netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Add a new RPC ConnectWithCreds to allow gofer to connect to a unix domain socket with application's credentials

Browse Source
This commit is contained in:
xianzhe-databricks
2025-01-03 17:50:06 +01:00
parent bd0cbf8071
commit c4f686f4e1
12 changed files with 263 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/fsimpl/gofer/dentry_impl.go
+9 -2
View File
@@ -452,11 +452,18 @@ func (d *dentry) allocate(ctx context.Context, mode, offset, length uint64) erro
// - !d.isSynthetic().
// - fs.renameMu is locked.
func (d *dentry) connect(ctx context.Context, sockType linux.SockType) (int, error) {
credentials := auth.CredentialsFromContextOrNil(ctx)
euid := lisafs.NoUID
egid := lisafs.NoGID
if credentials != nil {
euid = lisafs.UID(credentials.EffectiveKUID)
egid = lisafs.GID(credentials.EffectiveKGID)
}
switch dt := d.impl.(type) {
case *lisafsDentry:
return dt.controlFD.Connect(ctx, sockType)
return dt.controlFD.Connect(ctx, sockType, euid, egid)
case *directfsDentry:
return dt.connect(ctx, sockType)
return dt.connect(ctx, sockType, euid, egid)
default:
panic("unknown dentry implementation")
}
pkg/sentry/fsimpl/gofer/directfs_dentry.go
+2 -2
View File
@@ -603,13 +603,13 @@ func (d *directfsDentry) getDirentsLocked(recordDirent func(name string, key ino
}
// Precondition: fs.renameMu is locked.
func (d *directfsDentry) connect(ctx context.Context, sockType linux.SockType) (int, error) {
func (d *directfsDentry) connect(ctx context.Context, sockType linux.SockType, euid lisafs.UID, egid lisafs.GID) (int, error) {
// There are no filesystems mounted in the sandbox process's mount namespace.
// So we can't perform absolute path traversals. So fallback to using lisafs.
if err := d.ensureLisafsControlFD(ctx); err != nil {
return -1, err
}
return d.controlFDLisa.Connect(ctx, sockType)
return d.controlFDLisa.Connect(ctx, sockType, euid, egid)
}
func (d *directfsDentry) readlink() (string, error) {