netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

cgroupfs: Mkdir should honour file mode.

Browse Source 
PiperOrigin-RevId: 440199111
This commit is contained in:
Rahat Mahmood
2022-04-07 14:22:40 -07:00
committed by gVisor bot
parent 90ef5d0869
commit 9219adb83c
3 changed files with 32 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/fsimpl/cgroupfs/base.go
+2 -2
View File
@@ -163,7 +163,7 @@ type cgroupInode struct {
var _ kernel.CgroupImpl = (*cgroupInode)(nil)
func (fs *filesystem) newCgroupInode(ctx context.Context, creds *auth.Credentials, parent *cgroupInode) kernfs.Inode {
func (fs *filesystem) newCgroupInode(ctx context.Context, creds *auth.Credentials, parent *cgroupInode, mode linux.FileMode) kernfs.Inode {
c := &cgroupInode{
dir: dir{fs: fs},
ts: make(map[*kernel.Task]struct{}),
@@ -190,7 +190,7 @@ func (fs *filesystem) newCgroupInode(ctx context.Context, creds *auth.Credential
}
}
c.dir.InodeAttrs.Init(ctx, creds, linux.UNNAMED_MAJOR, fs.devMinor, fs.NextIno(), linux.ModeDirectory|linux.FileMode(0555))
c.dir.InodeAttrs.Init(ctx, creds, linux.UNNAMED_MAJOR, fs.devMinor, fs.NextIno(), mode)
c.dir.OrderedChildren.Init(kernfs.OrderedChildrenOptions{Writable: true})
c.dir.IncLinks(c.dir.OrderedChildren.Populate(contents))
pkg/sentry/fsimpl/cgroupfs/cgroupfs.go
+9 -6
View File
@@ -78,9 +78,11 @@ import (
const (
// Name is the default filesystem name.
Name = "cgroup"
readonlyFileMode = linux.FileMode(0444)
writableFileMode = linux.FileMode(0644)
Name = "cgroup"
readonlyFileMode = linux.FileMode(0444)
writableFileMode = linux.FileMode(0644)
defaultDirMode = linux.FileMode(0555) | linux.ModeDirectory
defaultMaxCachedDentries = uint64(1000)
)
@@ -297,7 +299,7 @@ func (fsType FilesystemType) GetFilesystem(ctx context.Context, vfsObj *vfs.Virt
fs.kcontrollers = append(fs.kcontrollers, c)
}
root := fs.newCgroupInode(ctx, creds, nil)
root := fs.newCgroupInode(ctx, creds, nil, defaultDirMode)
var rootD kernfs.Dentry
rootD.InitRoot(&fs.Filesystem, root)
fs.root = &rootD
@@ -346,7 +348,7 @@ func (fs *filesystem) prepareInitialCgroup(ctx context.Context, vfsObj *vfs.Virt
// Have initial cgroup target, create the tree.
cgDir := fs.root.Inode().(*cgroupInode)
for pit := initPath.Begin; pit.Ok(); pit = pit.Next() {
cgDirI, err := cgDir.NewDir(ctx, pit.String(), vfs.MkdirOptions{})
cgDirI, err := cgDir.NewDir(ctx, pit.String(), vfs.MkdirOptions{Mode: defaultDirMode})
if err != nil {
return err
}
@@ -452,9 +454,10 @@ func (d *dir) NewDir(ctx context.Context, name string, opts vfs.MkdirOptions) (k
if strings.Contains(name, "\n") {
return nil, linuxerr.EINVAL
}
mode := opts.Mode.Permissions() | linux.ModeDirectory
return d.OrderedChildren.Inserter(name, func() kernfs.Inode {
d.IncLinks(1)
return d.fs.newCgroupInode(ctx, auth.CredentialsFromContext(ctx), d.cgi)
return d.fs.newCgroupInode(ctx, auth.CredentialsFromContext(ctx), d.cgi, mode)
})
}
test/syscalls/linux/cgroup.cc
+21 -1
View File
@@ -457,7 +457,8 @@ TEST(Cgroup, DirSetStat) {
Cgroup child = ASSERT_NO_ERRNO_AND_VALUE(c.CreateChild("child"));
const struct stat child_before =
ASSERT_NO_ERRNO_AND_VALUE(Stat(child.Path()));
EXPECT_THAT(child_before.st_mode, PermissionIs(0555)); // Default.
// Mkdir passes 0755 by default.
EXPECT_THAT(child_before.st_mode, PermissionIs(0755));
ASSERT_NO_ERRNO(Chmod(child.Path(), 0757));
const struct stat child_after = ASSERT_NO_ERRNO_AND_VALUE(Stat(child.Path()));
@@ -468,6 +469,25 @@ TEST(Cgroup, DirSetStat) {
EXPECT_THAT(parent_after.st_mode, PermissionIs(0755));
}
TEST(Cgroup, MkdirWithPermissions) {
SKIP_IF(!CgroupsAvailable());
Mounter m(ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateDir()));
Cgroup c = ASSERT_NO_ERRNO_AND_VALUE(m.MountCgroupfs(""));
std::string child1_path = JoinPath(c.Path(), "child1");
std::string child2_path = JoinPath(c.Path(), "child2");
ASSERT_NO_ERRNO(Mkdir(child1_path, 0444));
const struct stat s1 = ASSERT_NO_ERRNO_AND_VALUE(Stat(child1_path));
EXPECT_THAT(s1.st_mode, PermissionIs(0444));
EXPECT_TRUE(S_ISDIR(s1.st_mode));
ASSERT_NO_ERRNO(Mkdir(child2_path, 0));
const struct stat s2 = ASSERT_NO_ERRNO_AND_VALUE(Stat(child2_path));
EXPECT_THAT(s2.st_mode, PermissionIs(0000));
EXPECT_TRUE(S_ISDIR(s2.st_mode));
}
TEST(MemoryCgroup, MemoryUsageInBytes) {
SKIP_IF(!CgroupsAvailable());