提交 e51b6ba0 编写于 作者: E Eric W. Biederman 提交者: David S. Miller

sysctl: Infrastructure for per namespace sysctls

This patch implements the basic infrastructure for per namespace sysctls.

A list of lists of sysctl headers is added, allowing each namespace to have
it's own list of sysctl headers.

Each list of sysctl headers has a lookup function to find the first
sysctl header in the list, allowing the lists to have a per namespace
instance.

register_sysct_root is added to tell sysctl.c about additional
lists of sysctl_headers.  As all of the users are expected to be in
kernel no unregister function is provided.

sysctl_head_next is updated to walk through the list of lists.

__register_sysctl_paths is added to add a new sysctl table on
a non-default sysctl list.

The only intrusive part of this patch is propagating the information
to decided which list of sysctls to use for sysctl_check_table.
Signed-off-by: NEric W. Biederman <ebiederm@xmission.com>
Cc: Serge Hallyn <serue@us.ibm.com>
Cc: Daniel Lezcano <dlezcano@fr.ibm.com>
Cc: Cedric Le Goater <clg@fr.ibm.com>
Cc: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 23eb06de
...@@ -945,7 +945,10 @@ enum ...@@ -945,7 +945,10 @@ enum
/* For the /proc/sys support */ /* For the /proc/sys support */
struct ctl_table; struct ctl_table;
struct nsproxy;
extern struct ctl_table_header *sysctl_head_next(struct ctl_table_header *prev); extern struct ctl_table_header *sysctl_head_next(struct ctl_table_header *prev);
extern struct ctl_table_header *__sysctl_head_next(struct nsproxy *namespaces,
struct ctl_table_header *prev);
extern void sysctl_head_finish(struct ctl_table_header *prev); extern void sysctl_head_finish(struct ctl_table_header *prev);
extern int sysctl_perm(struct ctl_table *table, int op); extern int sysctl_perm(struct ctl_table *table, int op);
...@@ -1049,6 +1052,13 @@ struct ctl_table ...@@ -1049,6 +1052,13 @@ struct ctl_table
void *extra2; void *extra2;
}; };
struct ctl_table_root {
struct list_head root_list;
struct list_head header_list;
struct list_head *(*lookup)(struct ctl_table_root *root,
struct nsproxy *namespaces);
};
/* struct ctl_table_header is used to maintain dynamic lists of /* struct ctl_table_header is used to maintain dynamic lists of
struct ctl_table trees. */ struct ctl_table trees. */
struct ctl_table_header struct ctl_table_header
...@@ -1058,6 +1068,7 @@ struct ctl_table_header ...@@ -1058,6 +1068,7 @@ struct ctl_table_header
int used; int used;
struct completion *unregistering; struct completion *unregistering;
struct ctl_table *ctl_table_arg; struct ctl_table *ctl_table_arg;
struct ctl_table_root *root;
}; };
/* struct ctl_path describes where in the hierarchy a table is added */ /* struct ctl_path describes where in the hierarchy a table is added */
...@@ -1066,12 +1077,16 @@ struct ctl_path { ...@@ -1066,12 +1077,16 @@ struct ctl_path {
int ctl_name; int ctl_name;
}; };
void register_sysctl_root(struct ctl_table_root *root);
struct ctl_table_header *__register_sysctl_paths(
struct ctl_table_root *root, struct nsproxy *namespaces,
const struct ctl_path *path, struct ctl_table *table);
struct ctl_table_header *register_sysctl_table(struct ctl_table * table); struct ctl_table_header *register_sysctl_table(struct ctl_table * table);
struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path, struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path,
struct ctl_table *table); struct ctl_table *table);
void unregister_sysctl_table(struct ctl_table_header * table); void unregister_sysctl_table(struct ctl_table_header * table);
int sysctl_check_table(struct ctl_table *table); int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table);
#else /* __KERNEL__ */ #else /* __KERNEL__ */
......
...@@ -157,8 +157,16 @@ static int proc_dointvec_taint(struct ctl_table *table, int write, struct file * ...@@ -157,8 +157,16 @@ static int proc_dointvec_taint(struct ctl_table *table, int write, struct file *
#endif #endif
static struct ctl_table root_table[]; static struct ctl_table root_table[];
static struct ctl_table_header root_table_header = static struct ctl_table_root sysctl_table_root;
{ root_table, LIST_HEAD_INIT(root_table_header.ctl_entry) }; static struct ctl_table_header root_table_header = {
.ctl_table = root_table,
.ctl_entry = LIST_HEAD_INIT(sysctl_table_root.header_list),
.root = &sysctl_table_root,
};
static struct ctl_table_root sysctl_table_root = {
.root_list = LIST_HEAD_INIT(sysctl_table_root.root_list),
.header_list = LIST_HEAD_INIT(root_table_header.ctl_entry),
};
static struct ctl_table kern_table[]; static struct ctl_table kern_table[];
static struct ctl_table vm_table[]; static struct ctl_table vm_table[];
...@@ -1371,12 +1379,27 @@ void sysctl_head_finish(struct ctl_table_header *head) ...@@ -1371,12 +1379,27 @@ void sysctl_head_finish(struct ctl_table_header *head)
spin_unlock(&sysctl_lock); spin_unlock(&sysctl_lock);
} }
struct ctl_table_header *sysctl_head_next(struct ctl_table_header *prev) static struct list_head *
lookup_header_list(struct ctl_table_root *root, struct nsproxy *namespaces)
{ {
struct list_head *header_list;
header_list = &root->header_list;
if (root->lookup)
header_list = root->lookup(root, namespaces);
return header_list;
}
struct ctl_table_header *__sysctl_head_next(struct nsproxy *namespaces,
struct ctl_table_header *prev)
{
struct ctl_table_root *root;
struct list_head *header_list;
struct ctl_table_header *head; struct ctl_table_header *head;
struct list_head *tmp; struct list_head *tmp;
spin_lock(&sysctl_lock); spin_lock(&sysctl_lock);
if (prev) { if (prev) {
head = prev;
tmp = &prev->ctl_entry; tmp = &prev->ctl_entry;
unuse_table(prev); unuse_table(prev);
goto next; goto next;
...@@ -1390,14 +1413,38 @@ struct ctl_table_header *sysctl_head_next(struct ctl_table_header *prev) ...@@ -1390,14 +1413,38 @@ struct ctl_table_header *sysctl_head_next(struct ctl_table_header *prev)
spin_unlock(&sysctl_lock); spin_unlock(&sysctl_lock);
return head; return head;
next: next:
root = head->root;
tmp = tmp->next; tmp = tmp->next;
if (tmp == &root_table_header.ctl_entry) header_list = lookup_header_list(root, namespaces);
break; if (tmp != header_list)
continue;
do {
root = list_entry(root->root_list.next,
struct ctl_table_root, root_list);
if (root == &sysctl_table_root)
goto out;
header_list = lookup_header_list(root, namespaces);
} while (list_empty(header_list));
tmp = header_list->next;
} }
out:
spin_unlock(&sysctl_lock); spin_unlock(&sysctl_lock);
return NULL; return NULL;
} }
struct ctl_table_header *sysctl_head_next(struct ctl_table_header *prev)
{
return __sysctl_head_next(current->nsproxy, prev);
}
void register_sysctl_root(struct ctl_table_root *root)
{
spin_lock(&sysctl_lock);
list_add_tail(&root->root_list, &sysctl_table_root.root_list);
spin_unlock(&sysctl_lock);
}
#ifdef CONFIG_SYSCTL_SYSCALL #ifdef CONFIG_SYSCTL_SYSCALL
int do_sysctl(int __user *name, int nlen, void __user *oldval, size_t __user *oldlenp, int do_sysctl(int __user *name, int nlen, void __user *oldval, size_t __user *oldlenp,
void __user *newval, size_t newlen) void __user *newval, size_t newlen)
...@@ -1554,14 +1601,16 @@ static __init int sysctl_init(void) ...@@ -1554,14 +1601,16 @@ static __init int sysctl_init(void)
{ {
int err; int err;
sysctl_set_parent(NULL, root_table); sysctl_set_parent(NULL, root_table);
err = sysctl_check_table(root_table); err = sysctl_check_table(current->nsproxy, root_table);
return 0; return 0;
} }
core_initcall(sysctl_init); core_initcall(sysctl_init);
/** /**
* register_sysctl_paths - register a sysctl hierarchy * __register_sysctl_paths - register a sysctl hierarchy
* @root: List of sysctl headers to register on
* @namespaces: Data to compute which lists of sysctl entries are visible
* @path: The path to the directory the sysctl table is in. * @path: The path to the directory the sysctl table is in.
* @table: the top-level table structure * @table: the top-level table structure
* *
...@@ -1629,9 +1678,12 @@ core_initcall(sysctl_init); ...@@ -1629,9 +1678,12 @@ core_initcall(sysctl_init);
* This routine returns %NULL on a failure to register, and a pointer * This routine returns %NULL on a failure to register, and a pointer
* to the table header on success. * to the table header on success.
*/ */
struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path, struct ctl_table_header *__register_sysctl_paths(
struct ctl_table *table) struct ctl_table_root *root,
struct nsproxy *namespaces,
const struct ctl_path *path, struct ctl_table *table)
{ {
struct list_head *header_list;
struct ctl_table_header *header; struct ctl_table_header *header;
struct ctl_table *new, **prevp; struct ctl_table *new, **prevp;
unsigned int n, npath; unsigned int n, npath;
...@@ -1674,18 +1726,37 @@ struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path, ...@@ -1674,18 +1726,37 @@ struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path,
INIT_LIST_HEAD(&header->ctl_entry); INIT_LIST_HEAD(&header->ctl_entry);
header->used = 0; header->used = 0;
header->unregistering = NULL; header->unregistering = NULL;
header->root = root;
sysctl_set_parent(NULL, header->ctl_table); sysctl_set_parent(NULL, header->ctl_table);
if (sysctl_check_table(header->ctl_table)) { if (sysctl_check_table(namespaces, header->ctl_table)) {
kfree(header); kfree(header);
return NULL; return NULL;
} }
spin_lock(&sysctl_lock); spin_lock(&sysctl_lock);
list_add_tail(&header->ctl_entry, &root_table_header.ctl_entry); header_list = lookup_header_list(root, namespaces);
list_add_tail(&header->ctl_entry, header_list);
spin_unlock(&sysctl_lock); spin_unlock(&sysctl_lock);
return header; return header;
} }
/**
* register_sysctl_table_path - register a sysctl table hierarchy
* @path: The path to the directory the sysctl table is in.
* @table: the top-level table structure
*
* Register a sysctl table hierarchy. @table should be a filled in ctl_table
* array. A completely 0 filled entry terminates the table.
*
* See __register_sysctl_paths for more details.
*/
struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path,
struct ctl_table *table)
{
return __register_sysctl_paths(&sysctl_table_root, current->nsproxy,
path, table);
}
/** /**
* register_sysctl_table - register a sysctl table hierarchy * register_sysctl_table - register a sysctl table hierarchy
* @table: the top-level table structure * @table: the top-level table structure
......
...@@ -1342,7 +1342,8 @@ static void sysctl_repair_table(struct ctl_table *table) ...@@ -1342,7 +1342,8 @@ static void sysctl_repair_table(struct ctl_table *table)
} }
} }
static struct ctl_table *sysctl_check_lookup(struct ctl_table *table) static struct ctl_table *sysctl_check_lookup(struct nsproxy *namespaces,
struct ctl_table *table)
{ {
struct ctl_table_header *head; struct ctl_table_header *head;
struct ctl_table *ref, *test; struct ctl_table *ref, *test;
...@@ -1350,8 +1351,8 @@ static struct ctl_table *sysctl_check_lookup(struct ctl_table *table) ...@@ -1350,8 +1351,8 @@ static struct ctl_table *sysctl_check_lookup(struct ctl_table *table)
depth = sysctl_depth(table); depth = sysctl_depth(table);
for (head = sysctl_head_next(NULL); head; for (head = __sysctl_head_next(namespaces, NULL); head;
head = sysctl_head_next(head)) { head = __sysctl_head_next(namespaces, head)) {
cur_depth = depth; cur_depth = depth;
ref = head->ctl_table; ref = head->ctl_table;
repeat: repeat:
...@@ -1396,13 +1397,14 @@ static void set_fail(const char **fail, struct ctl_table *table, const char *str ...@@ -1396,13 +1397,14 @@ static void set_fail(const char **fail, struct ctl_table *table, const char *str
*fail = str; *fail = str;
} }
static int sysctl_check_dir(struct ctl_table *table) static int sysctl_check_dir(struct nsproxy *namespaces,
struct ctl_table *table)
{ {
struct ctl_table *ref; struct ctl_table *ref;
int error; int error;
error = 0; error = 0;
ref = sysctl_check_lookup(table); ref = sysctl_check_lookup(namespaces, table);
if (ref) { if (ref) {
int match = 0; int match = 0;
if ((!table->procname && !ref->procname) || if ((!table->procname && !ref->procname) ||
...@@ -1427,11 +1429,12 @@ static int sysctl_check_dir(struct ctl_table *table) ...@@ -1427,11 +1429,12 @@ static int sysctl_check_dir(struct ctl_table *table)
return error; return error;
} }
static void sysctl_check_leaf(struct ctl_table *table, const char **fail) static void sysctl_check_leaf(struct nsproxy *namespaces,
struct ctl_table *table, const char **fail)
{ {
struct ctl_table *ref; struct ctl_table *ref;
ref = sysctl_check_lookup(table); ref = sysctl_check_lookup(namespaces, table);
if (ref && (ref != table)) if (ref && (ref != table))
set_fail(fail, table, "Sysctl already exists"); set_fail(fail, table, "Sysctl already exists");
} }
...@@ -1455,7 +1458,7 @@ static void sysctl_check_bin_path(struct ctl_table *table, const char **fail) ...@@ -1455,7 +1458,7 @@ static void sysctl_check_bin_path(struct ctl_table *table, const char **fail)
} }
} }
int sysctl_check_table(struct ctl_table *table) int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
{ {
int error = 0; int error = 0;
for (; table->ctl_name || table->procname; table++) { for (; table->ctl_name || table->procname; table++) {
...@@ -1485,7 +1488,7 @@ int sysctl_check_table(struct ctl_table *table) ...@@ -1485,7 +1488,7 @@ int sysctl_check_table(struct ctl_table *table)
set_fail(&fail, table, "Directory with extra1"); set_fail(&fail, table, "Directory with extra1");
if (table->extra2) if (table->extra2)
set_fail(&fail, table, "Directory with extra2"); set_fail(&fail, table, "Directory with extra2");
if (sysctl_check_dir(table)) if (sysctl_check_dir(namespaces, table))
set_fail(&fail, table, "Inconsistent directory names"); set_fail(&fail, table, "Inconsistent directory names");
} else { } else {
if ((table->strategy == sysctl_data) || if ((table->strategy == sysctl_data) ||
...@@ -1534,7 +1537,7 @@ int sysctl_check_table(struct ctl_table *table) ...@@ -1534,7 +1537,7 @@ int sysctl_check_table(struct ctl_table *table)
if (!table->procname && table->proc_handler) if (!table->procname && table->proc_handler)
set_fail(&fail, table, "proc_handler without procname"); set_fail(&fail, table, "proc_handler without procname");
#endif #endif
sysctl_check_leaf(table, &fail); sysctl_check_leaf(namespaces, table, &fail);
} }
sysctl_check_bin_path(table, &fail); sysctl_check_bin_path(table, &fail);
if (fail) { if (fail) {
...@@ -1542,7 +1545,7 @@ int sysctl_check_table(struct ctl_table *table) ...@@ -1542,7 +1545,7 @@ int sysctl_check_table(struct ctl_table *table)
error = -EINVAL; error = -EINVAL;
} }
if (table->child) if (table->child)
error |= sysctl_check_table(table->child); error |= sysctl_check_table(namespaces, table->child);
} }
return error; return error;
} }
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册