IPC Namespace 详解

pwl@ubuntu:~$ sudo ls -l /proc/$$/ns
[sudo] password for pwl:
total 0
lrwxrwxrwx 1 root root 0 3月  14 10:53 cgroup -> 'cgroup:[4026531835]'
lrwxrwxrwx 1 root root 0 3月  14 10:53 ipc -> 'ipc:[4026531839]'
lrwxrwxrwx 1 root root 0 3月  14 10:53 mnt -> 'mnt:[4026531840]'
lrwxrwxrwx 1 root root 0 3月  14 10:53 net -> 'net:[4026531993]'
lrwxrwxrwx 1 root root 0 3月  14 10:53 pid -> 'pid:[4026531836]'
lrwxrwxrwx 1 root root 0 3月  14 10:53 pid_for_children -> 'pid:[4026531836]'
lrwxrwxrwx 1 root root 0 3月  14 10:53 user -> 'user:[4026531837]'
lrwxrwxrwx 1 root root 0 3月  14 10:53 uts -> 'uts:[4026531838]'
pwl@ubuntu:~$ ipcs

------ Message Queues --------
key        msqid      owner      perms      used-bytes   messages

------ Shared Memory Segments --------
key        shmid      owner      perms      bytes      nattch     status
0x00000000 262144     pwl        600        67108864   2          dest
0x00000000 360449     pwl        600        524288     2          dest

------ Semaphore Arrays --------
key        semid      owner      perms      nsems

pwl@ubuntu:~$

pwl@ubuntu:~$ sudo unshare --ipc
[sudo] password for pwl:
root@ubuntu:~#
root@ubuntu:~# ls -l /proc/$$/ns
total 0
lrwxrwxrwx 1 root root 0 3月  14 10:55 cgroup -> 'cgroup:[4026531835]'
lrwxrwxrwx 1 root root 0 3月  14 10:55 ipc -> 'ipc:[4026532643]'
lrwxrwxrwx 1 root root 0 3月  14 10:55 mnt -> 'mnt:[4026531840]'
lrwxrwxrwx 1 root root 0 3月  14 10:55 net -> 'net:[4026531993]'
lrwxrwxrwx 1 root root 0 3月  14 10:55 pid -> 'pid:[4026531836]'
lrwxrwxrwx 1 root root 0 3月  14 10:55 pid_for_children -> 'pid:[4026531836]'
lrwxrwxrwx 1 root root 0 3月  14 10:55 user -> 'user:[4026531837]'
lrwxrwxrwx 1 root root 0 3月  14 10:55 uts -> 'uts:[4026531838]'
root@ubuntu:~# ipcs

------ Message Queues --------
key        msqid      owner      perms      used-bytes   messages

------ Shared Memory Segments --------
key        shmid      owner      perms      bytes      nattch     status

------ Semaphore Arrays --------
key        semid      owner      perms      nsems

root@ubuntu:~#

copy_ipcs() → create_ipc_ns():

static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
					   struct ipc_namespace *old_ns)
{
	struct ipc_namespace *ns;
	struct ucounts *ucounts;
	int err;

	err = -ENOSPC;
	ucounts = inc_ipc_namespaces(user_ns);
	if (!ucounts)
		goto fail;

	err = -ENOMEM;
    /* (1) 分配新的ipc_namespace数据结构 */
	ns = kmalloc(sizeof(struct ipc_namespace), GFP_KERNEL);
	if (ns == NULL)
		goto fail_dec;

	err = ns_alloc_inum(&ns->ns);
	if (err)
		goto fail_free;
	ns->ns.ops = &ipcns_operations;

	refcount_set(&ns->count, 1);
	ns->user_ns = get_user_ns(user_ns);
	ns->ucounts = ucounts;

    /* (2) 初始化信号量sem对应的idr池和一些参数 */
	err = sem_init_ns(ns);
	if (err)
		goto fail_put;
    /* (3) 初始化消息msg对应的idr池和一些参数 */
	err = msg_init_ns(ns);
	if (err)
		goto fail_destroy_sem;
    /* (4) 初始化共享内存shm对应的idr池和一些参数 */
	err = shm_init_ns(ns);
	if (err)
		goto fail_destroy_msg;
    /* (5) 初始化消息队列mq对应的一些参数 */
	err = mq_init_ns(ns);
	if (err)
		goto fail_destroy_shm;

	return ns;
}

SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
{
	struct ipc_namespace *ns;
    /* (1) 构造 ipc_ops 参数 */
	static const struct ipc_ops sem_ops = {
		.getnew = newary,
		.associate = sem_security,
		.more_checks = sem_more_checks,
	};
	struct ipc_params sem_params;

    /* (2) 构造 ipc namespace 参数 */
	ns = current->nsproxy->ipc_ns;

	if (nsems < 0 || nsems > ns->sc_semmsl)
		return -EINVAL;

    /* (3) 构造 ipc_params 参数 */
	sem_params.key = key;
	sem_params.flg = semflg;
	sem_params.u.nsems = nsems;

    /* (4) 根据key查询已有的ipcp，或者创建新的ipcp */
	return ipcget(ns, &sem_ids(ns), &sem_ops, &sem_params);
}

↓

ipcget() → ipcget_public()

↓

static int ipcget_public(struct ipc_namespace *ns, struct ipc_ids *ids,
		const struct ipc_ops *ops, struct ipc_params *params)
{
	struct kern_ipc_perm *ipcp;
	int flg = params->flg;
	int err;

	/*
	 * Take the lock as a writer since we are potentially going to add
	 * a new entry + read locks are not "upgradable"
	 */
	down_write(&ids->rwsem);
    /* (4.1) 根据key在信号量 idr 池 `ns->ids[IPC_SEM_IDS]`中查找对应的ipcp */
	ipcp = ipc_findkey(ids, params->key);
	if (ipcp == NULL) {
		/* key not used */
		if (!(flg & IPC_CREAT))
			err = -ENOENT;
		else
            /* (4.2) 如果key对应的ipcp不存在，且设置了IPC_CREAT标志
                    则根据key创建一个新的ipcp
             */
			err = ops->getnew(ns, params);
	} else {
		/* ipc object has been locked by ipc_findkey() */

		if (flg & IPC_CREAT && flg & IPC_EXCL)
			err = -EEXIST;
		else {
			err = 0;
            /* (4.3) 如果key对应的ipcp存在，则针对参数进行第一步的检查 */
			if (ops->more_checks)
				err = ops->more_checks(ipcp, params);
			if (!err)
				/*
				 * ipc_check_perms returns the IPC id on
				 * success
				 */
                /* (4.4) ipcp存在，针对参数做第二步的权限检查 */
				err = ipc_check_perms(ns, ipcp, ops, params);
		}
		ipc_unlock(ipcp);
	}
	up_write(&ids->rwsem);

	return err;
}

↓

ops->getnew() → newary()

↓

static int newary(struct ipc_namespace *ns, struct ipc_params *params)
{
	int retval;
	struct sem_array *sma;
	key_t key = params->key;
	int nsems = params->u.nsems;
	int semflg = params->flg;
	int i;

	if (!nsems)
		return -EINVAL;
	if (ns->used_sems + nsems > ns->sc_semmns)
		return -ENOSPC;

    /* (4.2.1) 分配nsems个信号量的数据结构sem_array[] */
	sma = sem_alloc(nsems);
	if (!sma)
		return -ENOMEM;

    /* (4.2.2) 初始化其中的ipcp成员，保存UGO模式，保存对应的key */
	sma->sem_perm.mode = (semflg & S_IRWXUGO);
	sma->sem_perm.key = key;

	sma->sem_perm.security = NULL;
	retval = security_sem_alloc(sma);
	if (retval) {
		kvfree(sma);
		return retval;
	}

	for (i = 0; i < nsems; i++) {
		INIT_LIST_HEAD(&sma->sems[i].pending_alter);
		INIT_LIST_HEAD(&sma->sems[i].pending_const);
		spin_lock_init(&sma->sems[i].lock);
	}

	sma->complex_count = 0;
	sma->use_global_lock = USE_GLOBAL_LOCK_HYSTERESIS;
	INIT_LIST_HEAD(&sma->pending_alter);
	INIT_LIST_HEAD(&sma->pending_const);
	INIT_LIST_HEAD(&sma->list_id);
	sma->sem_nsems = nsems;
	sma->sem_ctime = ktime_get_real_seconds();

	/* ipc_addid() locks sma upon success. */
    /* (4.2.3) 赋值 ipcp 中的 uid、gid
            并将新分配的ipcp加入信号量 idr 池 `ns->ids[IPC_SEM_IDS]`中
     */
	retval = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
	if (retval < 0) {
		call_rcu(&sma->sem_perm.rcu, sem_rcu_free);
		return retval;
	}
	ns->used_sems += nsems;

	sem_unlock(sma, -1);
	rcu_read_unlock();

	return sma->sem_perm.id;
}

↓

int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int limit)
{
	kuid_t euid;
	kgid_t egid;
	int id, err;

	if (limit > IPCMNI)
		limit = IPCMNI;

	if (!ids->tables_initialized || ids->in_use >= limit)
		return -ENOSPC;

	idr_preload(GFP_KERNEL);

	refcount_set(&new->refcount, 1);
	spin_lock_init(&new->lock);
	new->deleted = false;
	rcu_read_lock();
	spin_lock(&new->lock);

    /* (4.2.3.1) 获取当前进程的uid/gid，赋值给 ipcp 的相关成员，
                类似文件的 `chown uid:gid ` 操作
     */
	current_euid_egid(&euid, &egid);
	new->cuid = new->uid = euid;
	new->gid = new->cgid = egid;

	id = ipc_idr_alloc(ids, new);
	idr_preload_end();

    /* (4.2.3.2) 加入信号量 idr 池 `ns->ids[IPC_SEM_IDS]`中 */
	if (id >= 0 && new->key != IPC_PRIVATE) {
		err = rhashtable_insert_fast(&ids->key_ht, &new->khtnode,
					     ipc_kht_params);
		if (err < 0) {
			idr_remove(&ids->ipcs_idr, id);
			id = err;
		}
	}
	if (id < 0) {
		spin_unlock(&new->lock);
		rcu_read_unlock();
		return id;
	}

	ids->in_use++;
	if (id > ids->max_id)
		ids->max_id = id;

	new->id = ipc_buildid(id, ids, new);

	return id;
}

struct kern_ipc_perm {
	spinlock_t	lock;
	bool		deleted;
	int		id;
	key_t		key;
	kuid_t		uid;
	kgid_t		gid;
	kuid_t		cuid;
	kgid_t		cgid;
	umode_t		mode;
	unsigned long	seq;
	void		*security;

	struct rhash_head khtnode;

	struct rcu_head rcu;
	refcount_t refcount;
} ____cacheline_aligned_in_smp __randomize_layout;

struct sem_array {
	struct kern_ipc_perm	sem_perm;	/* permissions .. see ipc.h */
    ...
}

struct shmid_kernel /* private to the kernel */
{
	struct kern_ipc_perm	shm_perm;
    ...
}

struct msg_queue {
	struct kern_ipc_perm q_perm;
    ...
}

ipc_check_perms() → ipcperms()

↓

int ipcperms(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp, short flag)
{
	kuid_t euid = current_euid();
	int requested_mode, granted_mode;

	audit_ipc_obj(ipcp);
    /* (1) 或 请求的 UGO 操作 */
	requested_mode = (flag >> 6) | (flag >> 3) | flag;

    /* (2) 获取 ipcp 的 UGO 规则 */
	granted_mode = ipcp->mode;

    /* (2.1) 如果当前进程 和 ipcp 对象 uid 相等，则取用 U 规则 */
	if (uid_eq(euid, ipcp->cuid) ||
	    uid_eq(euid, ipcp->uid))
		granted_mode >>= 6;
    /* (2.2) 如果当前进程 和 ipcp 对象 gid 相等，则取用 G 规则 */
	else if (in_group_p(ipcp->cgid) || in_group_p(ipcp->gid))
		granted_mode >>= 3;
    /* (2.3) 如果当前进程 和 ipcp 对象 uid gid 都不相等，则取用 O 规则 */

	/* is there some bit set in requested_mode but not in granted_mode? */
    /* (3) 判断请求的操作是否适配对应的规则 */
	if ((requested_mode & ~granted_mode & 0007) &&
	    !ns_capable(ns->user_ns, CAP_IPC_OWNER))
		return -1;

	return security_ipc_permission(ipcp, flag);
}