[PATCH RFC v3 26/90] cells: add cell_configure()

[Josef Bacik <josef@toxicpanda.com>]

Add the system call that changes a cell. It is modelled on fsconfig(): it
takes a command, a key and a value, and data only flows into the kernel.
Reading from a cell is a separate system call, so that a seccomp filter
can allow a monitor to read and deny it to change anything.

Holding the cellfd is the only authority that is needed over the cell.

This patch adds the framework and the one key that depends on nothing
else, the "hostname" string. There are no flags for CELL_SET_FLAG yet.
Every command requires the cell to be in the BUILDING state.

Signed-off-by: Josef Bacik <josef@toxicpanda.com>
---
 include/uapi/linux/cell.h |   9 +++
 kernel/cell/Makefile      |   1 +
 kernel/cell/slots.c       | 136 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 146 insertions(+)

diff --git a/include/uapi/linux/cell.h b/include/uapi/linux/cell.h
index f3589a23a596..22337cab3da1 100644
--- a/include/uapi/linux/cell.h
+++ b/include/uapi/linux/cell.h
@@ -12,6 +12,15 @@
 
 /* cell_create(): @parent is CELL_SELF, see <linux/fcntl.h>. */
 
+/* cell_configure(): @cmd. Data only ever goes in. */
+enum cell_configure_cmd {
+	CELL_SET_FLAG		= 0,	/* Set the flag named by @key. There are none yet */
+	CELL_SET_STRING		= 1,	/* Set @key to the string in @value */
+	CELL_SET_BINARY		= 2,	/* Set @key to the @aux bytes at @value */
+	CELL_SET_FD		= 3,	/* Fill the slot named by @key from fd @aux */
+	CELL_CMD_SEAL		= 4,	/* Validate everything and seal */
+};
+
 /* Life of a cell. It only ever moves down this list. */
 enum cell_state {
 	CELL_BUILDING		= 0,	/* Slots may be filled */
diff --git a/kernel/cell/Makefile b/kernel/cell/Makefile
index e343e0fa72b0..ac48bfb289d0 100644
--- a/kernel/cell/Makefile
+++ b/kernel/cell/Makefile
@@ -1,2 +1,3 @@
 # SPDX-License-Identifier: GPL-2.0-only
 obj-y += core.o
+obj-y += slots.o
diff --git a/kernel/cell/slots.c b/kernel/cell/slots.c
new file mode 100644
index 000000000000..905672db9936
--- /dev/null
+++ b/kernel/cell/slots.c
@@ -0,0 +1,136 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Cells: filling the slots of a cell, and sealing it.
+ */
+#include <linux/cgroup.h>
+#include <linux/fs.h>
+#include <linux/mnt_namespace.h>
+#include <linux/nsfs.h>
+#include <linux/nsproxy.h>
+#include <linux/pid_namespace.h>
+#include <linux/proc_fs.h>
+#include <linux/proc_ns.h>
+#include <linux/slab.h>
+#include <linux/syscalls.h>
+#include <net/net_namespace.h>
+#include <uapi/linux/cell.h>
+
+#include "internal.h"
+
+/*
+ * Slots. All of these run with cell->lock held and the cell BUILDING. Filling a
+ * slot takes what using the object that goes into it would take: holding the
+ * cellfd is authority over the cell, not over what is put into it.
+ */
+
+static int cell_set_hostname(struct cell *cell, const char *val)
+{
+	if (strlen(val) > __NEW_UTS_LEN)
+		return -ENAMETOOLONG;
+	strscpy(cell->hostname, val);
+	return 0;
+}
+
+static int cell_set_string(struct cell *cell, const char *key, const char *val)
+{
+	if (!strcmp(key, "hostname"))
+		return cell_set_hostname(cell, val);
+	return -EINVAL;
+}
+
+static int cell_set_binary(struct cell *cell, const char *key,
+			   const void __user *uvalue, size_t len)
+{
+	return -EINVAL;
+}
+
+static int cell_set_fd(struct cell *cell, const char *key, struct file *file)
+{
+	return -EINVAL;
+}
+
+/**
+ * sys_cell_configure - change a cell
+ * @cfd:    a cellfd
+ * @cmd:    one of enum cell_configure_cmd
+ * @ukey:   the name of what is set, or NULL for the commands that take none
+ * @uvalue: a string for CELL_SET_STRING, @aux bytes for CELL_SET_BINARY
+ * @aux:    a length for CELL_SET_BINARY, a file descriptor for CELL_SET_FD
+ *
+ * Shaped like fsconfig(). Data only goes in. Holding @cfd is all the authority
+ * it takes over the cell. Filling a slot also takes what using the object that
+ * goes into it would take.
+ *
+ * All of it needs the cell to be in state CELL_BUILDING.
+ *
+ * Return: 0, -EBUSY if the cell is past CELL_BUILDING or the slot is taken,
+ * -EOPNOTSUPP for an unknown @cmd or a reserved key, -EINVAL for an unknown key
+ * or arguments that do not go with @cmd, or what the slot has to say.
+ */
+SYSCALL_DEFINE5(cell_configure, int, cfd, unsigned int, cmd,
+		const char __user *, ukey, const void __user *, uvalue, int, aux)
+{
+	char *key __free(kfree) = NULL;
+	char *str __free(kfree) = NULL;
+	struct cell *cell;
+
+	CLASS(fd, f)(cfd);
+	cell = cell_from_fd(&f);
+	if (IS_ERR(cell))
+		return PTR_ERR(cell);
+
+	switch (cmd) {
+	case CELL_SET_FLAG:
+		if (!ukey || uvalue || aux)
+			return -EINVAL;
+		break;
+	case CELL_SET_STRING:
+		if (!ukey || !uvalue || aux)
+			return -EINVAL;
+		break;
+	case CELL_SET_BINARY:
+		if (!ukey || !uvalue || aux <= 0)
+			return -EINVAL;
+		break;
+	case CELL_SET_FD:
+		if (!ukey || uvalue || aux < 0)
+			return -EINVAL;
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	if (ukey) {
+		key = strndup_user(ukey, CELL_KEY_MAX);
+		if (IS_ERR(key))
+			return PTR_ERR(no_free_ptr(key));
+	}
+	if (cmd == CELL_SET_STRING) {
+		str = strndup_user(uvalue, 256);
+		if (IS_ERR(str))
+			return PTR_ERR(no_free_ptr(str));
+	}
+
+	guard(mutex)(&cell->lock);
+
+	if (cell->state != CELL_BUILDING)
+		return -EBUSY;
+
+	switch (cmd) {
+	case CELL_SET_FLAG:
+		/* There are none yet. */
+		return -EINVAL;
+	case CELL_SET_STRING:
+		return cell_set_string(cell, key, str);
+	case CELL_SET_BINARY:
+		return cell_set_binary(cell, key, uvalue, aux);
+	case CELL_SET_FD: {
+		CLASS(fd_raw, slot)(aux);
+
+		if (fd_empty(slot))
+			return -EBADF;
+		return cell_set_fd(cell, key, fd_file(slot));
+	}
+	}
+	return -EOPNOTSUPP;
+}

-- 
2.55.0