Serge E. Hallyn | 858d72e | 2007-10-18 23:39:45 -0700 | [diff] [blame] | 1 | /* |
| 2 | * ns_cgroup.c - namespace cgroup subsystem |
| 3 | * |
| 4 | * Copyright 2006, 2007 IBM Corp |
| 5 | */ |
| 6 | |
| 7 | #include <linux/module.h> |
| 8 | #include <linux/cgroup.h> |
| 9 | #include <linux/fs.h> |
Serge E. Hallyn | e885dcd | 2008-07-25 01:47:06 -0700 | [diff] [blame] | 10 | #include <linux/proc_fs.h> |
Robert P. J. Day | 1aeb272 | 2008-04-29 00:59:25 -0700 | [diff] [blame] | 11 | #include <linux/slab.h> |
Adrian Bunk | 3ff31d0 | 2008-04-29 00:59:55 -0700 | [diff] [blame] | 12 | #include <linux/nsproxy.h> |
Serge E. Hallyn | 858d72e | 2007-10-18 23:39:45 -0700 | [diff] [blame] | 13 | |
| 14 | struct ns_cgroup { |
| 15 | struct cgroup_subsys_state css; |
Serge E. Hallyn | 858d72e | 2007-10-18 23:39:45 -0700 | [diff] [blame] | 16 | }; |
| 17 | |
| 18 | struct cgroup_subsys ns_subsys; |
| 19 | |
| 20 | static inline struct ns_cgroup *cgroup_to_ns( |
| 21 | struct cgroup *cgroup) |
| 22 | { |
| 23 | return container_of(cgroup_subsys_state(cgroup, ns_subsys_id), |
| 24 | struct ns_cgroup, css); |
| 25 | } |
| 26 | |
Serge E. Hallyn | e885dcd | 2008-07-25 01:47:06 -0700 | [diff] [blame] | 27 | int ns_cgroup_clone(struct task_struct *task, struct pid *pid) |
Serge E. Hallyn | 858d72e | 2007-10-18 23:39:45 -0700 | [diff] [blame] | 28 | { |
Serge E. Hallyn | e885dcd | 2008-07-25 01:47:06 -0700 | [diff] [blame] | 29 | char name[PROC_NUMBUF]; |
| 30 | |
| 31 | snprintf(name, PROC_NUMBUF, "%d", pid_vnr(pid)); |
| 32 | return cgroup_clone(task, &ns_subsys, name); |
Serge E. Hallyn | 858d72e | 2007-10-18 23:39:45 -0700 | [diff] [blame] | 33 | } |
| 34 | |
| 35 | /* |
| 36 | * Rules: |
| 37 | * 1. you can only enter a cgroup which is a child of your current |
| 38 | * cgroup |
| 39 | * 2. you can only place another process into a cgroup if |
| 40 | * a. you have CAP_SYS_ADMIN |
| 41 | * b. your cgroup is an ancestor of task's destination cgroup |
| 42 | * (hence either you are in the same cgroup as task, or in an |
| 43 | * ancestor cgroup thereof) |
| 44 | */ |
| 45 | static int ns_can_attach(struct cgroup_subsys *ss, |
| 46 | struct cgroup *new_cgroup, struct task_struct *task) |
| 47 | { |
| 48 | struct cgroup *orig; |
| 49 | |
| 50 | if (current != task) { |
| 51 | if (!capable(CAP_SYS_ADMIN)) |
| 52 | return -EPERM; |
| 53 | |
| 54 | if (!cgroup_is_descendant(new_cgroup)) |
| 55 | return -EPERM; |
| 56 | } |
| 57 | |
| 58 | if (atomic_read(&new_cgroup->count) != 0) |
| 59 | return -EPERM; |
| 60 | |
| 61 | orig = task_cgroup(task, ns_subsys_id); |
| 62 | if (orig && orig != new_cgroup->parent) |
| 63 | return -EPERM; |
| 64 | |
| 65 | return 0; |
| 66 | } |
| 67 | |
| 68 | /* |
| 69 | * Rules: you can only create a cgroup if |
| 70 | * 1. you are capable(CAP_SYS_ADMIN) |
| 71 | * 2. the target cgroup is a descendant of your own cgroup |
| 72 | */ |
| 73 | static struct cgroup_subsys_state *ns_create(struct cgroup_subsys *ss, |
| 74 | struct cgroup *cgroup) |
| 75 | { |
| 76 | struct ns_cgroup *ns_cgroup; |
| 77 | |
| 78 | if (!capable(CAP_SYS_ADMIN)) |
| 79 | return ERR_PTR(-EPERM); |
| 80 | if (!cgroup_is_descendant(cgroup)) |
| 81 | return ERR_PTR(-EPERM); |
| 82 | |
| 83 | ns_cgroup = kzalloc(sizeof(*ns_cgroup), GFP_KERNEL); |
| 84 | if (!ns_cgroup) |
| 85 | return ERR_PTR(-ENOMEM); |
Serge E. Hallyn | 858d72e | 2007-10-18 23:39:45 -0700 | [diff] [blame] | 86 | return &ns_cgroup->css; |
| 87 | } |
| 88 | |
| 89 | static void ns_destroy(struct cgroup_subsys *ss, |
| 90 | struct cgroup *cgroup) |
| 91 | { |
| 92 | struct ns_cgroup *ns_cgroup; |
| 93 | |
| 94 | ns_cgroup = cgroup_to_ns(cgroup); |
| 95 | kfree(ns_cgroup); |
| 96 | } |
| 97 | |
| 98 | struct cgroup_subsys ns_subsys = { |
| 99 | .name = "ns", |
| 100 | .can_attach = ns_can_attach, |
| 101 | .create = ns_create, |
| 102 | .destroy = ns_destroy, |
| 103 | .subsys_id = ns_subsys_id, |
| 104 | }; |