From 6fae8b623f19c1aebbecbc632fbad62047bb1bb6 Mon Sep 17 00:00:00 2001
From: Nicolas Lacasse <nlacasse@google.com>
Date: Fri, 10 May 2024 15:31:00 -0700
Subject: [PATCH] Log warnings when runsc tries to open/connect to host fifos
 or UDS

...but is not configured to do so.

The warning says which flag to turn on to make this work.

PiperOrigin-RevId: 632620127
---
 pkg/sentry/fsimpl/gofer/filesystem.go |  7 +++++++
 runsc/fsgofer/lisafs.go               | 21 +++++++++++++++++++++
 test/runner/main.go                   |  5 +++++
 3 files changed, 33 insertions(+)

diff --git a/pkg/sentry/fsimpl/gofer/filesystem.go b/pkg/sentry/fsimpl/gofer/filesystem.go
index 9857a433e..ca31da957 100644
--- a/pkg/sentry/fsimpl/gofer/filesystem.go
+++ b/pkg/sentry/fsimpl/gofer/filesystem.go
@@ -26,6 +26,7 @@ import (
 	"gvisor.dev/gvisor/pkg/context"
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/fspath"
+	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/refs"
 	"gvisor.dev/gvisor/pkg/sentry/fsimpl/host"
 	"gvisor.dev/gvisor/pkg/sentry/fsmetric"
@@ -1048,6 +1049,9 @@ afterTrailingSymlink:
 	return child.open(ctx, rp, &opts)
 }
 
+// Used to log a rejected fifo open, once.
+var logRejectedFifoOpenOnce sync.Once
+
 // Preconditions: The caller must hold no locks (since opening pipes may block
 // indefinitely).
 func (d *dentry) open(ctx context.Context, rp *vfs.ResolvingPath, opts *vfs.OpenOptions) (*vfs.FileDescription, error) {
@@ -1132,6 +1136,9 @@ func (d *dentry) open(ctx context.Context, rp *vfs.ResolvingPath, opts *vfs.Open
 			return d.pipe.Open(ctx, mnt, &d.vfsd, opts.Flags, &d.locks)
 		}
 		if d.fs.opts.disableFifoOpen {
+			logRejectedFifoOpenOnce.Do(func() {
+				log.Warningf("Rejecting attempt to open fifo/pipe from host filesystem: %q. If you want to allow this, set flag --host-fifo=open", d.name)
+			})
 			return nil, linuxerr.EPERM
 		}
 	}
diff --git a/runsc/fsgofer/lisafs.go b/runsc/fsgofer/lisafs.go
index 9bb3a97e9..d7ada02fb 100644
--- a/runsc/fsgofer/lisafs.go
+++ b/runsc/fsgofer/lisafs.go
@@ -24,6 +24,7 @@ import (
 	"path"
 	"path/filepath"
 	"strconv"
+	"sync"
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
@@ -478,6 +479,14 @@ func (fd *controlFDLisa) WalkStat(path lisafs.StringArray, recordStat func(linux
 	return nil
 }
 
+// Used to log rejected fifo/uds operations, one time each.
+var (
+	logRejectedFifoOpenOnce   sync.Once
+	logRejectedUdsOpenOnce    sync.Once
+	logRejectedUdsCreateOnce  sync.Once
+	logRejectedUdsConnectOnce sync.Once
+)
+
 // Open implements lisafs.ControlFDImpl.Open.
 func (fd *controlFDLisa) Open(flags uint32) (*lisafs.OpenFD, int, error) {
 	ftype := fd.FileType()
@@ -485,10 +494,16 @@ func (fd *controlFDLisa) Open(flags uint32) (*lisafs.OpenFD, int, error) {
 	switch ftype {
 	case unix.S_IFIFO:
 		if !server.config.HostFifo.AllowOpen() {
+			logRejectedFifoOpenOnce.Do(func() {
+				log.Warningf("Rejecting attempt to open fifo/pipe from host filesystem: %q. If you want to allow this, set flag --host-fifo=open", fd.ControlFD.Node().FilePath())
+			})
 			return nil, -1, unix.EPERM
 		}
 	case unix.S_IFSOCK:
 		if !server.config.HostUDS.AllowOpen() {
+			logRejectedUdsOpenOnce.Do(func() {
+				log.Warningf("Rejecting attempt to open unix domain socket from host filesystem. If you want to allow this, set flag --host-uds=open", fd.ControlFD.Node().FilePath())
+			})
 			return nil, -1, unix.EPERM
 		}
 	}
@@ -771,6 +786,9 @@ func isSockTypeSupported(sockType uint32) bool {
 // Connect implements lisafs.ControlFDImpl.Connect.
 func (fd *controlFDLisa) Connect(sockType uint32) (int, error) {
 	if !fd.Conn().ServerImpl().(*LisafsServer).config.HostUDS.AllowOpen() {
+		logRejectedUdsConnectOnce.Do(func() {
+			log.Warningf("Rejecting attempt to connect to unix domain socket from host filesystem: %q. If you want to allow this, set flag --host-uds=open", fd.ControlFD.Node().FilePath())
+		})
 		return -1, unix.EPERM
 	}
 
@@ -803,6 +821,9 @@ func (fd *controlFDLisa) Connect(sockType uint32) (int, error) {
 // BindAt implements lisafs.ControlFDImpl.BindAt.
 func (fd *controlFDLisa) BindAt(name string, sockType uint32, mode linux.FileMode, uid lisafs.UID, gid lisafs.GID) (*lisafs.ControlFD, linux.Statx, *lisafs.BoundSocketFD, int, error) {
 	if !fd.Conn().ServerImpl().(*LisafsServer).config.HostUDS.AllowCreate() {
+		logRejectedUdsCreateOnce.Do(func() {
+			log.Warningf("Rejecting attempt to create unix domain socket from host filesystem: %q. If you want to allow this, set flag --host-uds=create", name)
+		})
 		return nil, linux.Statx{}, nil, -1, unix.EPERM
 	}
 
diff --git a/test/runner/main.go b/test/runner/main.go
index 4ead8f65f..e4f458ad0 100644
--- a/test/runner/main.go
+++ b/test/runner/main.go
@@ -652,6 +652,11 @@ func runRunsc(tc *gtest.TestCase, spec *specs.Spec) error {
 				case strings.Contains(line, "Opened a writable executable"):
 				// Expected in some tests, eg. /gvisor/test/syscalls/linux/sysret.cc
 				case strings.Contains(line, "invalid rip for 64 bit mode"):
+				// Expected in some tests that create pipes or sockets.
+				case strings.Contains(line, "Rejecting attempt to open fifo/pipe"):
+				case strings.Contains(line, "Rejecting attempt to open unix domain socket"):
+				case strings.Contains(line, "Rejecting attempt to connect to unix domain socket"):
+				case strings.Contains(line, "Rejecting attempt to create unix domain socket"):
 
 				// Ignore clock frequency adjustment messages.
 				case strings.Contains(line, "adjusted frequency from"):