/*
* task_end()
*
* Overview
* task_end() contains the actions executed once the final member of
* a task has released the task, and all actions connected with the task, such
* as committing an accounting record to a file, are completed. It is called
* by the known last consumer of the task information. Additionally,
* task_end() must never refer to any process in the system.
*
* Return values
* None.
*
* Caller's context
* No restrictions on context, beyond that given above.
*/
void
task_end(task_t *tk)
{
ASSERT(tk->tk_hold_count == 0);
project_rele(tk->tk_proj);
kmem_free(tk->tk_usage, sizeof (task_usage_t));
kmem_free(tk->tk_inherited, sizeof (task_usage_t));
if (tk->tk_prevusage != NULL)
kmem_free(tk->tk_prevusage, sizeof (task_usage_t));
if (tk->tk_zoneusage != NULL)
kmem_free(tk->tk_zoneusage, sizeof (task_usage_t));
rctl_set_free(tk->tk_rctls);
id_free(taskid_space, tk->tk_tkid);
zone_task_rele(tk->tk_zone);
kmem_cache_free(task_cache, tk);
}
static void
changeproj(proc_t *p, kproject_t *kpj, zone_t *zone, void *projbuf,
void *zonebuf)
{
kproject_t *oldkpj;
kthread_t *t;
ASSERT(MUTEX_HELD(&pidlock));
ASSERT(MUTEX_HELD(&p->p_lock));
if ((t = p->p_tlist) != NULL) {
do {
(void) project_hold(kpj);
thread_lock(t);
oldkpj = ttoproj(t);
/*
* Kick this thread so that he doesn't sit
* on a wrong wait queue.
*/
if (ISWAITING(t))
setrun_locked(t);
/*
* The thread wants to go on the project wait queue, but
* the waitq is changing.
*/
if (t->t_schedflag & TS_PROJWAITQ)
t->t_schedflag &= ~ TS_PROJWAITQ;
t->t_proj = kpj;
t->t_pre_sys = 1; /* For cred update */
thread_unlock(t);
fss_changeproj(t, kpj, zone, projbuf, zonebuf);
project_rele(oldkpj);
} while ((t = t->t_forw) != p->p_tlist);
}
}
static int
pset_bind(psetid_t pset, idtype_t idtype, id_t id, psetid_t *opset)
{
kthread_t *tp;
proc_t *pp;
task_t *tk;
kproject_t *kpj;
contract_t *ct;
zone_t *zptr;
psetid_t oldpset;
int error = 0;
void *projbuf, *zonebuf;
pool_lock();
if ((pset != PS_QUERY) && (pset != PS_SOFT) &&
(pset != PS_HARD) && (pset != PS_QUERY_TYPE)) {
/*
* Check if the set actually exists before checking
* permissions. This is the historical error
* precedence. Note that if pset was PS_MYID, the
* cpupart_get_cpus call will change it to the
* processor set id of the caller (or PS_NONE if the
* caller is not bound to a processor set).
*/
if (pool_state == POOL_ENABLED) {
pool_unlock();
return (set_errno(ENOTSUP));
}
if (cpupart_get_cpus(&pset, NULL, NULL) != 0) {
pool_unlock();
return (set_errno(EINVAL));
} else if (pset != PS_NONE && secpolicy_pset(CRED()) != 0) {
pool_unlock();
return (set_errno(EPERM));
}
}
/*
* Pre-allocate enough buffers for FSS for all active projects
* and for all active zones on the system. Unused buffers will
* be freed later by fss_freebuf().
*/
mutex_enter(&cpu_lock);
projbuf = fss_allocbuf(FSS_NPROJ_BUF, FSS_ALLOC_PROJ);
zonebuf = fss_allocbuf(FSS_NPROJ_BUF, FSS_ALLOC_ZONE);
switch (idtype) {
case P_LWPID:
pp = curproc;
mutex_enter(&pidlock);
mutex_enter(&pp->p_lock);
if (id == P_MYID) {
tp = curthread;
} else {
if ((tp = idtot(pp, id)) == NULL) {
mutex_exit(&pp->p_lock);
mutex_exit(&pidlock);
error = ESRCH;
break;
}
}
error = pset_bind_thread(tp, pset, &oldpset, projbuf, zonebuf);
mutex_exit(&pp->p_lock);
mutex_exit(&pidlock);
break;
case P_PID:
mutex_enter(&pidlock);
if (id == P_MYID) {
pp = curproc;
} else if ((pp = prfind(id)) == NULL) {
mutex_exit(&pidlock);
error = ESRCH;
break;
}
error = pset_bind_process(pp, pset, &oldpset, projbuf, zonebuf);
mutex_exit(&pidlock);
break;
case P_TASKID:
mutex_enter(&pidlock);
if (id == P_MYID)
id = curproc->p_task->tk_tkid;
if ((tk = task_hold_by_id(id)) == NULL) {
mutex_exit(&pidlock);
error = ESRCH;
break;
}
error = pset_bind_task(tk, pset, &oldpset, projbuf, zonebuf);
mutex_exit(&pidlock);
task_rele(tk);
break;
case P_PROJID:
pp = curproc;
if (id == P_MYID)
id = curprojid();
if ((kpj = project_hold_by_id(id, pp->p_zone,
PROJECT_HOLD_FIND)) == NULL) {
error = ESRCH;
break;
}
mutex_enter(&pidlock);
error = pset_bind_project(kpj, pset, &oldpset, projbuf,
zonebuf);
mutex_exit(&pidlock);
project_rele(kpj);
break;
case P_ZONEID:
if (id == P_MYID)
id = getzoneid();
if ((zptr = zone_find_by_id(id)) == NULL) {
error = ESRCH;
break;
}
mutex_enter(&pidlock);
error = pset_bind_zone(zptr, pset, &oldpset, projbuf, zonebuf);
mutex_exit(&pidlock);
zone_rele(zptr);
break;
case P_CTID:
if (id == P_MYID)
id = PRCTID(curproc);
if ((ct = contract_type_ptr(process_type, id,
curproc->p_zone->zone_uniqid)) == NULL) {
error = ESRCH;
break;
}
mutex_enter(&pidlock);
error = pset_bind_contract(ct->ct_data, pset, &oldpset, projbuf,
zonebuf);
mutex_exit(&pidlock);
contract_rele(ct);
break;
case P_PSETID:
if (id == P_MYID || pset != PS_NONE || !INGLOBALZONE(curproc)) {
error = EINVAL;
break;
}
error = pset_unbind(id, projbuf, zonebuf, idtype);
break;
case P_ALL:
if (id == P_MYID || pset != PS_NONE || !INGLOBALZONE(curproc)) {
error = EINVAL;
break;
}
error = pset_unbind(PS_NONE, projbuf, zonebuf, idtype);
break;
default:
error = EINVAL;
break;
}
fss_freebuf(projbuf, FSS_ALLOC_PROJ);
fss_freebuf(zonebuf, FSS_ALLOC_ZONE);
mutex_exit(&cpu_lock);
pool_unlock();
if (error != 0)
return (set_errno(error));
if (opset != NULL) {
if (copyout(&oldpset, opset, sizeof (psetid_t)) != 0)
return (set_errno(EFAULT));
}
return (0);
}
int
klpd_unreg(int did, idtype_t type, id_t id)
{
door_handle_t dh;
int res = 0;
proc_t *p;
pid_t pid;
projid_t proj;
kproject_t *kpp = NULL;
credklpd_t *ckp;
switch (type) {
case P_PID:
pid = (pid_t)id;
break;
case P_PROJID:
proj = (projid_t)id;
kpp = project_hold_by_id(proj, crgetzone(CRED()),
PROJECT_HOLD_FIND);
if (kpp == NULL)
return (set_errno(ESRCH));
break;
default:
return (set_errno(ENOTSUP));
}
dh = door_ki_lookup(did);
if (dh == NULL) {
if (kpp != NULL)
project_rele(kpp);
return (set_errno(EINVAL));
}
if (kpp != NULL) {
mutex_enter(&klpd_mutex);
if (kpp->kpj_klpd == NULL)
res = ESRCH;
else
klpd_freelist(&kpp->kpj_klpd);
mutex_exit(&klpd_mutex);
project_rele(kpp);
goto out;
} else if ((int)pid > 0) {
mutex_enter(&pidlock);
p = prfind(pid);
if (p == NULL) {
mutex_exit(&pidlock);
door_ki_rele(dh);
return (set_errno(ESRCH));
}
mutex_enter(&p->p_crlock);
mutex_exit(&pidlock);
} else if (pid == 0) {
p = curproc;
mutex_enter(&p->p_crlock);
} else {
res = klpd_unreg_dh(dh);
goto out;
}
ckp = crgetcrklpd(p->p_cred);
if (ckp != NULL) {
crklpd_setreg(ckp, NULL);
} else {
res = ESRCH;
}
mutex_exit(&p->p_crlock);
out:
door_ki_rele(dh);
if (res != 0)
return (set_errno(res));
return (0);
}
/*
* Register the klpd.
* If the pid_t passed in is positive, update the registration for
* the specific process; that is only possible if the process already
* has a registration on it. This change of registration will affect
* all processes which share common ancestry.
*
* MY_PID (pid 0) can be used to create or change the context for
* the current process, typically done after fork().
*
* A negative value can be used to register a klpd globally.
*
* The per-credential klpd needs to be cleaned up when entering
* a zone or unsetting the flag.
*/
int
klpd_reg(int did, idtype_t type, id_t id, priv_set_t *psetbuf)
{
cred_t *cr = CRED();
door_handle_t dh;
klpd_reg_t *kpd;
priv_set_t pset;
door_info_t di;
credklpd_t *ckp = NULL;
pid_t pid = -1;
projid_t proj = -1;
kproject_t *kpp = NULL;
if (CR_FLAGS(cr) & PRIV_XPOLICY)
return (set_errno(EINVAL));
if (copyin(psetbuf, &pset, sizeof (priv_set_t)))
return (set_errno(EFAULT));
if (!priv_issubset(&pset, &CR_OEPRIV(cr)))
return (set_errno(EPERM));
switch (type) {
case P_PID:
pid = (pid_t)id;
if (pid == P_MYPID)
pid = curproc->p_pid;
if (pid == curproc->p_pid)
ckp = crklpd_alloc();
break;
case P_PROJID:
proj = (projid_t)id;
kpp = project_hold_by_id(proj, crgetzone(cr),
PROJECT_HOLD_FIND);
if (kpp == NULL)
return (set_errno(ESRCH));
break;
default:
return (set_errno(ENOTSUP));
}
/*
* Verify the door passed in; it must be a door and we won't
* allow processes to be called on their own behalf.
*/
dh = door_ki_lookup(did);
if (dh == NULL || door_ki_info(dh, &di) != 0) {
if (ckp != NULL)
crklpd_rele(ckp);
if (kpp != NULL)
project_rele(kpp);
return (set_errno(EBADF));
}
if (type == P_PID && pid == di.di_target) {
if (ckp != NULL)
crklpd_rele(ckp);
ASSERT(kpp == NULL);
return (set_errno(EINVAL));
}
kpd = kmem_zalloc(sizeof (*kpd), KM_SLEEP);
crhold(kpd->klpd_cred = cr);
kpd->klpd_door = dh;
kpd->klpd_door_pid = di.di_target;
kpd->klpd_ref = 1;
kpd->klpd_pset = pset;
if (kpp != NULL) {
mutex_enter(&klpd_mutex);
kpd = klpd_link(kpd, &kpp->kpj_klpd, B_TRUE);
mutex_exit(&klpd_mutex);
if (kpd != NULL)
klpd_rele(kpd);
project_rele(kpp);
} else if ((int)pid < 0) {
/* Global daemon */
mutex_enter(&klpd_mutex);
(void) klpd_link(kpd, &klpd_list, B_FALSE);
mutex_exit(&klpd_mutex);
} else if (pid == curproc->p_pid) {
proc_t *p = curproc;
cred_t *newcr = cralloc();
/* No need to lock, sole reference to ckp */
kpd = klpd_link(kpd, &ckp->crkl_reg, B_TRUE);
if (kpd != NULL)
klpd_rele(kpd);
mutex_enter(&p->p_crlock);
cr = p->p_cred;
crdup_to(cr, newcr);
crsetcrklpd(newcr, ckp);
p->p_cred = newcr; /* Already held for p_cred */
crhold(newcr); /* Hold once for the current thread */
mutex_exit(&p->p_crlock);
crfree(cr); /* One for the p_cred */
crset(p, newcr);
} else {
proc_t *p;
cred_t *pcr;
mutex_enter(&pidlock);
p = prfind(pid);
if (p == NULL || !prochasprocperm(p, curproc, CRED())) {
mutex_exit(&pidlock);
klpd_rele(kpd);
return (set_errno(p == NULL ? ESRCH : EPERM));
}
mutex_enter(&p->p_crlock);
crhold(pcr = p->p_cred);
mutex_exit(&pidlock);
mutex_exit(&p->p_crlock);
/*
* We're going to update the credential's ckp in place;
* this requires that it exists.
*/
ckp = crgetcrklpd(pcr);
if (ckp == NULL) {
crfree(pcr);
klpd_rele(kpd);
return (set_errno(EINVAL));
}
crklpd_setreg(ckp, kpd);
crfree(pcr);
}
return (0);
}
/*
* taskid_t tasksys_settaskid(projid_t projid, uint_t flags);
*
* Overview
* Place the calling process in a new task if sufficiently privileged. If the
* present task is finalized, the process may not create a new task.
*
* Return values
* 0 on success, errno on failure.
*/
static long
tasksys_settaskid(projid_t projid, uint_t flags)
{
proc_t *p = ttoproc(curthread);
kproject_t *oldpj;
kproject_t *kpj;
task_t *tk, *oldtk;
rctl_entity_p_t e;
zone_t *zone;
int rctlfail = 0;
if (secpolicy_tasksys(CRED()) != 0)
return (set_errno(EPERM));
if (projid < 0 || projid > MAXPROJID)
return (set_errno(EINVAL));
if (flags & ~TASK_FINAL)
return (set_errno(EINVAL));
mutex_enter(&pidlock);
if (p->p_task->tk_flags & TASK_FINAL) {
mutex_exit(&pidlock);
return (set_errno(EACCES));
}
mutex_exit(&pidlock);
/*
* Try to stop all other lwps in the process while we're changing
* our project. This way, curthread doesn't need to grab its own
* thread_lock to find its project ID (see curprojid()). If this
* is the /proc agent lwp, we know that the other lwps are already
* held. If we failed to hold all lwps, bail out and return EINTR.
*/
if (curthread != p->p_agenttp && !holdlwps(SHOLDFORK1))
return (set_errno(EINTR));
/*
* Put a hold on our new project and make sure that nobody is
* trying to bind it to a pool while we're joining.
*/
kpj = project_hold_by_id(projid, p->p_zone, PROJECT_HOLD_INSERT);
e.rcep_p.proj = kpj;
e.rcep_t = RCENTITY_PROJECT;
mutex_enter(&p->p_lock);
oldpj = p->p_task->tk_proj;
zone = p->p_zone;
mutex_enter(&zone->zone_nlwps_lock);
mutex_enter(&zone->zone_mem_lock);
if (kpj->kpj_nlwps + p->p_lwpcnt > kpj->kpj_nlwps_ctl)
if (rctl_test_entity(rc_project_nlwps, kpj->kpj_rctls, p, &e,
p->p_lwpcnt, 0) & RCT_DENY)
rctlfail = 1;
if (kpj->kpj_ntasks + 1 > kpj->kpj_ntasks_ctl)
if (rctl_test_entity(rc_project_ntasks, kpj->kpj_rctls, p, &e,
1, 0) & RCT_DENY)
rctlfail = 1;
if (kpj->kpj_data.kpd_locked_mem + p->p_locked_mem >
kpj->kpj_data.kpd_locked_mem_ctl)
if (rctl_test_entity(rc_project_locked_mem, kpj->kpj_rctls, p,
&e, p->p_locked_mem, 0) & RCT_DENY)
rctlfail = 1;
mutex_enter(&(kpj->kpj_data.kpd_crypto_lock));
if (kpj->kpj_data.kpd_crypto_mem + p->p_crypto_mem >
kpj->kpj_data.kpd_crypto_mem_ctl)
if (rctl_test_entity(rc_project_crypto_mem, kpj->kpj_rctls, p,
&e, p->p_crypto_mem, 0) & RCT_DENY)
rctlfail = 1;
if (rctlfail) {
mutex_exit(&(kpj->kpj_data.kpd_crypto_lock));
mutex_exit(&zone->zone_mem_lock);
mutex_exit(&zone->zone_nlwps_lock);
if (curthread != p->p_agenttp)
continuelwps(p);
mutex_exit(&p->p_lock);
return (set_errno(EAGAIN));
}
kpj->kpj_data.kpd_crypto_mem += p->p_crypto_mem;
mutex_exit(&(kpj->kpj_data.kpd_crypto_lock));
kpj->kpj_data.kpd_locked_mem += p->p_locked_mem;
kpj->kpj_nlwps += p->p_lwpcnt;
kpj->kpj_ntasks++;
oldpj->kpj_data.kpd_locked_mem -= p->p_locked_mem;
mutex_enter(&(oldpj->kpj_data.kpd_crypto_lock));
oldpj->kpj_data.kpd_crypto_mem -= p->p_crypto_mem;
mutex_exit(&(oldpj->kpj_data.kpd_crypto_lock));
oldpj->kpj_nlwps -= p->p_lwpcnt;
mutex_exit(&zone->zone_mem_lock);
mutex_exit(&zone->zone_nlwps_lock);
mutex_exit(&p->p_lock);
mutex_enter(&kpj->kpj_poolbind);
tk = task_create(projid, curproc->p_zone);
mutex_enter(&cpu_lock);
/*
* Returns with p_lock held.
*/
oldtk = task_join(tk, flags);
if (curthread != p->p_agenttp)
continuelwps(p);
mutex_exit(&p->p_lock);
mutex_exit(&cpu_lock);
mutex_exit(&kpj->kpj_poolbind);
task_rele(oldtk);
project_rele(kpj);
return (tk->tk_tkid);
}