether it's alive, and this guarantees
276 * we never hash a peer back to net->netns_ids, after it has
277 * just been idr_remove()'d from there in cleanup_net().
279 if (!maybe_get_net(peer)) {
280 spin_unlock_bh(&net->nsid_lock);
281 return NETNSA_NSID_NOT_ASSIGNED;
284 id = alloc_netid(net, peer, -1);
285 spin_unlock_bh(&net->nsid_lock);
289 return NETNSA_NSID_NOT_ASSIGNED;
291 rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp);
295 EXPORT_SYMBOL_GPL(peernet2id_alloc);
297 /* This function returns, if assigned, the id of a peer netns. */
298 int peernet2id(const struct net *net, struct net *peer)
303 id = __peernet2id(net, peer);
308 EXPORT_SYMBOL(peernet2id);
310 /* This function returns true is the peer netns has an id assigned into the
313 bool peernet_has_id(const struct net *net, struct net *peer)
315 return peernet2id(net, peer) >= 0;
318 struct net *get_net_ns_by_id(const struct net *net, int id)
326 peer = idr_find(&net->netns_ids, id);
328 peer = maybe_get_net(peer);
335 * setup_net runs the initializers for the network namespace object.
337 static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
339 /* Must be called with pernet_ops_rwsem held */
340 const struct pernet_operations *ops, *saved_ops;
342 LIST_HEAD(net_exit_list);
344 refcount_set(&net->count, 1);
345 refcount_set(&net->passive, 1);
346 get_random_bytes(&net->hash_mix, sizeof(u32));
347 net->dev_base_seq = 1;
348 net->user_ns = user_ns;
349 idr_init(&net->netns_ids);
350 spin_lock_init(&net->nsid_lock);
351 mutex_init(&net->ipv4.ra_mutex);
353 list_for_each_entry(ops, &pernet_list, list) {
354 error = ops_init(ops, net);
358 down_write(&net_rwsem);
359 list_add_tail_rcu(&net->list, &net_namespace_list);
360 up_write(&net_rwsem);
365 /* Walk through the list backwards calling the exit functions
366 * for the pernet modules whose init functions did not fail.
368 list_add(&net->exit_list, &net_exit_list);
370 list_for_each_entry_continue_reverse(ops, &pernet_list, list)
371 ops_pre_exit_list(ops, &net_exit_list);
376 list_for_each_entry_continue_reverse(ops, &pernet_list, list)
377 ops_exit_list(ops, &net_exit_list);
380 list_for_each_entry_continue_reverse(ops, &pernet_list, list)
381 ops_free_list(ops, &net_exit_list);
387 static int __net_init net_defaults_init_net(struct net *net)
389 net->core.sysctl_somaxconn = SOMAXCONN;
393 static struct pernet_operations net_defaults_ops = {
394 .init = net_defaults_init_net,
397 static __init int net_defaults_init(void)
399 if (register_pernet_subsys(&net_defaults_ops))
400 panic("Cannot initialize net default settings");
405 core_initcall(net_defaults_init);
408 static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
410 return inc_ucount(ns, current_euid(), UCOUNT_NET_NAMESPACES);
413 static void dec_net_namespaces(struct ucounts *ucounts)
415 dec_ucount(ucounts, UCOUNT_NET_NAMESPACES);
418 static struct kmem_cache *net_cachep __ro_after_init;
419 static struct workqueue_struct *netns_wq;
421 static struct net *net_alloc(void)
423 struct net *net = NULL;
424 struct net_generic *ng;
426 ng = net_alloc_generic();
430 net = kmem_cache_zalloc(net_cachep, GFP_KERNEL);
435 net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL);
436 if (!net->key_domain)
438 refcount_set(&net->key_domain->usage, 1);
441 rcu_assign_pointer(net->gen, ng);
447 kmem_cache_free(net_cachep, net);
455 static void net_free(struct net *net)
457 kfree(rcu_access_pointer(net->gen));
458 kmem_cache_free(net_cachep, net);
461 void net_drop_ns(void *p)
464 if (ns && refcount_dec_and_test(&ns->passive))
468 struct net *copy_net_ns(unsigned long flags,
469 struct user_namespace *user_ns, struct net *old_net)
471 struct ucounts *ucounts;
475 if (!(flags & CLONE_NEWNET))
476 return get_net(old_net);
478 ucounts = inc_net_namespaces(user_ns);
480 return ERR_PTR(-ENOSPC);
487 refcount_set(&net->passive, 1);
488 net->ucounts = ucounts;
489 get_user_ns(user_ns);
491 rv = down_read_killable(&pernet_ops_rwsem);
495 rv = setup_net(net, user_ns);
497 up_read(&pernet_ops_rwsem);
502 key_remove_domain(net->key_domain);
504 put_user_ns(user_ns);
507 dec_net_namespaces(ucounts);
514 * net_ns_get_ownership - get sysfs ownership data for @net
515 * @net: network namespace in question (can be NULL)
516 * @uid: kernel user ID for sysfs objects
517 * @gid: kernel group ID for sysfs objects
519 * Returns the uid/gid pair of root in the user namespace associated with the
520 * given network namespace.
522 void net_ns_get_ownership(const struct net *net, kuid_t *uid, kgid_t *gid)
525 kuid_t ns_root_uid = make_kuid(net->user_ns, 0);
526 kgid_t ns_root_gid = make_kgid(net->user_ns, 0);
528 if (uid_valid(ns_root_uid))
531 if (gid_valid(ns_root_gid))
534 *uid = GLOBAL_ROOT_UID;
535 *gid = GLOBAL_ROOT_GID;
538 EXPORT_SYMBOL_GPL(net_ns_get_ownership);
540 static void unhash_nsid(struct net *net, struct net *last)
543 /* This function is only called from cleanup_net() work,
544 * and this work is the only process, that may delete
545 * a net from net_namespace_list. So, when the below
546 * is executing, the list may only grow. Thus, we do not
547 * use for_each_net_rcu() or net_rwsem.
552 spin_lock_bh(&tmp->nsid_lock);
553 id = __peernet2id(tmp, net);
555 idr_remove(&tmp->netns_ids, id);
556 spin_unlock_bh(&tmp->nsid_lock);
558 rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL,
563 spin_lock_bh(&net->nsid_lock);
564 idr_destroy(&net->netns_ids);
565 spin_unlock_bh(&net->nsid_lock);
568 static LLIST_HEAD(cleanup_list);
570 static void cleanup_net(struct work_struct *work)
572 const struct pernet_operations *ops;
573 struct net *net, *tmp, *last;
574 struct llist_node *net_kill_list;
575 LIST_HEAD(net_exit_list);
577 /* Atomically snapshot the list of namespaces to cleanup */
578 net_kill_list = llist_del_all(&cleanup_list);
580 down_read(&pernet_ops_rwsem);
582 /* Don't let anyone else find us. */
583 down_write(&net_rwsem);
584 llist_for_each_entry(net, net_kill_list, cleanup_list)
585 list_del_rcu(&net->list);
586 /* Cache last net. After we unlock rtnl, no one new net
587 * added to net_namespace_list can assign nsid pointer
588 * to a net from net_kill_list (see peernet2id_alloc()).
589 * So, we skip them in unhash_nsid().
591 * Note, that unhash_nsid() does not delete nsid links
592 * between net_kill_list's nets, as they've already
593 * deleted from net_namespace_list. But, this would be
594 * useless anyway, as netns_ids are destroyed there.
596 last = list_last_entry(&net_namespace_list, struct net, list);
597 up_write(&net_rwsem);
599 llist_for_each_entry(net, net_kill_list, cleanup_list) {
600 unhash_nsid(net, last);
601 list_add_tail(&net->exit_list, &net_exit_list);
604 /* Run all of the network namespace pre_exit methods */
605 list_for_each_entry_reverse(ops, &pernet_list, list)
606 ops_pre_exit_list(ops, &net_exit_list);
609 * Another CPU might be rcu-iterating the list, wait for it.
610 * This needs to be before calling the exit() notifiers, so
611 * the rcu_barrier() below isn't sufficient alone.
612 * Also the pre_exit() and exit() methods need this barrier.
616 /* Run all of the network namespace exit methods */
617 list_for_each_entry_reverse(ops, &pernet_list, list)
618 ops_exit_list(ops, &net_exit_list);
620 /* Free the net generic variables */
621 list_for_each_entry_reverse(ops, &pernet_list, list)
622 ops_free_list(ops, &net_exit_list);
624 up_read(&pernet_ops_rwsem);
626 /* Ensure there are no outstanding rcu callbacks using this
631 /* Finally it is safe to free my network namespace structure */
632 list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
633 list_del_init(&net->exit_list);
634 dec_net_namespaces(net->ucounts);
636 key_remove_domain(net->key_domain);
638 put_user_ns(net->user_ns);
644 * net_ns_barrier - wait until concurrent net_cleanup_work is done
646 * cleanup_net runs from work queue and will first remove namespaces
647 * from the global list, then run net exit functions.
649 * Call this in module exit path to make sure that all netns
650 * ->exit ops have been invoked before the function is removed.
652 void net_ns_barrier(void)
654 down_write(&pernet_ops_rwsem);
655 up_write(&pernet_ops_rwsem);
657 EXPORT_SYMBOL(net_ns_barrier);
659 static DECLARE_WORK(net_cleanup_work, cleanup_net);
661 void __put_net(struct net *net)
663 /* Cleanup the network namespace in process context */
664 if (llist_add(&net->cleanup_list, &cleanup_list))
665 queue_work(netns_wq, &net_cleanup_work);
667 EXPORT_SYMBOL_GPL(__put_net);
670 * get_net_ns - increment the refcount of the network namespace
671 * @ns: common namespace (net)
673 * Returns the net's common namespace.
675 struct ns_common *get_net_ns(struct ns_common *ns)
677 return &get_net(container_of(ns, struct net, ns))->ns;
679 EXPORT_SYMBOL_GPL(get_net_ns);
681 struct net *get_net_ns_by_fd(int fd)
684 struct ns_common *ns;
687 file = proc_ns_fget(fd);
689 return ERR_CAST(file);
691 ns = get_proc_ns(file_inode(file));
692 if (ns->ops == &netns_operations)
693 net = get_net(container_of(ns, struct net, ns));
695 net = ERR_PTR(-EINVAL);
702 struct net *get_net_ns_by_fd(int fd)
704 return ERR_PTR(-EINVAL);
707 EXPORT_SYMBOL_GPL(get_net_ns_by_fd);
709 struct net *get_net_ns_by_pid(pid_t pid)
711 struct task_struct *tsk;
714 /* Lookup the network namespace */
715 net = ERR_PTR(-ESRCH);
717 tsk = find_task_by_vpid(pid);
719 struct nsproxy *nsproxy;
721 nsproxy = tsk->nsproxy;
723 net = get_net(nsproxy->net_ns);
729 EXPORT_SYMBOL_GPL(get_net_ns_by_pid);
731 static __net_init int net_ns_net_init(struct net *net)
734 net->ns.ops = &netns_operations;
736 return ns_alloc_inum(&net->ns);
739 static __net_exit void net_ns_net_exit(struct net *net)
741 ns_free_inum(&net->ns);
744 static struct pernet_operations __net_initdata net_ns_ops = {
745 .init = net_ns_net_init,
746 .exit = net_ns_net_exit,
749 static const struct nla_policy rtnl_net_policy[NETNSA_MAX + 1] = {
750 [NETNSA_NONE] = { .type = NLA_UNSPEC },
751 [NETNSA_NSID] = { .type = NLA_S32 },
752 [NETNSA_PID] = { .type = NLA_U32 },
753 [NETNSA_FD] = { .type = NLA_U32 },
754 [NETNSA_TARGET_NSID] = { .type = NLA_S32 },
757 static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
758 struct netlink_ext_ack *extack)
760 struct net *net = sock_net(skb->sk);
761 struct nlattr *tb[NETNSA_MAX + 1];
766 err = nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg), tb,
767 NETNSA_MAX, rtnl_net_policy, extack);
770 if (!tb[NETNSA_NSID]) {
771 NL_SET_ERR_MSG(extack, "nsid is missing");
774 nsid = nla_get_s32(tb[NETNSA_NSID]);
776 if (tb[NETNSA_PID]) {
777 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
778 nla = tb[NETNSA_PID];
779 } else if (tb[NETNSA_FD]) {
780 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
783 NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
787 NL_SET_BAD_ATTR(extack, nla);
788 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
789 return PTR_ERR(peer);
792 spin_lock_bh(&net->nsid_lock);
793 if (__peernet2id(net, peer) >= 0) {
794 spin_unlock_bh(&net->nsid_lock);
796 NL_SET_BAD_ATTR(extack, nla);
797 NL_SET_ERR_MSG(extack,
798 "Peer netns already has a nsid assigned");
802 err = alloc_netid(net, peer, nsid);
803 spin_unlock_bh(&net->nsid_lock);
805 rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid,
808 } else if (err == -ENOSPC && nsid >= 0) {
810 NL_SET_BAD_ATTR(extack, tb[NETNSA_NSID]);
811 NL_SET_ERR_MSG(extack, "The specified nsid is already used");
818 static int rtnl_net_get_size(void)
820 return NLMSG_ALIGN(sizeof(struct rtgenmsg))
821 + nla_total_size(sizeof(s32)) /* NETNSA_NSID */
822 + nla_total_size(sizeof(s32)) /* NETNSA_CURRENT_NSID */
826 struct net_fill_args {
836 static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args)
838 struct nlmsghdr *nlh;
839 struct rtgenmsg *rth;
841 nlh = nlmsg_put(skb, args->portid, args->seq, args->cmd, sizeof(*rth),
846 rth = nlmsg_data(nlh);
847 rth->rtgen_family = AF_UNSPEC;
849 if (nla_put_s32(skb, NETNSA_NSID, args->nsid))
850 goto nla_put_failure;
853 nla_put_s32(skb, NETNSA_CURRENT_NSID, args->ref_nsid))
854 goto nla_put_failure;
860 nlmsg_cancel(skb, nlh);
864 static int rtnl_net_valid_getid_req(struct sk_buff *skb,
865 const struct nlmsghdr *nlh,
867 struct netlink_ext_ack *extack)
871 if (!netlink_strict_get_check(skb))
872 return nlmsg_parse_deprecated(nlh, sizeof(struct rtgenmsg),
873 tb, NETNSA_MAX, rtnl_net_policy,
876 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
877 NETNSA_MAX, rtnl_net_policy,
882 for (i = 0; i <= NETNSA_MAX; i++) {
890 case NETNSA_TARGET_NSID:
893 NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request");
901 static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh,
902 struct netlink_ext_ack *extack)
904 struct net *net = sock_net(skb->sk);
905 struct nlattr *tb[NETNSA_MAX + 1];
906 struct net_fill_args fillargs = {
907 .portid = NETLINK_CB(skb).portid,
908 .seq = nlh->nlmsg_seq,
911 struct net *peer, *target = net;
916 err = rtnl_net_valid_getid_req(skb, nlh, tb, extack);
919 if (tb[NETNSA_PID]) {
920 peer = get_net_ns_by_pid(nla_get_u32(tb[NETNSA_PID]));
921 nla = tb[NETNSA_PID];
922 } else if (tb[NETNSA_FD]) {
923 peer = get_net_ns_by_fd(nla_get_u32(tb[NETNSA_FD]));
925 } else if (tb[NETNSA_NSID]) {
926 peer = get_net_ns_by_id(net, nla_get_s32(tb[NETNSA_NSID]));
928 peer = ERR_PTR(-ENOENT);
929 nla = tb[NETNSA_NSID];
931 NL_SET_ERR_MSG(extack, "Peer netns reference is missing");
936 NL_SET_BAD_ATTR(extack, nla);
937 NL_SET_ERR_MSG(extack, "Peer netns reference is invalid");
938 return PTR_ERR(peer);
941 if (tb[NETNSA_TARGET_NSID]) {
942 int id = nla_get_s32(tb[NETNSA_TARGET_NSID]);
944 target = rtnl_get_net_ns_capable(NETLINK_CB(skb).sk, id);
945 if (IS_ERR(target)) {
946 NL_SET_BAD_ATTR(extack, tb[NETNSA_TARGET_NSID]);
947 NL_SET_ERR_MSG(extack,
948 "Target netns reference is invalid");
949 err = PTR_ERR(target);
952 fillargs.add_ref = true;
953 fillargs.ref_nsid = peernet2id(net, peer);
956 msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
962 fillargs.nsid = peernet2id(target, peer);
963 err = rtnl_net_fill(msg, &fillargs);
967 err = rtnl_unicast(msg, net, NETLINK_CB(skb).portid);
973 if (fillargs.add_ref)
979 struct rtnl_net_dump_cb {
983 struct net_fill_args fillargs;
988 /* Runs in RCU-critical section. */
989 static int rtnl_net_dumpid_one(int id, void *peer, void *data)
991 struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data;
994 if (net_cb->idx < net_cb->s_idx)
997 net_cb->fillargs.nsid = id;
998 if (net_cb->fillargs.add_ref)
999 net_cb->fillargs.ref_nsid = __peernet2id(net_cb->ref_net, peer);
1000 ret = rtnl_net_fill(net_cb->skb, &net_cb->fillargs);
1009 static int rtnl_valid_dump_net_req(const struct nlmsghdr *nlh, struct sock *sk,
1010 struct rtnl_net_dump_cb *net_cb,
1011 struct netlink_callback *cb)
1013 struct netlink_ext_ack *extack = cb->extack;
1014 struct nlattr *tb[NETNSA_MAX + 1];
1017 err = nlmsg_parse_deprecated_strict(nlh, sizeof(struct rtgenmsg), tb,
1018 NETNSA_MAX, rtnl_net_policy,
1023 for (i = 0; i <= NETNSA_MAX; i++) {
1027 if (i == NETNSA_TARGET_NSID) {
1030 net = rtnl_get_net_ns_capable(sk, nla_get_s32(tb[i]));
1032 NL_SET_BAD_ATTR(extack, tb[i]);
1033 NL_SET_ERR_MSG(extack,
1034 "Invalid target network namespace id");
1035 return PTR_ERR(net);
1037 net_cb->fillargs.add_ref = true;
1038 net_cb->ref_net = net_cb->tgt_net;
1039 net_cb->tgt_net = net;
1041 NL_SET_BAD_ATTR(extack, tb[i]);
1042 NL_SET_ERR_MSG(extack,
1043 "Unsupported attribute in dump request");
1051 static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb)
1053 struct rtnl_net_dump_cb net_cb = {
1054 .tgt_net = sock_net(skb->sk),
1057 .portid = NETLINK_CB(cb->skb).portid,
1058 .seq = cb->nlh->nlmsg_seq,
1059 .flags = NLM_F_MULTI,
1063 .s_idx = cb->args[0],
1067 if (cb->strict_check) {
1068 err = rtnl_valid_dump_net_req(cb->nlh, skb->sk, &net_cb, cb);
1074 idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb);
1077 cb->args[0] = net_cb.idx;
1079 if (net_cb.fillargs.add_ref)
1080 put_net(net_cb.tgt_net);
1081 return err < 0 ? err : skb->len;
1084 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
1085 struct nlmsghdr *nlh, gfp_t gfp)
1087 struct net_fill_args fillargs = {
1089 .seq = nlh ? nlh->nlmsg_seq : 0,
1093 struct sk_buff *msg;
1096 msg = nlmsg_new(rtnl_net_get_size(), gfp);
1100 err = rtnl_net_fill(msg, &fillargs);
1104 rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp);
1110 rtnl_set_sk_err(net, RTNLGRP_NSID, err);
1113 static int __init net_ns_init(void)
1115 struct net_generic *ng;
1117 #ifdef CONFIG_NET_NS
1118 net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
1120 SLAB_PANIC|SLAB_ACCOUNT, NULL);
1122 /* Create workqueue for cleanup */
1123 netns_wq = create_singlethread_workqueue("netns");
1125 panic("Could not create netns workq");
1128 ng = net_alloc_generic();
1130 panic("Could not allocate generic netns");
1132 rcu_assign_pointer(init_net.gen, ng);
1135 __net_gen_cookie(&init_net);
1138 down_write(&pernet_ops_rwsem);
1139 if (setup_net(&init_net, &init_user_ns))
1140 panic("Could not setup the initial network namespace");
1142 init_net_initialized = true;
1143 up_write(&pernet_ops_rwsem);
1145 if (register_pernet_subsys(&net_ns_ops))
1146 panic("Could not register network namespace subsystems");
1148 rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL,
1149 RTNL_FLAG_DOIT_UNLOCKED);
1150 rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid,
1151 RTNL_FLAG_DOIT_UNLOCKED);
1156 pure_initcall(net_ns_init);
1158 #ifdef CONFIG_NET_NS
1159 static int __register_pernet_operations(struct list_head *list,
1160 struct pernet_operations *ops)
1164 LIST_HEAD(net_exit_list);
1166 list_add_tail(&ops->list, list);
1167 if (ops->init || (ops->id && ops->size)) {
1168 /* We held write locked pernet_ops_rwsem, and parallel
1169 * setup_net() and cleanup_net() are not possible.
1172 error = ops_init(ops, net);
1175 list_add_tail(&net->exit_list, &net_exit_list);
1181 /* If I have an error cleanup all namespaces I initialized */
1182 list_del(&ops->list);
1183 ops_pre_exit_list(ops, &net_exit_list);
1185 ops_exit_list(ops, &net_exit_list);
1186 ops_free_list(ops, &net_exit_list);
1190 static void __unregister_pernet_operations(struct pernet_operations *ops)
1193 LIST_HEAD(net_exit_list);
1195 list_del(&ops->list);
1196 /* See comment in __register_pernet_operations() */
1198 list_add_tail(&net->exit_list, &net_exit_list);
1199 ops_pre_exit_list(ops, &net_exit_list);
1201 ops_exit_list(ops, &net_exit_list);
1202 ops_free_list(ops, &net_exit_list);
1207 static int __register_pernet_operations(struct list_head *list,
1208 struct pernet_operations *ops)
1210 if (!init_net_initialized) {
1211 list_add_tail(&ops->list, list);
1215 return ops_init(ops, &init_net);
1218 static void __unregister_pernet_operations(struct pernet_operations *ops)
1220 if (!init_net_initialized) {
1221 list_del(&ops->list);
1223 LIST_HEAD(net_exit_list);
1224 list_add(&init_net.exit_list, &net_exit_list);
1225 ops_pre_exit_list(ops, &net_exit_list);
1227 ops_exit_list(ops, &net_exit_list);
1228 ops_free_list(ops, &net_exit_list);
1232 #endif /* CONFIG_NET_NS */
1234 static DEFINE_IDA(net_generic_ids);
1236 static int register_pernet_operations(struct list_head *list,
1237 struct pernet_operations *ops)
1242 error = ida_alloc_min(&net_generic_ids, MIN_PERNET_OPS_ID,
1247 /* This does not require READ_ONCE as writers already hold
1248 * pernet_ops_rwsem. But WRITE_ONCE is needed to protect
1249 * net_alloc_generic.
1251 WRITE_ONCE(max_gen_ptrs, max(max_gen_ptrs, *ops->id + 1));
1253 error = __register_pernet_operations(list, ops);
1257 ida_free(&net_generic_ids, *ops->id);
1263 static void unregister_pernet_operations(struct pernet_operations *ops)
1265 __unregister_pernet_operations(ops);
1268 ida_free(&net_generic_ids, *ops->id);
1272 * register_pernet_subsys - register a network namespace subsystem
1273 * @ops: pernet operations structure for the subsystem
1275 * Register a subsystem which has init and exit functions
1276 * that are called when network namespaces are created and
1277 * destroyed respectively.
1279 * When registered all network namespace init functions are
1280 * called for every existing network namespace. Allowing kernel
1281 * modules to have a race free view of the set of network namespaces.
1283 * When a new network namespace is created all of the init
1284 * methods are called in the order in which they were registered.
1286 * When a network namespace is destroyed all of the exit methods
1287 * are called in the reverse of the order with which they were
1290 int register_pernet_subsys(struct pernet_operations *ops)
1293 down_write(&pernet_ops_rwsem);
1294 error = register_pernet_operations(first_device, ops);
1295 up_write(&pernet_ops_rwsem);
1298 EXPORT_SYMBOL_GPL(register_pernet_subsys);
1301 * unregister_pernet_subsys - unregister a network namespace subsystem
1302 * @ops: pernet operations structure to manipulate
1304 * Remove the pernet operations structure from the list to be
1305 * used when network namespaces are created or destroyed. In
1306 * addition run the exit method for all existing network
1309 void unregister_pernet_subsys(struct pernet_operations *ops)
1311 down_write(&pernet_ops_rwsem);
1312 unregister_pernet_operations(ops);
1313 up_write(&pernet_ops_rwsem);
1315 EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
1318 * register_pernet_device - register a network namespace device
1319 * @ops: pernet operations structure for the subsystem
1321 * Register a device which has init and exit functions
1322 * that are called when network namespaces are created and
1323 * destroyed respectively.
1325 * When registered all network namespace init functions are
1326 * called for every existing network namespace. Allowing kernel
1327 * modules to have a race free view of the set of network namespaces.
1329 * When a new network namespace is created all of the init
1330 * methods are called in the order in which they were registered.
1332 * When a network namespace is destroyed all of the exit methods
1333 * are called in the reverse of the order with which they were
1336 int register_pernet_device(struct pernet_operations *ops)
1339 down_write(&pernet_ops_rwsem);
1340 error = register_pernet_operations(&pernet_list, ops);
1341 if (!error && (first_device == &pernet_list))
1342 first_device = &ops->list;
1343 up_write(&pernet_ops_rwsem);
1346 EXPORT_SYMBOL_GPL(register_pernet_device);
1349 * unregister_pernet_device - unregister a network namespace netdevice
1350 * @ops: pernet operations structure to manipulate
1352 * Remove the pernet operations structure from the list to be
1353 * used when network namespaces are created or destroyed. In
1354 * addition run the exit method for all existing network
1357 void unregister_pernet_device(struct pernet_operations *ops)
1359 down_write(&pernet_ops_rwsem);
1360 if (&ops->list == first_device)
1361 first_device = first_device->next;
1362 unregister_pernet_operations(ops);
1363 up_write(&pernet_ops_rwsem);
1365 EXPORT_SYMBOL_GPL(unregister_pernet_device);
1367 #ifdef CONFIG_NET_NS
1368 static struct ns_common *netns_get(struct task_struct *task)
1370 struct net *net = NULL;
1371 struct nsproxy *nsproxy;
1374 nsproxy = task->nsproxy;
1376 net = get_net(nsproxy->net_ns);
1379 return net ? &net->ns : NULL;
1382 static inline struct net *to_net_ns(struct ns_common *ns)
1384 return container_of(ns, struct net, ns);
1387 static void netns_put(struct ns_common *ns)
1389 put_net(to_net_ns(ns));
1392 static int netns_install(struct nsset *nsset, struct ns_common *ns)
1394 struct nsproxy *nsproxy = nsset->nsproxy;
1395 struct net *net = to_net_ns(ns);
1397 if (!ns_capable(net->user_ns, CAP_SYS_ADMIN) ||
1398 !ns_capable(nsset->cred->user_ns, CAP_SYS_ADMIN))
1401 put_net(nsproxy->net_ns);
1402 nsproxy->net_ns = get_net(net);
1406 static struct user_namespace *netns_owner(struct ns_common *ns)
1408 return to_net_ns(ns)->user_ns;
1411 const struct proc_ns_operations netns_operations = {
1413 .type = CLONE_NEWNET,
1416 .install = netns_install,
1417 .owner = netns_owner,