3 * Copyright (C) 1992 Krishna Balasubramanian
5 * Sep 1997 - Call suser() last after "normal" permission checks so we
6 * get BSD style process accounting right.
7 * Occurs in several places in the IPC code.
8 * Chris Evans, <chris@ferret.lmh.ox.ac.uk>
9 * Nov 1999 - ipc helper functions, unified SMP locking
10 * Manfred Spraul <manfred@colorfullife.com>
11 * Oct 2002 - One lock per IPC id. RCU ipc_free for lock-free grow_ary().
12 * Mingming Cao <cmm@us.ibm.com>
13 * Mar 2006 - support for audit of ipc object properties
14 * Dustin Kirkland <dustin.kirkland@us.ibm.com>
15 * Jun 2006 - namespaces ssupport
17 * Pavel Emelianov <xemul@openvz.org>
19 * General sysv ipc locking scheme:
21 * obtain the ipc object (kern_ipc_perm) by looking up the id in an idr
23 * - perform initial checks (capabilities, auditing and permission,
25 * - perform read-only operations, such as STAT, INFO commands.
26 * acquire the ipc lock (kern_ipc_perm.lock) through
28 * - perform data updates, such as SET, RMID commands and
29 * mechanism-specific operations (semop/semtimedop,
30 * msgsnd/msgrcv, shmat/shmdt).
31 * drop the ipc lock, through ipc_unlock_object().
34 * The ids->rwsem must be taken when:
35 * - creating, removing and iterating the existing entries in ipc
37 * - iterating through files under /proc/sysvipc/
39 * Note that sems have a special fast path that avoids kern_ipc_perm.lock -
44 #include <linux/shm.h>
45 #include <linux/init.h>
46 #include <linux/msg.h>
47 #include <linux/vmalloc.h>
48 #include <linux/slab.h>
49 #include <linux/notifier.h>
50 #include <linux/capability.h>
51 #include <linux/highuid.h>
52 #include <linux/security.h>
53 #include <linux/rcupdate.h>
54 #include <linux/workqueue.h>
55 #include <linux/seq_file.h>
56 #include <linux/proc_fs.h>
57 #include <linux/audit.h>
58 #include <linux/nsproxy.h>
59 #include <linux/rwsem.h>
60 #include <linux/memory.h>
61 #include <linux/ipc_namespace.h>
63 #include <asm/unistd.h>
67 struct ipc_proc_iface
{
71 int (*show
)(struct seq_file
*, void *);
75 * ipc_init - initialise ipc subsystem
77 * The various sysv ipc resources (semaphores, messages and shared
78 * memory) are initialised.
80 * A callback routine is registered into the memory hotplug notifier
81 * chain: since msgmni scales to lowmem this callback routine will be
82 * called upon successful memory add / remove to recompute msmgni.
84 static int __init
ipc_init(void)
89 WARN(err_sem
, "ipc: sysv sem_init failed: %d\n", err_sem
);
91 WARN(err_msg
, "ipc: sysv msg_init failed: %d\n", err_msg
);
94 return err_msg
? err_msg
: err_sem
;
96 device_initcall(ipc_init
);
98 static const struct rhashtable_params ipc_kht_params
= {
99 .head_offset
= offsetof(struct kern_ipc_perm
, khtnode
),
100 .key_offset
= offsetof(struct kern_ipc_perm
, key
),
101 .key_len
= FIELD_SIZEOF(struct kern_ipc_perm
, key
),
103 .automatic_shrinking
= true,
107 * ipc_init_ids - initialise ipc identifiers
108 * @ids: ipc identifier set
110 * Set up the sequence range to use for the ipc identifier range (limited
111 * below IPCMNI) then initialise the keys hashtable and ids idr.
113 int ipc_init_ids(struct ipc_ids
*ids
)
119 init_rwsem(&ids
->rwsem
);
120 err
= rhashtable_init(&ids
->key_ht
, &ipc_kht_params
);
123 idr_init(&ids
->ipcs_idr
);
124 ids
->tables_initialized
= true;
128 #ifdef CONFIG_PROC_FS
129 static const struct file_operations sysvipc_proc_fops
;
131 * ipc_init_proc_interface - create a proc interface for sysipc types using a seq_file interface.
132 * @path: Path in procfs
133 * @header: Banner to be printed at the beginning of the file.
134 * @ids: ipc id table to iterate.
135 * @show: show routine.
137 void __init
ipc_init_proc_interface(const char *path
, const char *header
,
138 int ids
, int (*show
)(struct seq_file
*, void *))
140 struct proc_dir_entry
*pde
;
141 struct ipc_proc_iface
*iface
;
143 iface
= kmalloc(sizeof(*iface
), GFP_KERNEL
);
147 iface
->header
= header
;
151 pde
= proc_create_data(path
,
152 S_IRUGO
, /* world readable */
153 NULL
, /* parent dir */
162 * ipc_findkey - find a key in an ipc identifier set
163 * @ids: ipc identifier set
166 * Returns the locked pointer to the ipc structure if found or NULL
167 * otherwise. If key is found ipc points to the owning ipc structure
169 * Called with writer ipc_ids.rwsem held.
171 static struct kern_ipc_perm
*ipc_findkey(struct ipc_ids
*ids
, key_t key
)
173 struct kern_ipc_perm
*ipcp
= NULL
;
175 if (likely(ids
->tables_initialized
))
176 ipcp
= rhashtable_lookup_fast(&ids
->key_ht
, &key
,
181 ipc_lock_object(ipcp
);
189 * ipc_get_maxid - get the last assigned id
190 * @ids: ipc identifier set
192 * Called with ipc_ids.rwsem held.
194 int ipc_get_maxid(struct ipc_ids
*ids
)
196 struct kern_ipc_perm
*ipc
;
200 if (ids
->in_use
== 0)
203 if (ids
->in_use
== IPCMNI
)
206 /* Look for the last assigned id */
208 for (id
= 0; id
< IPCMNI
&& total
< ids
->in_use
; id
++) {
209 ipc
= idr_find(&ids
->ipcs_idr
, id
);
219 * ipc_addid - add an ipc identifier
220 * @ids: ipc identifier set
221 * @new: new ipc permission set
222 * @size: limit for the number of used ids
224 * Add an entry 'new' to the ipc ids idr. The permissions object is
225 * initialised and the first free entry is set up and the id assigned
226 * is returned. The 'new' entry is returned in a locked state on success.
227 * On failure the entry is not locked and a negative err-code is returned.
229 * Called with writer ipc_ids.rwsem held.
231 int ipc_addid(struct ipc_ids
*ids
, struct kern_ipc_perm
*new, int size
)
236 int next_id
= ids
->next_id
;
241 if (!ids
->tables_initialized
|| ids
->in_use
>= size
)
244 idr_preload(GFP_KERNEL
);
246 refcount_set(&new->refcount
, 1);
247 spin_lock_init(&new->lock
);
248 new->deleted
= false;
250 spin_lock(&new->lock
);
252 current_euid_egid(&euid
, &egid
);
253 new->cuid
= new->uid
= euid
;
254 new->gid
= new->cgid
= egid
;
256 id
= idr_alloc(&ids
->ipcs_idr
, new,
257 (next_id
< 0) ? 0 : ipcid_to_idx(next_id
), 0,
261 if (id
>= 0 && new->key
!= IPC_PRIVATE
) {
262 err
= rhashtable_insert_fast(&ids
->key_ht
, &new->khtnode
,
265 idr_remove(&ids
->ipcs_idr
, id
);
270 spin_unlock(&new->lock
);
278 new->seq
= ids
->seq
++;
279 if (ids
->seq
> IPCID_SEQ_MAX
)
282 new->seq
= ipcid_to_seqx(next_id
);
286 new->id
= ipc_buildid(id
, new->seq
);
291 * ipcget_new - create a new ipc object
293 * @ids: ipc identifier set
294 * @ops: the actual creation routine to call
295 * @params: its parameters
297 * This routine is called by sys_msgget, sys_semget() and sys_shmget()
298 * when the key is IPC_PRIVATE.
300 static int ipcget_new(struct ipc_namespace
*ns
, struct ipc_ids
*ids
,
301 const struct ipc_ops
*ops
, struct ipc_params
*params
)
305 down_write(&ids
->rwsem
);
306 err
= ops
->getnew(ns
, params
);
307 up_write(&ids
->rwsem
);
312 * ipc_check_perms - check security and permissions for an ipc object
314 * @ipcp: ipc permission set
315 * @ops: the actual security routine to call
316 * @params: its parameters
318 * This routine is called by sys_msgget(), sys_semget() and sys_shmget()
319 * when the key is not IPC_PRIVATE and that key already exists in the
322 * On success, the ipc id is returned.
324 * It is called with ipc_ids.rwsem and ipcp->lock held.
326 static int ipc_check_perms(struct ipc_namespace
*ns
,
327 struct kern_ipc_perm
*ipcp
,
328 const struct ipc_ops
*ops
,
329 struct ipc_params
*params
)
333 if (ipcperms(ns
, ipcp
, params
->flg
))
336 err
= ops
->associate(ipcp
, params
->flg
);
345 * ipcget_public - get an ipc object or create a new one
347 * @ids: ipc identifier set
348 * @ops: the actual creation routine to call
349 * @params: its parameters
351 * This routine is called by sys_msgget, sys_semget() and sys_shmget()
352 * when the key is not IPC_PRIVATE.
353 * It adds a new entry if the key is not found and does some permission
354 * / security checkings if the key is found.
356 * On success, the ipc id is returned.
358 static int ipcget_public(struct ipc_namespace
*ns
, struct ipc_ids
*ids
,
359 const struct ipc_ops
*ops
, struct ipc_params
*params
)
361 struct kern_ipc_perm
*ipcp
;
362 int flg
= params
->flg
;
366 * Take the lock as a writer since we are potentially going to add
367 * a new entry + read locks are not "upgradable"
369 down_write(&ids
->rwsem
);
370 ipcp
= ipc_findkey(ids
, params
->key
);
373 if (!(flg
& IPC_CREAT
))
376 err
= ops
->getnew(ns
, params
);
378 /* ipc object has been locked by ipc_findkey() */
380 if (flg
& IPC_CREAT
&& flg
& IPC_EXCL
)
384 if (ops
->more_checks
)
385 err
= ops
->more_checks(ipcp
, params
);
388 * ipc_check_perms returns the IPC id on
391 err
= ipc_check_perms(ns
, ipcp
, ops
, params
);
395 up_write(&ids
->rwsem
);
401 * ipc_kht_remove - remove an ipc from the key hashtable
402 * @ids: ipc identifier set
403 * @ipcp: ipc perm structure containing the key to remove
405 * ipc_ids.rwsem (as a writer) and the spinlock for this ID are held
406 * before this function is called, and remain locked on the exit.
408 static void ipc_kht_remove(struct ipc_ids
*ids
, struct kern_ipc_perm
*ipcp
)
410 if (ipcp
->key
!= IPC_PRIVATE
)
411 rhashtable_remove_fast(&ids
->key_ht
, &ipcp
->khtnode
,
416 * ipc_rmid - remove an ipc identifier
417 * @ids: ipc identifier set
418 * @ipcp: ipc perm structure containing the identifier to remove
420 * ipc_ids.rwsem (as a writer) and the spinlock for this ID are held
421 * before this function is called, and remain locked on the exit.
423 void ipc_rmid(struct ipc_ids
*ids
, struct kern_ipc_perm
*ipcp
)
425 int lid
= ipcid_to_idx(ipcp
->id
);
427 idr_remove(&ids
->ipcs_idr
, lid
);
428 ipc_kht_remove(ids
, ipcp
);
430 ipcp
->deleted
= true;
434 * ipc_set_key_private - switch the key of an existing ipc to IPC_PRIVATE
435 * @ids: ipc identifier set
436 * @ipcp: ipc perm structure containing the key to modify
438 * ipc_ids.rwsem (as a writer) and the spinlock for this ID are held
439 * before this function is called, and remain locked on the exit.
441 void ipc_set_key_private(struct ipc_ids
*ids
, struct kern_ipc_perm
*ipcp
)
443 ipc_kht_remove(ids
, ipcp
);
444 ipcp
->key
= IPC_PRIVATE
;
447 int ipc_rcu_getref(struct kern_ipc_perm
*ptr
)
449 return refcount_inc_not_zero(&ptr
->refcount
);
452 void ipc_rcu_putref(struct kern_ipc_perm
*ptr
,
453 void (*func
)(struct rcu_head
*head
))
455 if (!refcount_dec_and_test(&ptr
->refcount
))
458 call_rcu(&ptr
->rcu
, func
);
462 * ipcperms - check ipc permissions
464 * @ipcp: ipc permission set
465 * @flag: desired permission set
467 * Check user, group, other permissions for access
468 * to ipc resources. return 0 if allowed
470 * @flag will most probably be 0 or ``S_...UGO`` from <linux/stat.h>
472 int ipcperms(struct ipc_namespace
*ns
, struct kern_ipc_perm
*ipcp
, short flag
)
474 kuid_t euid
= current_euid();
475 int requested_mode
, granted_mode
;
478 requested_mode
= (flag
>> 6) | (flag
>> 3) | flag
;
479 granted_mode
= ipcp
->mode
;
480 if (uid_eq(euid
, ipcp
->cuid
) ||
481 uid_eq(euid
, ipcp
->uid
))
483 else if (in_group_p(ipcp
->cgid
) || in_group_p(ipcp
->gid
))
485 /* is there some bit set in requested_mode but not in granted_mode? */
486 if ((requested_mode
& ~granted_mode
& 0007) &&
487 !ns_capable(ns
->user_ns
, CAP_IPC_OWNER
))
490 return security_ipc_permission(ipcp
, flag
);
494 * Functions to convert between the kern_ipc_perm structure and the
495 * old/new ipc_perm structures
499 * kernel_to_ipc64_perm - convert kernel ipc permissions to user
500 * @in: kernel permissions
501 * @out: new style ipc permissions
503 * Turn the kernel object @in into a set of permissions descriptions
504 * for returning to userspace (@out).
506 void kernel_to_ipc64_perm(struct kern_ipc_perm
*in
, struct ipc64_perm
*out
)
509 out
->uid
= from_kuid_munged(current_user_ns(), in
->uid
);
510 out
->gid
= from_kgid_munged(current_user_ns(), in
->gid
);
511 out
->cuid
= from_kuid_munged(current_user_ns(), in
->cuid
);
512 out
->cgid
= from_kgid_munged(current_user_ns(), in
->cgid
);
513 out
->mode
= in
->mode
;
518 * ipc64_perm_to_ipc_perm - convert new ipc permissions to old
519 * @in: new style ipc permissions
520 * @out: old style ipc permissions
522 * Turn the new style permissions object @in into a compatibility
523 * object and store it into the @out pointer.
525 void ipc64_perm_to_ipc_perm(struct ipc64_perm
*in
, struct ipc_perm
*out
)
528 SET_UID(out
->uid
, in
->uid
);
529 SET_GID(out
->gid
, in
->gid
);
530 SET_UID(out
->cuid
, in
->cuid
);
531 SET_GID(out
->cgid
, in
->cgid
);
532 out
->mode
= in
->mode
;
537 * ipc_obtain_object_idr
538 * @ids: ipc identifier set
539 * @id: ipc id to look for
541 * Look for an id in the ipc ids idr and return associated ipc object.
543 * Call inside the RCU critical section.
544 * The ipc object is *not* locked on exit.
546 struct kern_ipc_perm
*ipc_obtain_object_idr(struct ipc_ids
*ids
, int id
)
548 struct kern_ipc_perm
*out
;
549 int lid
= ipcid_to_idx(id
);
551 if (unlikely(!ids
->tables_initialized
))
552 return ERR_PTR(-EINVAL
);
554 out
= idr_find(&ids
->ipcs_idr
, lid
);
556 return ERR_PTR(-EINVAL
);
562 * ipc_lock - lock an ipc structure without rwsem held
563 * @ids: ipc identifier set
564 * @id: ipc id to look for
566 * Look for an id in the ipc ids idr and lock the associated ipc object.
568 * The ipc object is locked on successful exit.
570 struct kern_ipc_perm
*ipc_lock(struct ipc_ids
*ids
, int id
)
572 struct kern_ipc_perm
*out
;
575 out
= ipc_obtain_object_idr(ids
, id
);
579 spin_lock(&out
->lock
);
582 * ipc_rmid() may have already freed the ID while ipc_lock()
583 * was spinning: here verify that the structure is still valid.
584 * Upon races with RMID, return -EIDRM, thus indicating that
585 * the ID points to a removed identifier.
587 if (ipc_valid_object(out
))
590 spin_unlock(&out
->lock
);
591 out
= ERR_PTR(-EIDRM
);
598 * ipc_obtain_object_check
599 * @ids: ipc identifier set
600 * @id: ipc id to look for
602 * Similar to ipc_obtain_object_idr() but also checks
603 * the ipc object reference counter.
605 * Call inside the RCU critical section.
606 * The ipc object is *not* locked on exit.
608 struct kern_ipc_perm
*ipc_obtain_object_check(struct ipc_ids
*ids
, int id
)
610 struct kern_ipc_perm
*out
= ipc_obtain_object_idr(ids
, id
);
615 if (ipc_checkid(out
, id
))
616 return ERR_PTR(-EINVAL
);
622 * ipcget - Common sys_*get() code
624 * @ids: ipc identifier set
625 * @ops: operations to be called on ipc object creation, permission checks
627 * @params: the parameters needed by the previous operations.
629 * Common routine called by sys_msgget(), sys_semget() and sys_shmget().
631 int ipcget(struct ipc_namespace
*ns
, struct ipc_ids
*ids
,
632 const struct ipc_ops
*ops
, struct ipc_params
*params
)
634 if (params
->key
== IPC_PRIVATE
)
635 return ipcget_new(ns
, ids
, ops
, params
);
637 return ipcget_public(ns
, ids
, ops
, params
);
641 * ipc_update_perm - update the permissions of an ipc object
642 * @in: the permission given as input.
643 * @out: the permission of the ipc to set.
645 int ipc_update_perm(struct ipc64_perm
*in
, struct kern_ipc_perm
*out
)
647 kuid_t uid
= make_kuid(current_user_ns(), in
->uid
);
648 kgid_t gid
= make_kgid(current_user_ns(), in
->gid
);
649 if (!uid_valid(uid
) || !gid_valid(gid
))
654 out
->mode
= (out
->mode
& ~S_IRWXUGO
)
655 | (in
->mode
& S_IRWXUGO
);
661 * ipcctl_pre_down_nolock - retrieve an ipc and check permissions for some IPC_XXX cmd
663 * @ids: the table of ids where to look for the ipc
664 * @id: the id of the ipc to retrieve
665 * @cmd: the cmd to check
666 * @perm: the permission to set
667 * @extra_perm: one extra permission parameter used by msq
669 * This function does some common audit and permissions check for some IPC_XXX
670 * cmd and is called from semctl_down, shmctl_down and msgctl_down.
671 * It must be called without any lock held and:
673 * - retrieves the ipc with the given id in the given table.
674 * - performs some audit and permission check, depending on the given cmd
675 * - returns a pointer to the ipc object or otherwise, the corresponding
678 * Call holding the both the rwsem and the rcu read lock.
680 struct kern_ipc_perm
*ipcctl_pre_down_nolock(struct ipc_namespace
*ns
,
681 struct ipc_ids
*ids
, int id
, int cmd
,
682 struct ipc64_perm
*perm
, int extra_perm
)
686 struct kern_ipc_perm
*ipcp
;
688 ipcp
= ipc_obtain_object_check(ids
, id
);
696 audit_ipc_set_perm(extra_perm
, perm
->uid
,
697 perm
->gid
, perm
->mode
);
699 euid
= current_euid();
700 if (uid_eq(euid
, ipcp
->cuid
) || uid_eq(euid
, ipcp
->uid
) ||
701 ns_capable(ns
->user_ns
, CAP_SYS_ADMIN
))
702 return ipcp
; /* successful lookup */
707 #ifdef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
711 * ipc_parse_version - ipc call version
712 * @cmd: pointer to command
714 * Return IPC_64 for new style IPC and IPC_OLD for old style IPC.
715 * The @cmd value is turned from an encoding command and version into
716 * just the command code.
718 int ipc_parse_version(int *cmd
)
728 #endif /* CONFIG_ARCH_WANT_IPC_PARSE_VERSION */
730 #ifdef CONFIG_PROC_FS
731 struct ipc_proc_iter
{
732 struct ipc_namespace
*ns
;
733 struct ipc_proc_iface
*iface
;
737 * This routine locks the ipc structure found at least at position pos.
739 static struct kern_ipc_perm
*sysvipc_find_ipc(struct ipc_ids
*ids
, loff_t pos
,
742 struct kern_ipc_perm
*ipc
;
746 for (id
= 0; id
< pos
&& total
< ids
->in_use
; id
++) {
747 ipc
= idr_find(&ids
->ipcs_idr
, id
);
752 if (total
>= ids
->in_use
)
755 for (; pos
< IPCMNI
; pos
++) {
756 ipc
= idr_find(&ids
->ipcs_idr
, pos
);
760 ipc_lock_object(ipc
);
765 /* Out of range - return NULL to terminate iteration */
769 static void *sysvipc_proc_next(struct seq_file
*s
, void *it
, loff_t
*pos
)
771 struct ipc_proc_iter
*iter
= s
->private;
772 struct ipc_proc_iface
*iface
= iter
->iface
;
773 struct kern_ipc_perm
*ipc
= it
;
775 /* If we had an ipc id locked before, unlock it */
776 if (ipc
&& ipc
!= SEQ_START_TOKEN
)
779 return sysvipc_find_ipc(&iter
->ns
->ids
[iface
->ids
], *pos
, pos
);
783 * File positions: pos 0 -> header, pos n -> ipc id = n - 1.
784 * SeqFile iterator: iterator value locked ipc pointer or SEQ_TOKEN_START.
786 static void *sysvipc_proc_start(struct seq_file
*s
, loff_t
*pos
)
788 struct ipc_proc_iter
*iter
= s
->private;
789 struct ipc_proc_iface
*iface
= iter
->iface
;
792 ids
= &iter
->ns
->ids
[iface
->ids
];
795 * Take the lock - this will be released by the corresponding
798 down_read(&ids
->rwsem
);
800 /* pos < 0 is invalid */
804 /* pos == 0 means header */
806 return SEQ_START_TOKEN
;
808 /* Find the (pos-1)th ipc */
809 return sysvipc_find_ipc(ids
, *pos
- 1, pos
);
812 static void sysvipc_proc_stop(struct seq_file
*s
, void *it
)
814 struct kern_ipc_perm
*ipc
= it
;
815 struct ipc_proc_iter
*iter
= s
->private;
816 struct ipc_proc_iface
*iface
= iter
->iface
;
819 /* If we had a locked structure, release it */
820 if (ipc
&& ipc
!= SEQ_START_TOKEN
)
823 ids
= &iter
->ns
->ids
[iface
->ids
];
824 /* Release the lock we took in start() */
825 up_read(&ids
->rwsem
);
828 static int sysvipc_proc_show(struct seq_file
*s
, void *it
)
830 struct ipc_proc_iter
*iter
= s
->private;
831 struct ipc_proc_iface
*iface
= iter
->iface
;
833 if (it
== SEQ_START_TOKEN
) {
834 seq_puts(s
, iface
->header
);
838 return iface
->show(s
, it
);
841 static const struct seq_operations sysvipc_proc_seqops
= {
842 .start
= sysvipc_proc_start
,
843 .stop
= sysvipc_proc_stop
,
844 .next
= sysvipc_proc_next
,
845 .show
= sysvipc_proc_show
,
848 static int sysvipc_proc_open(struct inode
*inode
, struct file
*file
)
850 struct ipc_proc_iter
*iter
;
852 iter
= __seq_open_private(file
, &sysvipc_proc_seqops
, sizeof(*iter
));
856 iter
->iface
= PDE_DATA(inode
);
857 iter
->ns
= get_ipc_ns(current
->nsproxy
->ipc_ns
);
862 static int sysvipc_proc_release(struct inode
*inode
, struct file
*file
)
864 struct seq_file
*seq
= file
->private_data
;
865 struct ipc_proc_iter
*iter
= seq
->private;
866 put_ipc_ns(iter
->ns
);
867 return seq_release_private(inode
, file
);
870 static const struct file_operations sysvipc_proc_fops
= {
871 .open
= sysvipc_proc_open
,
874 .release
= sysvipc_proc_release
,
876 #endif /* CONFIG_PROC_FS */