netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

tmpfs: Allow xattrs in the trusted namespace if creds has CAP_SYS_ADMIN.

Browse Source 
This is needed to support the overlay opaque attribute.

PiperOrigin-RevId: 328552985
This commit is contained in:
Nicolas Lacasse
2020-08-26 10:05:34 -07:00
committed by gVisor bot
parent ebf5293374
commit 83a8b309e9
7 changed files with 147 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/fsimpl/tmpfs/tmpfs.go
+42 -26
View File
@@ -631,49 +631,65 @@ func (i *inode) listxattr(size uint64) ([]string, error) {
}
func (i *inode) getxattr(creds *auth.Credentials, opts *vfs.GetxattrOptions) (string, error) {
if err := i.checkPermissions(creds, vfs.MayRead); err != nil {
if err := i.checkXattrPermissions(creds, opts.Name, vfs.MayRead); err != nil {
return "", err
}
if !strings.HasPrefix(opts.Name, linux.XATTR_USER_PREFIX) {
return "", syserror.EOPNOTSUPP
}
if !i.userXattrSupported() {
return "", syserror.ENODATA
}
return i.xattrs.Getxattr(opts)
}
func (i *inode) setxattr(creds *auth.Credentials, opts *vfs.SetxattrOptions) error {
if err := i.checkPermissions(creds, vfs.MayWrite); err != nil {
if err := i.checkXattrPermissions(creds, opts.Name, vfs.MayWrite); err != nil {
return err
}
if !strings.HasPrefix(opts.Name, linux.XATTR_USER_PREFIX) {
return syserror.EOPNOTSUPP
}
if !i.userXattrSupported() {
return syserror.EPERM
}
return i.xattrs.Setxattr(opts)
}
func (i *inode) removexattr(creds *auth.Credentials, name string) error {
if err := i.checkPermissions(creds, vfs.MayWrite); err != nil {
if err := i.checkXattrPermissions(creds, name, vfs.MayWrite); err != nil {
return err
}
if !strings.HasPrefix(name, linux.XATTR_USER_PREFIX) {
return syserror.EOPNOTSUPP
}
if !i.userXattrSupported() {
return syserror.EPERM
}
return i.xattrs.Removexattr(name)
}
// Extended attributes in the user.* namespace are only supported for regular
// files and directories.
func (i *inode) userXattrSupported() bool {
filetype := linux.S_IFMT & atomic.LoadUint32(&i.mode)
return filetype == linux.S_IFREG || filetype == linux.S_IFDIR
func (i *inode) checkXattrPermissions(creds *auth.Credentials, name string, ats vfs.AccessTypes) error {
switch {
case ats&vfs.MayRead == vfs.MayRead:
if err := i.checkPermissions(creds, vfs.MayRead); err != nil {
return err
}
case ats&vfs.MayWrite == vfs.MayWrite:
if err := i.checkPermissions(creds, vfs.MayWrite); err != nil {
return err
}
default:
panic(fmt.Sprintf("checkXattrPermissions called with impossible AccessTypes: %v", ats))
}
switch {
case strings.HasPrefix(name, linux.XATTR_TRUSTED_PREFIX):
// The trusted.* namespace can only be accessed by privileged
// users.
if creds.HasCapability(linux.CAP_SYS_ADMIN) {
return nil
}
if ats&vfs.MayWrite == vfs.MayWrite {
return syserror.EPERM
}
return syserror.ENODATA
case strings.HasPrefix(name, linux.XATTR_USER_PREFIX):
// Extended attributes in the user.* namespace are only
// supported for regular files and directories.
filetype := linux.S_IFMT & atomic.LoadUint32(&i.mode)
if filetype == linux.S_IFREG || filetype == linux.S_IFDIR {
return nil
}
if ats&vfs.MayWrite == vfs.MayWrite {
return syserror.EPERM
}
return syserror.ENODATA
}
return syserror.EOPNOTSUPP
}
// fileDescription is embedded by tmpfs implementations of