From 0c99e86f01153f0db6a6d3b571171d86aeda825d Mon Sep 17 00:00:00 2001 From: Jonathon Belotti Date: Thu, 9 Nov 2023 04:02:09 +0000 Subject: [PATCH] provide (read only) /proc/sys/kernel/overflowuid and overflowgid --- pkg/sentry/fsimpl/proc/tasks_sys.go | 2 ++ pkg/sentry/kernel/auth/id.go | 4 ++-- test/syscalls/linux/proc.cc | 14 ++++++++++++++ 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/pkg/sentry/fsimpl/proc/tasks_sys.go b/pkg/sentry/fsimpl/proc/tasks_sys.go index dd57fdfdb..7448116e9 100644 --- a/pkg/sentry/fsimpl/proc/tasks_sys.go +++ b/pkg/sentry/fsimpl/proc/tasks_sys.go @@ -47,6 +47,8 @@ func (fs *filesystem) newSysDir(ctx context.Context, root *auth.Credentials, k * "kernel": fs.newStaticDir(ctx, root, map[string]kernfs.Inode{ "cap_last_cap": fs.newInode(ctx, root, 0444, newStaticFile(fmt.Sprintf("%d\n", linux.CAP_LAST_CAP))), "hostname": fs.newInode(ctx, root, 0444, &hostnameData{}), + "overflowgid": fs.newInode(ctx, root, 0444, newStaticFile(fmt.Sprintf("%d\n", auth.OverflowGID))), + "overflowuid": fs.newInode(ctx, root, 0444, newStaticFile(fmt.Sprintf("%d\n", auth.OverflowUID))), "sem": fs.newInode(ctx, root, 0444, newStaticFile(fmt.Sprintf("%d\t%d\t%d\t%d\n", linux.SEMMSL, linux.SEMMNS, linux.SEMOPM, linux.SEMMNI))), "shmall": fs.newInode(ctx, root, 0444, ipcData(linux.SHMALL)), "shmmax": fs.newInode(ctx, root, 0444, ipcData(linux.SHMMAX)), diff --git a/pkg/sentry/kernel/auth/id.go b/pkg/sentry/kernel/auth/id.go index 6551d184b..cf66e26e5 100644 --- a/pkg/sentry/kernel/auth/id.go +++ b/pkg/sentry/kernel/auth/id.go @@ -53,8 +53,8 @@ const ( // OverflowUID is the default value of /proc/sys/kernel/overflowuid. The // "overflow UID" is usually [1] used when translating a user ID between - // namespaces fails because the ID is not mapped. (We don't implement this - // file, so the overflow UID is constant.) + // namespaces fails because the ID is not mapped. (We implement this + // file as read-only, so the overflow UID is constant.) // // [1] "There is one notable case where unmapped user and group IDs are not // converted to the corresponding overflow ID value. When viewing a uid_map diff --git a/test/syscalls/linux/proc.cc b/test/syscalls/linux/proc.cc index a34d188f2..8b60d9fc8 100644 --- a/test/syscalls/linux/proc.cc +++ b/test/syscalls/linux/proc.cc @@ -2921,6 +2921,20 @@ TEST(ProcFilesystems, ReadCapLastCap) { EXPECT_TRUE(lastCap > 32 && lastCap < 64); } +TEST(ProcFilesystems, OverflowID) { + std::string overflowGidStr = + ASSERT_NO_ERRNO_AND_VALUE(GetContents("/proc/sys/kernel/overflowgid")); + std::string overflowUidStr = + ASSERT_NO_ERRNO_AND_VALUE(GetContents("/proc/sys/kernel/overflowuid")); + uint64_t overflowGid, overflowUid; + ASSERT_TRUE(absl::SimpleAtoi(overflowGidStr, &overflowGid)); + ASSERT_TRUE(absl::SimpleAtoi(overflowUidStr, &overflowUid)); + + const uint64_t defaultOverflowID = 65534; + EXPECT_EQ(overflowGid, defaultOverflowID); + EXPECT_EQ(overflowUid, defaultOverflowID); +} + } // namespace } // namespace testing } // namespace gvisor