netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Enforce file size rlimits in VFS2

Browse Source 
Updates #1035

PiperOrigin-RevId: 301255357
This commit is contained in:
Fabricio Voznika
2020-03-16 16:00:49 -07:00
committed by gVisor bot
parent 0f60799a4f
commit 2a6c4369be
23 changed files with 103 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/fsimpl/tmpfs/filesystem.go
+1 -1
View File
@@ -575,7 +575,7 @@ func (fs *filesystem) SetStatAt(ctx context.Context, rp *vfs.ResolvingPath, opts
if err != nil {
return err
}
return d.inode.setStat(rp.Credentials(), &opts.Stat)
return d.inode.setStat(ctx, rp.Credentials(), &opts.Stat)
}
// StatAt implements vfs.FilesystemImpl.StatAt.
pkg/sentry/fsimpl/tmpfs/regular_file.go
+9 -2
View File
@@ -308,11 +308,18 @@ func (fd *regularFileFD) PWrite(ctx context.Context, src usermem.IOSequence, off
return 0, nil
}
f := fd.inode().impl.(*regularFile)
end := offset + srclen
if end < offset {
if end := offset + srclen; end < offset {
// Overflow.
return 0, syserror.EFBIG
}
var err error
srclen, err = vfs.CheckLimit(ctx, offset, srclen)
if err != nil {
return 0, err
}
src = src.TakeFirst64(srclen)
f.inode.mu.Lock()
rw := getRegularFileReadWriter(f, offset)
n, err := src.CopyInTo(ctx, rw)
pkg/sentry/fsimpl/tmpfs/tmpfs.go
+3 -3
View File
@@ -299,14 +299,14 @@ func (i *inode) statTo(stat *linux.Statx) {
}
}
func (i *inode) setStat(creds *auth.Credentials, stat *linux.Statx) error {
func (i *inode) setStat(ctx context.Context, creds *auth.Credentials, stat *linux.Statx) error {
if stat.Mask == 0 {
return nil
}
if stat.Mask&^(linux.STATX_MODE|linux.STATX_UID|linux.STATX_GID|linux.STATX_ATIME|linux.STATX_MTIME|linux.STATX_CTIME|linux.STATX_SIZE) != 0 {
return syserror.EPERM
}
if err := vfs.CheckSetStat(creds, stat, uint16(atomic.LoadUint32(&i.mode))&^linux.S_IFMT, auth.KUID(atomic.LoadUint32(&i.uid)), auth.KGID(atomic.LoadUint32(&i.gid))); err != nil {
if err := vfs.CheckSetStat(ctx, creds, stat, uint16(atomic.LoadUint32(&i.mode))&^linux.S_IFMT, auth.KUID(atomic.LoadUint32(&i.uid)), auth.KGID(atomic.LoadUint32(&i.gid))); err != nil {
return err
}
i.mu.Lock()
@@ -464,5 +464,5 @@ func (fd *fileDescription) Stat(ctx context.Context, opts vfs.StatOptions) (linu
// SetStat implements vfs.FileDescriptionImpl.SetStat.
func (fd *fileDescription) SetStat(ctx context.Context, opts vfs.SetStatOptions) error {
creds := auth.CredentialsFromContext(ctx)
return fd.inode().setStat(creds, &opts.Stat)
return fd.inode().setStat(ctx, creds, &opts.Stat)
}