netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Return integrity failure only if enabled

Browse Source 
If the parent is not enabled in verity stepLocked(), failure to find
the child dentry could just mean an incorrect path.

PiperOrigin-RevId: 367733412
This commit is contained in:
Chong Cai
2021-04-09 17:37:47 -07:00
committed by gVisor bot
parent 7420821a7b
commit ea7faa5057
1 changed files with 23 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/fsimpl/verity/filesystem.go
+23 -22
View File
@@ -553,7 +553,7 @@ func (fs *filesystem) lookupAndVerifyLocked(ctx context.Context, parent *dentry,
}
childVD, err := parent.getLowerAt(ctx, vfsObj, name)
if err == syserror.ENOENT {
if parent.verityEnabled() && err == syserror.ENOENT {
return nil, alertIntegrityViolation(fmt.Sprintf("file %s expected but not found", parentPath+"/"+name))
}
if err != nil {
@@ -565,29 +565,30 @@ func (fs *filesystem) lookupAndVerifyLocked(ctx context.Context, parent *dentry,
defer childVD.DecRef(ctx)
childMerkleVD, err := parent.getLowerAt(ctx, vfsObj, merklePrefix+name)
if err == syserror.ENOENT {
if !fs.allowRuntimeEnable {
return nil, alertIntegrityViolation(fmt.Sprintf("Merkle file for %s expected but not found", parentPath+"/"+name))
}
childMerkleFD, err := vfsObj.OpenAt(ctx, fs.creds, &vfs.PathOperation{
Root: parent.lowerVD,
Start: parent.lowerVD,
Path: fspath.Parse(merklePrefix + name),
}, &vfs.OpenOptions{
Flags: linux.O_RDWR | linux.O_CREAT,
Mode: 0644,
})
if err != nil {
if err != nil {
if err == syserror.ENOENT {
if parent.verityEnabled() {
return nil, alertIntegrityViolation(fmt.Sprintf("Merkle file for %s expected but not found", parentPath+"/"+name))
}
childMerkleFD, err := vfsObj.OpenAt(ctx, fs.creds, &vfs.PathOperation{
Root: parent.lowerVD,
Start: parent.lowerVD,
Path: fspath.Parse(merklePrefix + name),
}, &vfs.OpenOptions{
Flags: linux.O_RDWR | linux.O_CREAT,
Mode: 0644,
})
if err != nil {
return nil, err
}
childMerkleFD.DecRef(ctx)
childMerkleVD, err = parent.getLowerAt(ctx, vfsObj, merklePrefix+name)
if err != nil {
return nil, err
}
} else {
return nil, err
}
childMerkleFD.DecRef(ctx)
childMerkleVD, err = parent.getLowerAt(ctx, vfsObj, merklePrefix+name)
if err != nil {
return nil, err
}
}
if err != nil && err != syserror.ENOENT {
return nil, err
}
// Clear the Merkle tree file if they are to be generated at runtime.