Create ipc package and ipc.Object.

Create ipc.Object to define fields and functionality used in SysV
mechanisms, and have them use it.

2 files changed, 54 insertions, 103 deletions

diff --git a/pkg/sentry/kernel/shm/BUILD b/pkg/sentry/kernel/shm/BUILD
index 5b69333fe..4e8deac4c 100644
--- a/pkg/sentry/kernel/shm/BUILD
+++ b/pkg/sentry/kernel/shm/BUILD
@@ -36,6 +36,7 @@ go_library(
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/kernel/auth",
+        "//pkg/sentry/kernel/ipc",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/memmap",
         "//pkg/sentry/pgalloc",
diff --git a/pkg/sentry/kernel/shm/shm.go b/pkg/sentry/kernel/shm/shm.go
index f7ac4c2b2..459ae8c30 100644
--- a/pkg/sentry/kernel/shm/shm.go
+++ b/pkg/sentry/kernel/shm/shm.go
@@ -43,6 +43,7 @@ import (
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/sentry/fs"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
+	"gvisor.dev/gvisor/pkg/sentry/kernel/ipc"
 	ktime "gvisor.dev/gvisor/pkg/sentry/kernel/time"
 	"gvisor.dev/gvisor/pkg/sentry/memmap"
 	"gvisor.dev/gvisor/pkg/sentry/pgalloc"
@@ -51,12 +52,6 @@ import (
 	"gvisor.dev/gvisor/pkg/syserror"
 )
 
-// Key represents a shm segment key. Analogous to a file name.
-type Key int32
-
-// ID represents the opaque handle for a shm segment. Analogous to an fd.
-type ID int32
-
 // Registry tracks all shared memory segments in an IPC namespace. The registry
 // provides the mechanisms for creating and finding segments, and reporting
 // global shm parameters.
@@ -78,13 +73,13 @@ type Registry struct {
 	// exists a short window during which a Shm still exists in Shm, but is
 	// unreferenced. Users must use TryIncRef to determine if the Shm is
 	// still valid.
-	shms map[ID]*Shm
+	shms map[ipc.ID]*Shm
 
 	// keysToShms maps segment keys to segments.
 	//
 	// Shms in keysToShms are guaranteed to be referenced, as they are
 	// removed by disassociateKey before the last DecRef.
-	keysToShms map[Key]*Shm
+	keysToShms map[ipc.Key]*Shm
 
 	// Sum of the sizes of all existing segments rounded up to page size, in
 	// units of page size.
@@ -92,22 +87,22 @@ type Registry struct {
 
 	// ID assigned to the last created segment. Used to quickly find the next
 	// unused ID.
-	lastIDUsed ID
+	lastIDUsed ipc.ID
 }
 
 // NewRegistry creates a new shm registry.
 func NewRegistry(userNS *auth.UserNamespace) *Registry {
 	return &Registry{
 		userNS:     userNS,
-		shms:       make(map[ID]*Shm),
-		keysToShms: make(map[Key]*Shm),
+		shms:       make(map[ipc.ID]*Shm),
+		keysToShms: make(map[ipc.Key]*Shm),
 	}
 }
 
 // FindByID looks up a segment given an ID.
 //
 // FindByID returns a reference on Shm.
-func (r *Registry) FindByID(id ID) *Shm {
+func (r *Registry) FindByID(id ipc.ID) *Shm {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	s := r.shms[id]
@@ -129,9 +124,9 @@ func (r *Registry) dissociateKey(s *Shm) {
 	defer r.mu.Unlock()
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	if s.key != linux.IPC_PRIVATE {
-		delete(r.keysToShms, s.key)
-		s.key = linux.IPC_PRIVATE
+	if s.obj.Key != linux.IPC_PRIVATE {
+		delete(r.keysToShms, s.obj.Key)
+		s.obj.Key = linux.IPC_PRIVATE
 	}
 }
 
@@ -139,7 +134,7 @@ func (r *Registry) dissociateKey(s *Shm) {
 // analogous to open(2).
 //
 // FindOrCreate returns a reference on Shm.
-func (r *Registry) FindOrCreate(ctx context.Context, pid int32, key Key, size uint64, mode linux.FileMode, private, create, exclusive bool) (*Shm, error) {
+func (r *Registry) FindOrCreate(ctx context.Context, pid int32, key ipc.Key, size uint64, mode linux.FileMode, private, create, exclusive bool) (*Shm, error) {
 	if (create || private) && (size < linux.SHMMIN || size > linux.SHMMAX) {
 		// "A new segment was to be created and size is less than SHMMIN or
 		// greater than SHMMAX." - man shmget(2)
@@ -165,7 +160,8 @@ func (r *Registry) FindOrCreate(ctx context.Context, pid int32, key Key, size ui
 			defer shm.mu.Unlock()
 
 			// Check that caller can access the segment.
-			if !shm.checkPermissions(ctx, fs.PermsFromMode(mode)) {
+			creds := auth.CredentialsFromContext(ctx)
+			if !shm.obj.CheckPermissions(creds, fs.PermsFromMode(mode)) {
 				// "The user does not have permission to access the shared
 				// memory segment, and does not have the CAP_IPC_OWNER
 				// capability in the user namespace that governs its IPC
@@ -227,7 +223,7 @@ func (r *Registry) FindOrCreate(ctx context.Context, pid int32, key Key, size ui
 // newShm creates a new segment in the registry.
 //
 // Precondition: Caller must hold r.mu.
-func (r *Registry) newShm(ctx context.Context, pid int32, key Key, creator fs.FileOwner, perms fs.FilePermissions, size uint64) (*Shm, error) {
+func (r *Registry) newShm(ctx context.Context, pid int32, key ipc.Key, creator fs.FileOwner, perms fs.FilePermissions, size uint64) (*Shm, error) {
 	mfp := pgalloc.MemoryFileProviderFromContext(ctx)
 	if mfp == nil {
 		panic(fmt.Sprintf("context.Context %T lacks non-nil value for key %T", ctx, pgalloc.CtxMemoryFileProvider))
@@ -239,21 +235,6 @@ func (r *Registry) newShm(ctx context.Context, pid int32, key Key, creator fs.Fi
 		return nil, err
 	}
 
-	shm := &Shm{
-		mfp:           mfp,
-		registry:      r,
-		creator:       creator,
-		size:          size,
-		effectiveSize: effectiveSize,
-		fr:            fr,
-		key:           key,
-		perms:         perms,
-		owner:         creator,
-		creatorPID:    pid,
-		changeTime:    ktime.NowFromContext(ctx),
-	}
-	shm.InitRefs()
-
 	// Find the next available ID.
 	for id := r.lastIDUsed + 1; id != r.lastIDUsed; id++ {
 		// Handle wrap around.
@@ -264,7 +245,18 @@ func (r *Registry) newShm(ctx context.Context, pid int32, key Key, creator fs.Fi
 		if r.shms[id] == nil {
 			r.lastIDUsed = id
 
-			shm.ID = id
+			shm := &Shm{
+				mfp:           mfp,
+				registry:      r,
+				size:          size,
+				effectiveSize: effectiveSize,
+				obj:           ipc.NewObject(r.userNS, ipc.ID(id), ipc.Key(key), creator, creator, perms),
+				fr:            fr,
+				creatorPID:    pid,
+				changeTime:    ktime.NowFromContext(ctx),
+			}
+			shm.InitRefs()
+
 			r.shms[id] = shm
 			r.keysToShms[key] = shm
 
@@ -314,11 +306,11 @@ func (r *Registry) remove(s *Shm) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	if s.key != linux.IPC_PRIVATE {
+	if s.obj.Key != linux.IPC_PRIVATE {
 		panic(fmt.Sprintf("Attempted to remove %s from the registry whose key is still associated", s.debugLocked()))
 	}
 
-	delete(r.shms, s.ID)
+	delete(r.shms, s.obj.ID)
 	r.totalPages -= s.effectiveSize / hostarch.PageSize
 }
 
@@ -374,12 +366,6 @@ type Shm struct {
 	// registry points to the shm registry containing this segment. Immutable.
 	registry *Registry
 
-	// ID is the kernel identifier for this segment. Immutable.
-	ID ID
-
-	// creator is the user that created the segment. Immutable.
-	creator fs.FileOwner
-
 	// size is the requested size of the segment at creation, in
 	// bytes. Immutable.
 	size uint64
@@ -397,14 +383,9 @@ type Shm struct {
 	// mu protects all fields below.
 	mu sync.Mutex `state:"nosave"`
 
-	// key is the public identifier for this segment.
-	key Key
+	// obj defines basic fields that should be included in all SysV IPC objects.
+	obj *ipc.Object
 
-	// perms is the access permissions for the segment.
-	perms fs.FilePermissions
-
-	// owner of this segment.
-	owner fs.FileOwner
 	// attachTime is updated on every successful shmat.
 	attachTime ktime.Time
 	// detachTime is updated on every successful shmdt.
@@ -426,17 +407,22 @@ type Shm struct {
 	pendingDestruction bool
 }
 
+// ID returns object's ID.
+func (s *Shm) ID() ipc.ID {
+	return s.obj.ID
+}
+
 // Precondition: Caller must hold s.mu.
 func (s *Shm) debugLocked() string {
 	return fmt.Sprintf("Shm{id: %d, key: %d, size: %d bytes, refs: %d, destroyed: %v}",
-		s.ID, s.key, s.size, s.ReadRefs(), s.pendingDestruction)
+		s.obj.ID, s.obj.Key, s.size, s.ReadRefs(), s.pendingDestruction)
 }
 
 // MappedName implements memmap.MappingIdentity.MappedName.
 func (s *Shm) MappedName(ctx context.Context) string {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	return fmt.Sprintf("SYSV%08d", s.key)
+	return fmt.Sprintf("SYSV%08d", s.obj.Key)
 }
 
 // DeviceID implements memmap.MappingIdentity.DeviceID.
@@ -448,7 +434,7 @@ func (s *Shm) DeviceID() uint64 {
 func (s *Shm) InodeID() uint64 {
 	// "shmid gets reported as "inode#" in /proc/pid/maps. proc-ps tools use
 	// this. Changing this will break them." -- Linux, ipc/shm.c:newseg()
-	return uint64(s.ID)
+	return uint64(s.obj.ID)
 }
 
 // DecRef drops a reference on s.
@@ -551,7 +537,8 @@ func (s *Shm) ConfigureAttach(ctx context.Context, addr hostarch.Addr, opts Atta
 		return memmap.MMapOpts{}, syserror.EIDRM
 	}
 
-	if !s.checkPermissions(ctx, fs.PermMask{
+	creds := auth.CredentialsFromContext(ctx)
+	if !s.obj.CheckPermissions(creds, fs.PermMask{
 		Read:    true,
 		Write:   !opts.Readonly,
 		Execute: opts.Execute,
@@ -591,7 +578,8 @@ func (s *Shm) IPCStat(ctx context.Context) (*linux.ShmidDS, error) {
 
 	// "The caller must have read permission on the shared memory segment."
 	//   - man shmctl(2)
-	if !s.checkPermissions(ctx, fs.PermMask{Read: true}) {
+	creds := auth.CredentialsFromContext(ctx)
+	if !s.obj.CheckPermissions(creds, fs.PermMask{Read: true}) {
 		// "IPC_STAT or SHM_STAT is requested and shm_perm.mode does not allow
 		// read access for shmid, and the calling process does not have the
 		// CAP_IPC_OWNER capability in the user namespace that governs its IPC
@@ -603,7 +591,6 @@ func (s *Shm) IPCStat(ctx context.Context) (*linux.ShmidDS, error) {
 	if s.pendingDestruction {
 		mode |= linux.SHM_DEST
 	}
-	creds := auth.CredentialsFromContext(ctx)
 
 	// Use the reference count as a rudimentary count of the number of
 	// attaches. We exclude:
@@ -620,12 +607,12 @@ func (s *Shm) IPCStat(ctx context.Context) (*linux.ShmidDS, error) {
 
 	ds := &linux.ShmidDS{
 		ShmPerm: linux.IPCPerm{
-			Key:  uint32(s.key),
-			UID:  uint32(creds.UserNamespace.MapFromKUID(s.owner.UID)),
-			GID:  uint32(creds.UserNamespace.MapFromKGID(s.owner.GID)),
-			CUID: uint32(creds.UserNamespace.MapFromKUID(s.creator.UID)),
-			CGID: uint32(creds.UserNamespace.MapFromKGID(s.creator.GID)),
-			Mode: mode | uint16(s.perms.LinuxMode()),
+			Key:  uint32(s.obj.Key),
+			UID:  uint32(creds.UserNamespace.MapFromKUID(s.obj.Owner.UID)),
+			GID:  uint32(creds.UserNamespace.MapFromKGID(s.obj.Owner.GID)),
+			CUID: uint32(creds.UserNamespace.MapFromKUID(s.obj.Creator.UID)),
+			CGID: uint32(creds.UserNamespace.MapFromKGID(s.obj.Creator.GID)),
+			Mode: mode | uint16(s.obj.Perms.LinuxMode()),
 			Seq:  0, // IPC sequences not supported.
 		},
 		ShmSegsz:   s.size,
@@ -645,11 +632,11 @@ func (s *Shm) Set(ctx context.Context, ds *linux.ShmidDS) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	if !s.checkOwnership(ctx) {
+	creds := auth.CredentialsFromContext(ctx)
+	if !s.obj.CheckOwnership(creds) {
 		return linuxerr.EPERM
 	}
 
-	creds := auth.CredentialsFromContext(ctx)
 	uid := creds.UserNamespace.MapToKUID(auth.UID(ds.ShmPerm.UID))
 	gid := creds.UserNamespace.MapToKGID(auth.GID(ds.ShmPerm.GID))
 	if !uid.Ok() || !gid.Ok() {
@@ -659,10 +646,10 @@ func (s *Shm) Set(ctx context.Context, ds *linux.ShmidDS) error {
 	// User may only modify the lower 9 bits of the mode. All the other bits are
 	// always 0 for the underlying inode.
 	mode := linux.FileMode(ds.ShmPerm.Mode & 0x1ff)
-	s.perms = fs.FilePermsFromMode(mode)
+	s.obj.Perms = fs.FilePermsFromMode(mode)
 
-	s.owner.UID = uid
-	s.owner.GID = gid
+	s.obj.Owner.UID = uid
+	s.obj.Owner.GID = gid
 
 	s.changeTime = ktime.NowFromContext(ctx)
 	return nil
@@ -691,40 +678,3 @@ func (s *Shm) MarkDestroyed(ctx context.Context) {
 	s.DecRef(ctx)
 	return
 }
-
-// checkOwnership verifies whether a segment may be accessed by ctx as an
-// owner. See ipc/util.c:ipcctl_pre_down_nolock() in Linux.
-//
-// Precondition: Caller must hold s.mu.
-func (s *Shm) checkOwnership(ctx context.Context) bool {
-	creds := auth.CredentialsFromContext(ctx)
-	if s.owner.UID == creds.EffectiveKUID || s.creator.UID == creds.EffectiveKUID {
-		return true
-	}
-
-	// Tasks with CAP_SYS_ADMIN may bypass ownership checks. Strangely, Linux
-	// doesn't use CAP_IPC_OWNER for this despite CAP_IPC_OWNER being documented
-	// for use to "override IPC ownership checks".
-	return creds.HasCapabilityIn(linux.CAP_SYS_ADMIN, s.registry.userNS)
-}
-
-// checkPermissions verifies whether a segment is accessible by ctx for access
-// described by req. See ipc/util.c:ipcperms() in Linux.
-//
-// Precondition: Caller must hold s.mu.
-func (s *Shm) checkPermissions(ctx context.Context, req fs.PermMask) bool {
-	creds := auth.CredentialsFromContext(ctx)
-
-	p := s.perms.Other
-	if s.owner.UID == creds.EffectiveKUID {
-		p = s.perms.User
-	} else if creds.InGroup(s.owner.GID) {
-		p = s.perms.Group
-	}
-	if p.SupersetOf(req) {
-		return true
-	}
-
-	// Tasks with CAP_IPC_OWNER may bypass permission checks.
-	return creds.HasCapabilityIn(linux.CAP_IPC_OWNER, s.registry.userNS)
-}