visor/pkg/sentry/fsimpl/proc/task.go

// Copyright 2019 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package proc

import (
	"bytes"
	"fmt"

	"gvisor.dev/gvisor/pkg/abi/linux"
	"gvisor.dev/gvisor/pkg/context"
	"gvisor.dev/gvisor/pkg/errors/linuxerr"
	"gvisor.dev/gvisor/pkg/sentry/fsimpl/kernfs"
	"gvisor.dev/gvisor/pkg/sentry/kernel"
	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
	"gvisor.dev/gvisor/pkg/sentry/mm"
	"gvisor.dev/gvisor/pkg/sentry/vfs"
)

// taskInode represents the inode for /proc/PID/ directory.
//
// +stateify savable
type taskInode struct {
	implStatFS
	kernfs.InodeAttrs
	kernfs.InodeDirectoryNoNewChildren
	kernfs.InodeNotAnonymous
	kernfs.InodeNotSymlink
	kernfs.InodeTemporary
	kernfs.InodeWatches
	kernfs.OrderedChildren
	taskInodeRefs

	locks vfs.FileLocks

	task *kernel.Task

	dentriesMu dentriesRWMutex `state:"nosave"`
	// dentries is a list of dentries to be invalidated when the task is destroyed.
	dentries map[*kernfs.Dentry]struct{}
}

var _ kernfs.Inode = (*taskInode)(nil)

func (fs *filesystem) newTaskInode(ctx context.Context, task *kernel.Task, pidns *kernel.PIDNamespace, isThreadGroup bool, fakeCgroupControllers map[string]string) (kernfs.Inode, error) {
	if task.ExitState() == kernel.TaskExitDead {
		return nil, linuxerr.ESRCH
	}

	nsEntries := map[string]kernfs.Inode{
		"net":  fs.newNamespaceSymlink(ctx, task, fs.NextIno(), linux.CLONE_NEWNET),
		"mnt":  fs.newNamespaceSymlink(ctx, task, fs.NextIno(), linux.CLONE_NEWNS),
		"pid":  fs.newNamespaceSymlink(ctx, task, fs.NextIno(), linux.CLONE_NEWPID),
		"user": fs.newNamespaceSymlink(ctx, task, fs.NextIno(), linux.CLONE_NEWUSER),
		"ipc":  fs.newNamespaceSymlink(ctx, task, fs.NextIno(), linux.CLONE_NEWIPC),
		"uts":  fs.newNamespaceSymlink(ctx, task, fs.NextIno(), linux.CLONE_NEWUTS),
	}
	if task.Kernel().Cgroup2FS().EverMounted() {
		nsEntries["cgroup"] = fs.newNamespaceSymlink(ctx, task, fs.NextIno(), linux.CLONE_NEWCGROUP)
	}

	contents := map[string]kernfs.Inode{
		"auxv":            fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0400, &mmFile{task: task, ftype: auxvMMFile}),
		"cmdline":         fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0444, &cmdlineData{task: task}),
		"coredump_filter": fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0644, &coredumpFilterData{task: task}),
		"comm":            fs.newComm(ctx, task, fs.NextIno(), 0644),
		"cwd":             fs.newCwdSymlink(ctx, task, fs.NextIno()),
		"environ":         fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0400, &mmFile{task: task, ftype: environMMFile}),
		"exe":             fs.newExeSymlink(ctx, task, fs.NextIno()),
		"fd":              fs.newFDDirInode(ctx, task),
		"fdinfo":          fs.newFDInfoDirInode(ctx, task),
		"gid_map":         fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0644, &idMapData{task: task, gids: true}),
		"io":              fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0400, newIO(task, isThreadGroup)),
		"limits":          fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0444, &limitsData{task: task}),
		"maps":            fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0444, &mmFile{task: task, ftype: mapsMMFile}),
		"mem":             fs.newMemInode(ctx, task, fs.NextIno(), 0600),
		"mountinfo":       fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0444, &mountInfoData{fs: fs, task: task}),
		"mounts":          fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0444, &mountsData{fs: fs, task: task}),
		"net":             fs.newTaskNetDir(ctx, task),
		"ns":              fs.newTaskOwnedDir(ctx, task, fs.NextIno(), 0511, nsEntries),
		"oom_score":       fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0444, newStaticFile("0\n")),
		"oom_score_adj":   fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0644, &oomScoreAdj{task: task}),
		"root":            fs.newRootSymlink(ctx, task, fs.NextIno()),
		"setgroups":       fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0644, &setgroupsData{task: task}),
		"smaps":           fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0444, &mmFile{task: task, ftype: smapsMMFile}),
		"stat":            fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0444, &taskStatData{task: task, pidns: pidns, tgstats: isThreadGroup}),
		"statm":           fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0444, &statmData{task: task}),
		"status":          fs.newStatusInode(ctx, task, pidns, fs.NextIno(), 0444),
		"uid_map":         fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0644, &idMapData{task: task, gids: false}),
	}
	if isThreadGroup {
		contents["task"] = fs.newSubtasks(ctx, task, pidns, fakeCgroupControllers)
	} else {
		contents["children"] = fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0644, &childrenData{task: task, pidns: pidns})
	}
	if len(fakeCgroupControllers) > 0 {
		contents["cgroup"] = fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0444, newFakeCgroupData(fakeCgroupControllers))
	} else {
		contents["cgroup"] = fs.newTaskOwnedInode(ctx, task, fs.NextIno(), 0444, &taskCgroupData{task: task})
	}

	taskInode := &taskInode{
		task:     task,
		dentries: make(map[*kernfs.Dentry]struct{}),
	}
	// Note: credentials are overridden by taskOwnedInode.
	taskInode.InodeAttrs.Init(ctx, task.Credentials(), linux.UNNAMED_MAJOR, fs.devMinor, fs.NextIno(), linux.ModeDirectory|0555)
	taskInode.InitRefs()

	inode := &taskOwnedInode{Inode: taskInode, owner: task}

	taskInode.OrderedChildren.Init(kernfs.OrderedChildrenOptions{})
	links := taskInode.OrderedChildren.Populate(contents)
	taskInode.IncLinks(links)

	return inode, nil
}

func (i *taskInode) TaskDestroyAction(ctx context.Context) {
	i.dentriesMu.Lock()
	dentries := i.dentries
	i.dentries = nil
	i.dentriesMu.Unlock()

	for d := range dentries {
		d.Invalidate(ctx)
	}
}

// RegisterDentry implements kernfs.Inode.RegisterDentry.
func (i *taskInode) RegisterDentry(d *kernfs.Dentry) {
	i.dentriesMu.Lock()
	defer i.dentriesMu.Unlock()

	if i.dentries == nil {
		return
	}
	if len(i.dentries) == 0 && !i.task.RegisterOnDestroyAction(i) {
		// The task has been destroyed.
		i.dentries = nil
		return
	}
	i.dentries[d] = struct{}{}
}

// UnregisterDentry implements kernfs.Inode.RegisterDentry.
func (i *taskInode) UnregisterDentry(d *kernfs.Dentry) {
	i.dentriesMu.Lock()
	defer i.dentriesMu.Unlock()

	delete(i.dentries, d)
	if len(i.dentries) == 0 {
		i.task.UnregisterOnDestroyAction(i)
	}
}

// Valid implements kernfs.Inode.Valid. This inode remains valid as long
// as the task is still running. When it's dead, another tasks with the same
// PID could replace it.
func (i *taskInode) Valid(ctx context.Context, parent *kernfs.Dentry, name string) bool {
	return i.task.ExitState() != kernel.TaskExitDead
}

// Open implements kernfs.Inode.Open.
func (i *taskInode) Open(ctx context.Context, rp *vfs.ResolvingPath, d *kernfs.Dentry, opts vfs.OpenOptions) (*vfs.FileDescription, error) {
	fd, err := kernfs.NewGenericDirectoryFD(rp.Mount(), d, rp.Credentials(), &i.OrderedChildren, &i.locks, &opts, kernfs.GenericDirectoryFDOptions{
		SeekEnd: kernfs.SeekEndZero,
	})
	if err != nil {
		return nil, err
	}
	return fd.VFSFileDescription(), nil
}

// SetStat implements kernfs.Inode.SetStat not allowing inode attributes to be changed.
func (*taskInode) SetStat(context.Context, *vfs.Filesystem, *auth.Credentials, vfs.SetStatOptions) error {
	return linuxerr.EPERM
}

// DecRef implements kernfs.Inode.DecRef.
func (i *taskInode) DecRef(ctx context.Context) {
	i.taskInodeRefs.DecRef(func() { i.Destroy(ctx) })
}

func (i *taskInode) Lookup(ctx context.Context, name string) (kernfs.Inode, error) {
	i.dentriesMu.RLock()
	if i.dentries == nil {
		// The task has been destroyed and the inode invalidate callback has been executed.
		i.dentriesMu.RUnlock()
		return nil, linuxerr.ESRCH
	}
	i.dentriesMu.RUnlock()
	return i.OrderedChildren.Lookup(ctx, name)
}

// taskOwnedInode implements kernfs.Inode and overrides inode owner with task
// effective user and group.
//
// +stateify savable
type taskOwnedInode struct {
	kernfs.Inode

	// owner is the task that owns this inode.
	owner *kernel.Task
}

// TaskFromProcPIDInode implements kernel.TaskOwnedInode.
func (i *taskOwnedInode) TaskFromProcPIDInode() *kernel.Task {
	ino, ok := i.Inode.(*taskInode)
	if !ok {
		return nil
	}
	return ino.task
}

var _ kernfs.Inode = (*taskOwnedInode)(nil)

func (fs *filesystem) newTaskOwnedInode(ctx context.Context, task *kernel.Task, ino uint64, perm linux.FileMode, inode dynamicInode) kernfs.Inode {
	// Note: credentials are overridden by taskOwnedInode.
	inode.Init(ctx, task.Credentials(), linux.UNNAMED_MAJOR, fs.devMinor, ino, inode, perm)

	return &taskOwnedInode{Inode: inode, owner: task}
}

func (fs *filesystem) newTaskOwnedDir(ctx context.Context, task *kernel.Task, ino uint64, perm linux.FileMode, children map[string]kernfs.Inode) kernfs.Inode {
	// Note: credentials are overridden by taskOwnedInode.
	fdOpts := kernfs.GenericDirectoryFDOptions{SeekEnd: kernfs.SeekEndZero}
	dir := kernfs.NewStaticDir(ctx, task.Credentials(), linux.UNNAMED_MAJOR, fs.devMinor, ino, perm, children, fdOpts)

	return &taskOwnedInode{Inode: dir, owner: task}
}

func (i *taskOwnedInode) Valid(ctx context.Context, parent *kernfs.Dentry, name string) bool {
	return i.owner.ExitState() != kernel.TaskExitDead && i.Inode.Valid(ctx, parent, name)
}

// Stat implements kernfs.Inode.Stat.
func (i *taskOwnedInode) Stat(ctx context.Context, fs *vfs.Filesystem, opts vfs.StatOptions) (linux.Statx, error) {
	stat, err := i.Inode.Stat(ctx, fs, opts)
	if err != nil {
		return linux.Statx{}, err
	}
	if opts.Mask&(linux.STATX_UID|linux.STATX_GID) != 0 {
		uid, gid := i.getOwner(linux.FileMode(stat.Mode))
		if opts.Mask&linux.STATX_UID != 0 {
			stat.UID = uint32(uid)
		}
		if opts.Mask&linux.STATX_GID != 0 {
			stat.GID = uint32(gid)
		}
	}
	return stat, nil
}

// CheckPermissions implements kernfs.Inode.CheckPermissions.
func (i *taskOwnedInode) CheckPermissions(ctx context.Context, creds *auth.Credentials, ats vfs.AccessTypes) error {
	mode := i.Mode()
	uid, gid := i.getOwner(mode)
	return vfs.GenericCheckPermissions(creds, ats, mode, nil, uid, gid)
}

func (i *taskOwnedInode) getOwner(mode linux.FileMode) (auth.KUID, auth.KGID) {
	// By default, set the task owner as the file owner.
	creds := i.owner.Credentials()
	uid := creds.EffectiveKUID
	gid := creds.EffectiveKGID

	// Linux doesn't apply dumpability adjustments to world readable/executable
	// directories so that applications can stat /proc/PID to determine the
	// effective UID of a process. See fs/proc/base.c:task_dump_owner.
	if mode.FileType() == linux.ModeDirectory && mode.Permissions() == 0555 {
		return uid, gid
	}

	// If the task is not dumpable, then root (in the namespace preferred)
	// owns the file.
	m := getMM(i.owner)
	if m == nil {
		return auth.RootKUID, auth.RootKGID
	}
	if m.Dumpability() != mm.UserDumpable {
		uid = auth.RootKUID
		if kuid := creds.UserNamespace.MapToKUID(auth.RootUID); kuid.Ok() {
			uid = kuid
		}
		gid = auth.RootKGID
		if kgid := creds.UserNamespace.MapToKGID(auth.RootGID); kgid.Ok() {
			gid = kgid
		}
	}
	return uid, gid
}

func newIO(t *kernel.Task, isThreadGroup bool) *ioData {
	if isThreadGroup {
		return &ioData{ioUsage: t.ThreadGroup()}
	}
	return &ioData{ioUsage: t}
}

// newFakeCgroupData creates an inode that shows fake cgroup
// information passed in as mount options.  From man 7 cgroups: "For
// each cgroup hierarchy of which the process is a member, there is
// one entry containing three colon-separated fields:
// hierarchy-ID:controller-list:cgroup-path"
//
// TODO(b/182488796): Remove once all users adopt cgroupfs.
func newFakeCgroupData(controllers map[string]string) dynamicInode {
	var buf bytes.Buffer

	// The hierarchy ids must be positive integers (for cgroup v1), but the
	// exact number does not matter, so long as they are unique. We can
	// just use a counter, but since linux sorts this file in descending
	// order, we must count down to preserve this behavior.
	i := len(controllers)
	for name, dir := range controllers {
		fmt.Fprintf(&buf, "%d:%s:%s\n", i, name, dir)
		i--
	}
	return newStaticFile(buf.String())
}