/* * linux/ipc/util.c * Copyright (C) 1992 Krishna Balasubramanian * * Sep 1997 - Call suser() last after "normal" permission checks so we *            get BSD style process accounting right. *            Occurs in several places in the IPC code. *            Chris Evans, <chris@ferret.lmh.ox.ac.uk> * Nov 1999 - ipc helper functions, unified SMP locking *	      Manfred Spraul <manfred@colorfullife.com> * Oct 2002 - One lock per IPC id. RCU ipc_free for lock-free grow_ary(). *            Mingming Cao <cmm@us.ibm.com> * Mar 2006 - support for audit of ipc object properties *            Dustin Kirkland <dustin.kirkland@us.ibm.com> * Jun 2006 - namespaces ssupport *            OpenVZ, SWsoft Inc. *            Pavel Emelianov <xemul@openvz.org> * * General sysv ipc locking scheme: *	rcu_read_lock() *          obtain the ipc object (kern_ipc_perm) by looking up the id in an idr *	    tree. *	    - perform initial checks (capabilities, auditing and permission, *	      etc). *	    - perform read-only operations, such as STAT, INFO commands. *	      acquire the ipc lock (kern_ipc_perm.lock) through *	      ipc_lock_object() *		- perform data updates, such as SET, RMID commands and *		  mechanism-specific operations (semop/semtimedop, *		  msgsnd/msgrcv, shmat/shmdt). *	    drop the ipc lock, through ipc_unlock_object(). *	rcu_read_unlock() * *  The ids->rwsem must be taken when: *	- creating, removing and iterating the existing entries in ipc *	  identifier sets. *	- iterating through files under /proc/sysvipc/ * *  Note that sems have a special fast path that avoids kern_ipc_perm.lock - *  see sem_lock(). */ #include <linux/mm.h>#include <linux/shm.h>#include <linux/init.h>#include <linux/msg.h>#include <linux/vmalloc.h>#include <linux/slab.h>#include <linux/notifier.h>#include <linux/capability.h>#include <linux/highuid.h>#include <linux/security.h>#include <linux/rcupdate.h>#include <linux/workqueue.h>#include <linux/seq_file.h>#include <linux/proc_fs.h>#include <linux/audit.h>#include <linux/nsproxy.h>#include <linux/rwsem.h>#include <linux/memory.h>#include <linux/ipc_namespace.h> #include <asm/unistd.h> #include "util.h" struct ipc_proc_iface {	const char *path;	const char *header;	int ids;	int (*show)(struct seq_file *, void *);}; /** * ipc_init - initialise ipc subsystem * * The various sysv ipc resources (semaphores, messages and shared * memory) are initialised. * * A callback routine is registered into the memory hotplug notifier * chain: since msgmni scales to lowmem this callback routine will be * called upon successful memory add / remove to recompute msmgni. */static int __init ipc_init(void){	sem_init();	msg_init();	shm_init();	return 0;}device_initcall(ipc_init); /** * ipc_init_ids	- initialise ipc identifiers * @ids: ipc identifier set * * Set up the sequence range to use for the ipc identifier range (limited * below IPCMNI) then initialise the ids idr. */void ipc_init_ids(struct ipc_ids *ids){	ids->in_use = 0;	ids->seq = 0;	ids->next_id = -1;	init_rwsem(&ids->rwsem);	idr_init(&ids->ipcs_idr);} #ifdef CONFIG_PROC_FSstatic const struct file_operations sysvipc_proc_fops;/** * ipc_init_proc_interface -  create a proc interface for sysipc types using a seq_file interface. * @path: Path in procfs * @header: Banner to be printed at the beginning of the file. * @ids: ipc id table to iterate. * @show: show routine. */void __init ipc_init_proc_interface(const char *path, const char *header,		int ids, int (*show)(struct seq_file *, void *)){	struct proc_dir_entry *pde;	struct ipc_proc_iface *iface; 	iface = kmalloc(sizeof(*iface), GFP_KERNEL);	if (!iface)		return;	iface->path	= path;	iface->header	= header;	iface->ids	= ids;	iface->show	= show; 	pde = proc_create_data(path,			       S_IRUGO,        /* world readable */			       NULL,           /* parent dir */			       &sysvipc_proc_fops,			       iface);	if (!pde)		kfree(iface);}#endif /** * ipc_findkey	- find a key in an ipc identifier set * @ids: ipc identifier set * @key: key to find * * Returns the locked pointer to the ipc structure if found or NULL * otherwise. If key is found ipc points to the owning ipc structure * * Called with ipc_ids.rwsem held. */static struct kern_ipc_perm *ipc_findkey(struct ipc_ids *ids, key_t key){	struct kern_ipc_perm *ipc;	int next_id;	int total; 	for (total = 0, next_id = 0; total < ids->in_use; next_id++) {		ipc = idr_find(&ids->ipcs_idr, next_id); 		if (ipc == NULL)			continue; 		if (ipc->key != key) {			total++;			continue;		} 		rcu_read_lock();		ipc_lock_object(ipc);		return ipc;	} 	return NULL;} /** * ipc_get_maxid - get the last assigned id * @ids: ipc identifier set * * Called with ipc_ids.rwsem held. */int ipc_get_maxid(struct ipc_ids *ids){	struct kern_ipc_perm *ipc;	int max_id = -1;	int total, id; 	if (ids->in_use == 0)		return -1; 	if (ids->in_use == IPCMNI)		return IPCMNI - 1; 	/* Look for the last assigned id */	total = 0;	for (id = 0; id < IPCMNI && total < ids->in_use; id++) {		ipc = idr_find(&ids->ipcs_idr, id);		if (ipc != NULL) {			max_id = id;			total++;		}	}	return max_id;} /** * ipc_addid - add an ipc identifier * @ids: ipc identifier set * @new: new ipc permission set * @size: limit for the number of used ids * * Add an entry 'new' to the ipc ids idr. The permissions object is * initialised and the first free entry is set up and the id assigned * is returned. The 'new' entry is returned in a locked state on success. * On failure the entry is not locked and a negative err-code is returned. * * Called with writer ipc_ids.rwsem held. */int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size){	kuid_t euid;	kgid_t egid;	int id;	int next_id = ids->next_id; 	if (size > IPCMNI)		size = IPCMNI; 	if (ids->in_use >= size)		return -ENOSPC; 	idr_preload(GFP_KERNEL); 	spin_lock_init(&new->lock);	new->deleted = false;	rcu_read_lock();	spin_lock(&new->lock); 	current_euid_egid(&euid, &egid);	new->cuid = new->uid = euid;	new->gid = new->cgid = egid; 	id = idr_alloc(&ids->ipcs_idr, new,		       (next_id < 0) ? 0 : ipcid_to_idx(next_id), 0,		       GFP_NOWAIT);	idr_preload_end();	if (id < 0) {		spin_unlock(&new->lock);		rcu_read_unlock();		return id;	} 	ids->in_use++; 	if (next_id < 0) {		new->seq = ids->seq++;		if (ids->seq > IPCID_SEQ_MAX)			ids->seq = 0;	} else {		new->seq = ipcid_to_seqx(next_id);		ids->next_id = -1;	} 	new->id = ipc_buildid(id, new->seq);	return id;} /** * ipcget_new -	create a new ipc object * @ns: ipc namespace * @ids: ipc identifier set * @ops: the actual creation routine to call * @params: its parameters * * This routine is called by sys_msgget, sys_semget() and sys_shmget() * when the key is IPC_PRIVATE. */static int ipcget_new(struct ipc_namespace *ns, struct ipc_ids *ids,		const struct ipc_ops *ops, struct ipc_params *params){	int err; 	down_write(&ids->rwsem);	err = ops->getnew(ns, params);	up_write(&ids->rwsem);	return err;} /** * ipc_check_perms - check security and permissions for an ipc object * @ns: ipc namespace * @ipcp: ipc permission set * @ops: the actual security routine to call * @params: its parameters * * This routine is called by sys_msgget(), sys_semget() and sys_shmget() * when the key is not IPC_PRIVATE and that key already exists in the * ds IDR. * * On success, the ipc id is returned. * * It is called with ipc_ids.rwsem and ipcp->lock held. */static int ipc_check_perms(struct ipc_namespace *ns,			   struct kern_ipc_perm *ipcp,			   const struct ipc_ops *ops,			   struct ipc_params *params){	int err; 	if (ipcperms(ns, ipcp, params->flg))		err = -EACCES;	else {		err = ops->associate(ipcp, params->flg);		if (!err)			err = ipcp->id;	} 	return err;} /** * ipcget_public - get an ipc object or create a new one * @ns: ipc namespace * @ids: ipc identifier set * @ops: the actual creation routine to call * @params: its parameters * * This routine is called by sys_msgget, sys_semget() and sys_shmget() * when the key is not IPC_PRIVATE. * It adds a new entry if the key is not found and does some permission * / security checkings if the key is found. * * On success, the ipc id is returned. */static int ipcget_public(struct ipc_namespace *ns, struct ipc_ids *ids,		const struct ipc_ops *ops, struct ipc_params *params){	struct kern_ipc_perm *ipcp;	int flg = params->flg;	int err; 	/*	 * Take the lock as a writer since we are potentially going to add	 * a new entry + read locks are not "upgradable"	 */	down_write(&ids->rwsem);	ipcp = ipc_findkey(ids, params->key);	if (ipcp == NULL) {		/* key not used */		if (!(flg & IPC_CREAT))			err = -ENOENT;		else			err = ops->getnew(ns, params);	} else {		/* ipc object has been locked by ipc_findkey() */ 		if (flg & IPC_CREAT && flg & IPC_EXCL)			err = -EEXIST;		else {			err = 0;			if (ops->more_checks)				err = ops->more_checks(ipcp, params);			if (!err)				/*				 * ipc_check_perms returns the IPC id on				 * success				 */				err = ipc_check_perms(ns, ipcp, ops, params);		}		ipc_unlock(ipcp);	}	up_write(&ids->rwsem); 	return err;}  /** * ipc_rmid - remove an ipc identifier * @ids: ipc identifier set * @ipcp: ipc perm structure containing the identifier to remove * * ipc_ids.rwsem (as a writer) and the spinlock for this ID are held * before this function is called, and remain locked on the exit. */void ipc_rmid(struct ipc_ids *ids, struct kern_ipc_perm *ipcp){	int lid = ipcid_to_idx(ipcp->id); 	idr_remove(&ids->ipcs_idr, lid);	ids->in_use--;	ipcp->deleted = true;} /** * ipc_alloc -	allocate ipc space * @size: size desired * * Allocate memory from the appropriate pools and return a pointer to it. * NULL is returned if the allocation fails */void *ipc_alloc(int size){	void *out;	if (size > PAGE_SIZE)		out = vmalloc(size);	else		out = kmalloc(size, GFP_KERNEL);	return out;} /** * ipc_free - free ipc space * @ptr: pointer returned by ipc_alloc * * Free a block created with ipc_alloc(). */void ipc_free(void *ptr){	kvfree(ptr);} /** * ipc_rcu_alloc - allocate ipc and rcu space * @size: size desired * * Allocate memory for the rcu header structure +  the object. * Returns the pointer to the object or NULL upon failure. */void *ipc_rcu_alloc(int size){	/*	 * We prepend the allocation with the rcu struct	 */	struct ipc_rcu *out = ipc_alloc(sizeof(struct ipc_rcu) + size);	if (unlikely(!out))		return NULL;	atomic_set(&out->refcount, 1);	return out + 1;} int ipc_rcu_getref(void *ptr){	struct ipc_rcu *p = ((struct ipc_rcu *)ptr) - 1; 	return atomic_inc_not_zero(&p->refcount);} void ipc_rcu_putref(void *ptr, void (*func)(struct rcu_head *head)){	struct ipc_rcu *p = ((struct ipc_rcu *)ptr) - 1; 	if (!atomic_dec_and_test(&p->refcount))		return; 	call_rcu(&p->rcu, func);} void ipc_rcu_free(struct rcu_head *head){	struct ipc_rcu *p = container_of(head, struct ipc_rcu, rcu); 	kvfree(p);} /** * ipcperms - check ipc permissions * @ns: ipc namespace * @ipcp: ipc permission set * @flag: desired permission set * * Check user, group, other permissions for access * to ipc resources. return 0 if allowed * * @flag will most probably be 0 or S_...UGO from <linux/stat.h> */int ipcperms(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp, short flag){	kuid_t euid = current_euid();	int requested_mode, granted_mode; 	audit_ipc_obj(ipcp);	requested_mode = (flag >> 6) | (flag >> 3) | flag;	granted_mode = ipcp->mode;	if (uid_eq(euid, ipcp->cuid) ||	    uid_eq(euid, ipcp->uid))		granted_mode >>= 6;	else if (in_group_p(ipcp->cgid) || in_group_p(ipcp->gid))		granted_mode >>= 3;	/* is there some bit set in requested_mode but not in granted_mode? */	if ((requested_mode & ~granted_mode & 0007) &&	    !ns_capable(ns->user_ns, CAP_IPC_OWNER))		return -1; 	return security_ipc_permission(ipcp, flag);} /*

Lines 1–500 of 878. Load more