[PATCH RFC v3 86/90] cells: add cell_info()

[Josef Bacik]

Add the system call that reads from a cell. It reports the id, state,
flags, exit status, budget, capabilities, ids and network rights of the
cell. It comes after the slots in this series so that it can report all of
them.

The kernel chooses the block of ids that a cell gets. cell_info() tells
the builder which block it was, as soon as one has been allocated. The
builder needs to know, because some things outside of the cell are
configured by id, such as a netfilter rule that matches the owner of a
socket, or a routing rule for a range of uids. These are set up together
with the network of the cell, before anything runs in it. The first id of
the block is reported as the caller sees it. It is not reported at all if
the user namespace of the caller has no mapping for it.

The struct can grow. The caller sets mask to what it wants. The kernel
sets mask to what it filled in, and supported_mask to what it knows about.

With CELL_SELF in place of a cellfd, a task can ask for the id of its own
cell and nothing else.

Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
---
 include/uapi/linux/cell.h | 28 ++++++++++++++
 kernel/cell/core.c        | 93 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 121 insertions(+)

diff --git a/include/uapi/linux/cell.h b/include/uapi/linux/cell.h
index c0d17c890552..22cd5e1f8f24 100644
--- a/include/uapi/linux/cell.h
+++ b/include/uapi/linux/cell.h
@@ -45,6 +45,34 @@ enum cell_state {
 	CELL_DEAD		= 4,	/* Nothing left. The status can be read */
 };
 
+/* cell_info(): bits for @mask. */
+#define CELL_INFO_ID		(1ULL << 0)	/* id, parent_id */
+#define CELL_INFO_STATE		(1ULL << 1)	/* state, flags */
+#define CELL_INFO_EXIT		(1ULL << 2)	/* exit_status, once CELL_DEAD */
+#define CELL_INFO_BUDGET	(1ULL << 3)	/* budget_cgroupid */
+#define CELL_INFO_IDS		(1ULL << 4)	/* ids_count */
+#define CELL_INFO_CAPS		(1ULL << 5)	/* caps */
+#define CELL_INFO_IDS_FIRST	(1ULL << 6)	/* ids_first, if the caller has a name for it */
+#define CELL_INFO_NET_RIGHTS	(1ULL << 7)	/* net_rights */
+
+struct cell_info {
+	__u64 mask;		/* in: what is wanted. out: what was filled in */
+	__u64 supported_mask;	/* out: everything this kernel can fill in */
+	__u64 id;		/* never reused */
+	__u64 parent_id;	/* 0: the host */
+	__u32 state;		/* enum cell_state */
+	__u32 flags;		/* none yet */
+	__s32 exit_status;	/* as wait(2) reports it, of the cell's first task */
+	__u32 ids_count;	/* how many uids and gids the cell has */
+	__u64 budget_cgroupid;
+	__u64 caps;		/* the capabilities its tasks start with, bit by number */
+	__u32 ids_first;	/* what uid 0 and gid 0 of a block are to the caller */
+	__u32 __spare;
+	__u64 net_rights;	/* CELL_NET_* */
+};
+
+#define CELL_INFO_SIZE_VER0	80
+
 /* cell_open(): @what. */
 enum cell_open_what {
 	CELL_OPEN_SLOT		= 0,	/* An fd on the object in the slot named by @key */
diff --git a/kernel/cell/core.c b/kernel/cell/core.c
index c780094ad794..12773f16d188 100644
--- a/kernel/cell/core.c
+++ b/kernel/cell/core.c
@@ -386,3 +386,96 @@ SYSCALL_DEFINE2(cell_kill, int, cfd, unsigned int, flags)
 	cell_kill(cell);
 	return 0;
 }
+
+#define CELL_INFO_SUPPORTED	(CELL_INFO_ID | CELL_INFO_STATE | CELL_INFO_EXIT | \
+				 CELL_INFO_BUDGET | CELL_INFO_IDS | \
+				 CELL_INFO_CAPS | CELL_INFO_IDS_FIRST | \
+				 CELL_INFO_NET_RIGHTS)
+
+/**
+ * sys_cell_info - read from a cell
+ * @cfd:   a cellfd, or CELL_SELF, which tells a task the id of its own cell
+ * @uinfo: where to return it. Only @uinfo->mask is read
+ * @usize: the size of *@uinfo as the caller knows it
+ * @flags: none yet, must be 0
+ *
+ * Fills in what @uinfo->mask asks for and the kernel has, and says in the mask
+ * what that was. @uinfo->supported_mask is everything this kernel knows of.
+ *
+ * Return: 0 or a negative error.
+ */
+SYSCALL_DEFINE4(cell_info, int, cfd, struct cell_info __user *, uinfo,
+		size_t, usize, unsigned int, flags)
+{
+	struct cell_info info = {};
+	struct cell *cell;
+	u64 want;
+
+	BUILD_BUG_ON(sizeof(struct cell_info) != CELL_INFO_SIZE_VER0);
+
+	if (flags)
+		return -EINVAL;
+	if (usize < CELL_INFO_SIZE_VER0)
+		return -EINVAL;
+	/* Only the mask goes in. The rest of the struct is the kernel's to fill. */
+	if (get_user(want, &uinfo->mask))
+		return -EFAULT;
+	info.supported_mask = CELL_INFO_SUPPORTED;
+
+	if (cfd == CELL_SELF) {
+		/* A name, and nothing that a handle would be needed for. */
+		info.id = current_cell_id();
+		info.mask = want & CELL_INFO_ID;
+		return copy_struct_to_user(uinfo, usize, &info, sizeof(info), NULL);
+	}
+
+	CLASS(fd, f)(cfd);
+	cell = cell_from_fd(&f);
+	if (IS_ERR(cell))
+		return PTR_ERR(cell);
+
+	scoped_guard(mutex, &cell->lock) {
+		if (want & CELL_INFO_ID) {
+			info.id = cell->id;
+			/* Cells do not nest yet. */
+			info.parent_id = 0;
+			info.mask |= CELL_INFO_ID;
+		}
+		if (want & CELL_INFO_STATE) {
+			info.state = cell->state;
+			/* There are none yet. */
+			info.flags = 0;
+			info.mask |= CELL_INFO_STATE;
+		}
+		if ((want & CELL_INFO_EXIT) && cell->state == CELL_DEAD) {
+			info.exit_status = cell->exit_status;
+			info.mask |= CELL_INFO_EXIT;
+		}
+		if ((want & CELL_INFO_BUDGET) && cell->budget_id) {
+			info.budget_cgroupid = cell->budget_id;
+			info.mask |= CELL_INFO_BUDGET;
+		}
+		if ((want & CELL_INFO_IDS) && cell->ids_count) {
+			info.ids_count = cell->ids_count;
+			info.mask |= CELL_INFO_IDS;
+		}
+		if (want & CELL_INFO_CAPS) {
+			info.caps = cell->caps.val;
+			info.mask |= CELL_INFO_CAPS;
+		}
+		if (want & CELL_INFO_NET_RIGHTS) {
+			info.net_rights = cell->net_rights;
+			info.mask |= CELL_INFO_NET_RIGHTS;
+		}
+		/* Uids and gids alike. Not everybody has a name for an id of a block. */
+		if ((want & CELL_INFO_IDS_FIRST) && cell->ids_count > 1 && cell->user_ns) {
+			info.ids_first = from_kuid(current_user_ns(),
+						   make_kuid(cell->user_ns, 0));
+			if (info.ids_first != (uid_t)-1)
+				info.mask |= CELL_INFO_IDS_FIRST;
+			else
+				info.ids_first = 0;
+		}
+	}
+	return copy_struct_to_user(uinfo, usize, &info, sizeof(info), NULL);
+}

-- 
2.55.0