From e8ccc27cdf4beeaa7ae3860b85d3d839b78d1834 Mon Sep 17 00:00:00 2001
From: gVisor bot <gvisor-bot@google.com>
Date: Wed, 5 Jun 2024 16:03:10 -0700
Subject: [PATCH] Internal change.

PiperOrigin-RevId: 640679645
---
 pkg/sentry/fsimpl/user/user.go      | 13 +++++++------
 pkg/sentry/fsimpl/user/user_test.go | 21 +++++++++++++++++++++
 2 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/pkg/sentry/fsimpl/user/user.go b/pkg/sentry/fsimpl/user/user.go
index 809abae0e..fcfb07aef 100644
--- a/pkg/sentry/fsimpl/user/user.go
+++ b/pkg/sentry/fsimpl/user/user.go
@@ -176,7 +176,7 @@ func findUIDGIDInPasswd(passwd io.Reader, user string) (auth.KUID, auth.KGID, er
 	//	- optional encrypted password
 	//	- numerical user ID
 	//	- numerical group ID
-	//	- user name or comment field
+	//	- Gecos field
 	//	- user home directory
 	//	- optional user command interpreter
 	const (
@@ -185,6 +185,7 @@ func findUIDGIDInPasswd(passwd io.Reader, user string) (auth.KUID, auth.KGID, er
 		passwdIdx = 1
 		uidIdx    = 2
 		gidIdx    = 3
+		gecosIdx  = 4
 		shellIdx  = 6
 	)
 	usergroup := strings.SplitN(user, ":", 2)
@@ -204,24 +205,24 @@ func findUIDGIDInPasswd(passwd io.Reader, user string) (auth.KUID, auth.KGID, er
 		}
 
 		line := strings.TrimSpace(s.Text())
-		if line == "" {
+		if line == "" || strings.HasPrefix(line, "#") {
 			continue
 		}
 
 		parts := strings.Split(line, ":")
 		if len(parts) != numFields {
 			// Return error if the format is invalid.
-			return defaultUID, defaultGID, fmt.Errorf("invalid line found in /etc/passwd")
+			return defaultUID, defaultGID, fmt.Errorf("invalid line found in /etc/passwd, there should be 7 fields but found %v", len(parts))
 		}
 		for i := 0; i < numFields; i++ {
-			// The password and user command interpreter fields are
+			// The password, GECOS and user command interpreter fields are
 			// optional, no need to check if they are empty.
-			if i == passwdIdx || i == shellIdx {
+			if i == passwdIdx || i == shellIdx || i == gecosIdx {
 				continue
 			}
 			if parts[i] == "" {
 				// Return error if the format is invalid.
-				return defaultUID, defaultGID, fmt.Errorf("invalid line found in /etc/passwd")
+				return defaultUID, defaultGID, fmt.Errorf("invalid line found in /etc/passwd, field[%v] is empty", i)
 			}
 		}
 
diff --git a/pkg/sentry/fsimpl/user/user_test.go b/pkg/sentry/fsimpl/user/user_test.go
index bb3f8fc93..68e3f1843 100644
--- a/pkg/sentry/fsimpl/user/user_test.go
+++ b/pkg/sentry/fsimpl/user/user_test.go
@@ -289,6 +289,27 @@ func TestGetExecUIDGIDFromUser(t *testing.T) {
 			expectedUID:    65534,
 			expectedGID:    65534,
 		},
+		"success_with_comments": {
+			user:           "user0",
+			passwdContents: "#This is a comment\nuser0::1000:1111:&:/home/user0:/bin/sh\nuser2::1002:1112:&:/home/user2:/bin/sh\nuser3:&:1003:1113::/home/user3:/bin/sh",
+			passwdMode:     linux.S_IFREG | 0666,
+			expectedUID:    1000,
+			expectedGID:    1111,
+		},
+		"success_with_comments_mid_file": {
+			user:           "user0",
+			passwdContents: "user0::1000:1111:&:/home/user0:/bin/sh\nuser2::1002:1112:&:/home/user2:/bin/sh\n#This is a comment\n\nuser3:&:1003:1113::/home/user3:/bin/sh",
+			passwdMode:     linux.S_IFREG | 0666,
+			expectedUID:    1000,
+			expectedGID:    1111,
+		},
+		"success_empty_gecos": {
+			user:           "user0",
+			passwdContents: "user0::1000:1111::/home/user0:/bin/sh\nuser2::1002:1112::/home/user2:/bin/sh\nuser3::1003:1113::/home/user3:/bin/sh",
+			passwdMode:     linux.S_IFREG | 0666,
+			expectedUID:    1000,
+			expectedGID:    1111,
+		},
 	}
 
 	for name, tc := range tests {