netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Change verity isEnable to be a member of dentry

Browse Source 
PiperOrigin-RevId: 337384146
This commit is contained in:
Chong Cai
2020-10-15 14:35:15 -07:00
committed by gVisor bot
parent 8f70c6ef35
commit f0f7431ea2
2 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/fsimpl/verity/filesystem.go
+5 -5
View File
@@ -377,12 +377,12 @@ func (fs *filesystem) getChildLocked(ctx context.Context, parent *dentry, name s
// enabled, we should verify the child hash here because it may
// be cached before enabled.
if fs.allowRuntimeEnable {
if isEnabled(parent) {
if parent.verityEnabled() {
if _, err := fs.verifyChild(ctx, parent, child); err != nil {
return nil, err
}
}
if isEnabled(child) {
if child.verityEnabled() {
vfsObj := fs.vfsfs.VirtualFilesystem()
mask := uint32(linux.STATX_TYPE | linux.STATX_MODE | linux.STATX_UID | linux.STATX_GID)
stat, err := vfsObj.StatAt(ctx, fs.creds, &vfs.PathOperation{
@@ -553,13 +553,13 @@ func (fs *filesystem) lookupAndVerifyLocked(ctx context.Context, parent *dentry,
// Verify child hash. This should always be performed unless in
// allowRuntimeEnable mode and the parent directory hasn't been enabled
// yet.
if isEnabled(parent) {
if parent.verityEnabled() {
if _, err := fs.verifyChild(ctx, parent, child); err != nil {
child.destroyLocked(ctx)
return nil, err
}
}
if isEnabled(child) {
if child.verityEnabled() {
if err := fs.verifyStat(ctx, child, stat); err != nil {
child.destroyLocked(ctx)
return nil, err
@@ -915,7 +915,7 @@ func (fs *filesystem) StatAt(ctx context.Context, rp *vfs.ResolvingPath, opts vf
if err != nil {
return linux.Statx{}, err
}
if isEnabled(d) {
if d.verityEnabled() {
if err := fs.verifyStat(ctx, d, stat); err != nil {
return linux.Statx{}, err
}
pkg/sentry/fsimpl/verity/verity.go
+10 -10
View File
@@ -148,14 +148,6 @@ func (FilesystemType) Name() string {
return Name
}
// isEnabled checks whether the target is enabled with verity features. It
// should always be true if runtime enable is not allowed. In runtime enable
// mode, it returns true if the target has been enabled with
// ioctl(FS_IOC_ENABLE_VERITY).
func isEnabled(d *dentry) bool {
return !d.fs.allowRuntimeEnable || len(d.hash) != 0
}
// Release implements vfs.FilesystemType.Release.
func (FilesystemType) Release(ctx context.Context) {}
@@ -448,6 +440,14 @@ func (d *dentry) checkPermissions(creds *auth.Credentials, ats vfs.AccessTypes)
return vfs.GenericCheckPermissions(creds, ats, linux.FileMode(atomic.LoadUint32(&d.mode)), auth.KUID(atomic.LoadUint32(&d.uid)), auth.KGID(atomic.LoadUint32(&d.gid)))
}
// verityEnabled checks whether the file is enabled with verity features. It
// should always be true if runtime enable is not allowed. In runtime enable
// mode, it returns true if the target has been enabled with
// ioctl(FS_IOC_ENABLE_VERITY).
func (d *dentry) verityEnabled() bool {
return !d.fs.allowRuntimeEnable || len(d.hash) != 0
}
func (d *dentry) readlink(ctx context.Context) (string, error) {
return d.fs.vfsfs.VirtualFilesystem().ReadlinkAt(ctx, d.fs.creds, &vfs.PathOperation{
Root: d.lowerVD,
@@ -510,7 +510,7 @@ func (fd *fileDescription) Stat(ctx context.Context, opts vfs.StatOptions) (linu
if err != nil {
return linux.Statx{}, err
}
if isEnabled(fd.d) {
if fd.d.verityEnabled() {
if err := fd.d.fs.verifyStat(ctx, fd.d, stat); err != nil {
return linux.Statx{}, err
}
@@ -726,7 +726,7 @@ func (fd *fileDescription) Ioctl(ctx context.Context, uio usermem.IO, args arch.
func (fd *fileDescription) PRead(ctx context.Context, dst usermem.IOSequence, offset int64, opts vfs.ReadOptions) (int64, error) {
// No need to verify if the file is not enabled yet in
// allowRuntimeEnable mode.
if !isEnabled(fd.d) {
if !fd.d.verityEnabled() {
return fd.lowerFD.PRead(ctx, dst, offset, opts)
}