diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2011-06-15 13:21:48 -0400 |
|---|---|---|
| committer | Eric W. Biederman <ebiederm@xmission.com> | 2012-11-20 07:19:49 -0500 |
| commit | 98f842e675f96ffac96e6c50315790912b2812be (patch) | |
| tree | ed4dee9a6e54e3443e9f3f1614c8a2fcf9b31e0a /fs | |
| parent | bf056bfa80596a5d14b26b17276a56a0dcb080e5 (diff) | |
proc: Usable inode numbers for the namespace file descriptors.
Assign a unique proc inode to each namespace, and use that
inode number to ensure we only allocate at most one proc
inode for every namespace in proc.
A single proc inode per namespace allows userspace to test
to see if two processes are in the same namespace.
This has been a long requested feature and only blocked because
a naive implementation would put the id in a global space and
would ultimately require having a namespace for the names of
namespaces, making migration and certain virtualization tricks
impossible.
We still don't have per superblock inode numbers for proc, which
appears necessary for application unaware checkpoint/restart and
migrations (if the application is using namespace file descriptors)
but that is now allowd by the design if it becomes important.
I have preallocated the ipc and uts initial proc inode numbers so
their structures can be statically initialized.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/mount.h | 1 | ||||
| -rw-r--r-- | fs/namespace.c | 14 | ||||
| -rw-r--r-- | fs/proc/namespaces.c | 24 |
3 files changed, 29 insertions, 10 deletions
diff --git a/fs/mount.h b/fs/mount.h index 630fafc616bb..cd5007980400 100644 --- a/fs/mount.h +++ b/fs/mount.h | |||
| @@ -4,6 +4,7 @@ | |||
| 4 | 4 | ||
| 5 | struct mnt_namespace { | 5 | struct mnt_namespace { |
| 6 | atomic_t count; | 6 | atomic_t count; |
| 7 | unsigned int proc_inum; | ||
| 7 | struct mount * root; | 8 | struct mount * root; |
| 8 | struct list_head list; | 9 | struct list_head list; |
| 9 | struct user_namespace *user_ns; | 10 | struct user_namespace *user_ns; |
diff --git a/fs/namespace.c b/fs/namespace.c index cab78a74aca3..c1bbe86f4920 100644 --- a/fs/namespace.c +++ b/fs/namespace.c | |||
| @@ -2301,6 +2301,7 @@ dput_out: | |||
| 2301 | 2301 | ||
| 2302 | static void free_mnt_ns(struct mnt_namespace *ns) | 2302 | static void free_mnt_ns(struct mnt_namespace *ns) |
| 2303 | { | 2303 | { |
| 2304 | proc_free_inum(ns->proc_inum); | ||
| 2304 | put_user_ns(ns->user_ns); | 2305 | put_user_ns(ns->user_ns); |
| 2305 | kfree(ns); | 2306 | kfree(ns); |
| 2306 | } | 2307 | } |
| @@ -2317,10 +2318,16 @@ static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1); | |||
| 2317 | static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns) | 2318 | static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns) |
| 2318 | { | 2319 | { |
| 2319 | struct mnt_namespace *new_ns; | 2320 | struct mnt_namespace *new_ns; |
| 2321 | int ret; | ||
| 2320 | 2322 | ||
| 2321 | new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL); | 2323 | new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL); |
| 2322 | if (!new_ns) | 2324 | if (!new_ns) |
| 2323 | return ERR_PTR(-ENOMEM); | 2325 | return ERR_PTR(-ENOMEM); |
| 2326 | ret = proc_alloc_inum(&new_ns->proc_inum); | ||
| 2327 | if (ret) { | ||
| 2328 | kfree(new_ns); | ||
| 2329 | return ERR_PTR(ret); | ||
| 2330 | } | ||
| 2324 | new_ns->seq = atomic64_add_return(1, &mnt_ns_seq); | 2331 | new_ns->seq = atomic64_add_return(1, &mnt_ns_seq); |
| 2325 | atomic_set(&new_ns->count, 1); | 2332 | atomic_set(&new_ns->count, 1); |
| 2326 | new_ns->root = NULL; | 2333 | new_ns->root = NULL; |
| @@ -2799,10 +2806,17 @@ static int mntns_install(struct nsproxy *nsproxy, void *ns) | |||
| 2799 | return 0; | 2806 | return 0; |
| 2800 | } | 2807 | } |
| 2801 | 2808 | ||
| 2809 | static unsigned int mntns_inum(void *ns) | ||
| 2810 | { | ||
| 2811 | struct mnt_namespace *mnt_ns = ns; | ||
| 2812 | return mnt_ns->proc_inum; | ||
| 2813 | } | ||
| 2814 | |||
| 2802 | const struct proc_ns_operations mntns_operations = { | 2815 | const struct proc_ns_operations mntns_operations = { |
| 2803 | .name = "mnt", | 2816 | .name = "mnt", |
| 2804 | .type = CLONE_NEWNS, | 2817 | .type = CLONE_NEWNS, |
| 2805 | .get = mntns_get, | 2818 | .get = mntns_get, |
| 2806 | .put = mntns_put, | 2819 | .put = mntns_put, |
| 2807 | .install = mntns_install, | 2820 | .install = mntns_install, |
| 2821 | .inum = mntns_inum, | ||
| 2808 | }; | 2822 | }; |
diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c index 7a6d8d69cdb8..b7a47196c8c3 100644 --- a/fs/proc/namespaces.c +++ b/fs/proc/namespaces.c | |||
| @@ -82,7 +82,7 @@ static struct dentry *proc_ns_get_dentry(struct super_block *sb, | |||
| 82 | return ERR_PTR(-ENOMEM); | 82 | return ERR_PTR(-ENOMEM); |
| 83 | } | 83 | } |
| 84 | 84 | ||
| 85 | inode = new_inode(sb); | 85 | inode = iget_locked(sb, ns_ops->inum(ns)); |
| 86 | if (!inode) { | 86 | if (!inode) { |
| 87 | dput(dentry); | 87 | dput(dentry); |
| 88 | ns_ops->put(ns); | 88 | ns_ops->put(ns); |
| @@ -90,13 +90,17 @@ static struct dentry *proc_ns_get_dentry(struct super_block *sb, | |||
| 90 | } | 90 | } |
| 91 | 91 | ||
| 92 | ei = PROC_I(inode); | 92 | ei = PROC_I(inode); |
| 93 | inode->i_ino = get_next_ino(); | 93 | if (inode->i_state & I_NEW) { |
| 94 | inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; | 94 | inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; |
| 95 | inode->i_op = &ns_inode_operations; | 95 | inode->i_op = &ns_inode_operations; |
| 96 | inode->i_mode = S_IFREG | S_IRUGO; | 96 | inode->i_mode = S_IFREG | S_IRUGO; |
| 97 | inode->i_fop = &ns_file_operations; | 97 | inode->i_fop = &ns_file_operations; |
| 98 | ei->ns_ops = ns_ops; | 98 | ei->ns_ops = ns_ops; |
| 99 | ei->ns = ns; | 99 | ei->ns = ns; |
| 100 | unlock_new_inode(inode); | ||
| 101 | } else { | ||
| 102 | ns_ops->put(ns); | ||
| 103 | } | ||
| 100 | 104 | ||
| 101 | d_set_d_op(dentry, &ns_dentry_operations); | 105 | d_set_d_op(dentry, &ns_dentry_operations); |
| 102 | result = d_instantiate_unique(dentry, inode); | 106 | result = d_instantiate_unique(dentry, inode); |
| @@ -162,12 +166,12 @@ static int proc_ns_readlink(struct dentry *dentry, char __user *buffer, int bufl | |||
| 162 | if (!ns) | 166 | if (!ns) |
| 163 | goto out_put_task; | 167 | goto out_put_task; |
| 164 | 168 | ||
| 165 | snprintf(name, sizeof(name), "%s", ns_ops->name); | 169 | snprintf(name, sizeof(name), "%s:[%u]", ns_ops->name, ns_ops->inum(ns)); |
| 166 | len = strlen(name); | 170 | len = strlen(name); |
| 167 | 171 | ||
| 168 | if (len > buflen) | 172 | if (len > buflen) |
| 169 | len = buflen; | 173 | len = buflen; |
| 170 | if (copy_to_user(buffer, ns_ops->name, len)) | 174 | if (copy_to_user(buffer, name, len)) |
| 171 | len = -EFAULT; | 175 | len = -EFAULT; |
| 172 | 176 | ||
| 173 | ns_ops->put(ns); | 177 | ns_ops->put(ns); |