netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Remove host fchmod(2) calls from the sentry.

Browse Source 
fchmod(2) is not part of sentry's seccomp filters. So the sentry
should not be trying to make this syscall. Instead we will error
out gracefully. Violating seccomp filters will kill the entire
sandbox.

There was only one instance in host filesystem (both in VFS1
and VFS2). I am only fixing VFS2, because VFS1 is already
deprecated. I manually checked that all other host syscalls
made by fsimpl/host are allowed by sentry seccomp filters.

PiperOrigin-RevId: 460335687
This commit is contained in:
Ayush Ranjan
2022-07-11 17:16:11 -07:00
committed by gVisor bot
parent 2fe0fe3102
commit dfd9045221
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/fsimpl/host/host.go
+2 -3
View File
@@ -523,9 +523,8 @@ func (i *inode) SetStat(ctx context.Context, fs *vfs.Filesystem, creds *auth.Cre
// We hold i.virtualOwner.mu.
i.virtualOwner.mode = atomicbitops.FromUint32(uint32(opts.Stat.Mode))
} else {
if err := unix.Fchmod(i.hostFD, uint32(s.Mode)); err != nil {
return err
}
log.Warningf("sentry seccomp filters don't allow making fchmod(2) syscall")
return unix.EPERM
}
}
if m&linux.STATX_SIZE != 0 {