From 6890e539c7000f54b5e73e8f38687a07d57893b2 Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Tue, 28 Mar 2023 10:46:32 -0700 Subject: [PATCH] systrap: set all arguments of prctl(PR_SET_NO_NEW_PRIVS) The kernel returns EINVAL if any of unused arguments are non-zero. Reported-by: syzbot+4de40c5bc3421bffcf6c@syzkaller.appspotmail.com PiperOrigin-RevId: 520072701 --- pkg/sentry/platform/systrap/subprocess.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/sentry/platform/systrap/subprocess.go b/pkg/sentry/platform/systrap/subprocess.go index 7693b868f..1642fe9dc 100644 --- a/pkg/sentry/platform/systrap/subprocess.go +++ b/pkg/sentry/platform/systrap/subprocess.go @@ -1086,6 +1086,9 @@ func (s *subprocess) createSysmsgThread(tregs *arch.Registers, c *context, ac *a _, err = p.syscallIgnoreInterrupt(&p.initRegs, unix.SYS_PRCTL, arch.SyscallArgument{Value: uintptr(linux.PR_SET_NO_NEW_PRIVS)}, arch.SyscallArgument{Value: uintptr(1)}, + arch.SyscallArgument{Value: uintptr(0)}, + arch.SyscallArgument{Value: uintptr(0)}, + arch.SyscallArgument{Value: uintptr(0)}, arch.SyscallArgument{Value: uintptr(0)}) if err != nil { panic(fmt.Sprintf("prctl(PR_SET_NO_NEW_PRIVS) failed: %v", err))