Enforce --host-fifo flag in directfs.

The flag is only enforced in lisafs gofer as of now.
This change plumbs a gofer client flag which disallowing opening FIFO from the
host filesystem.

PiperOrigin-RevId: 548193558

pkg/sentry/fsimpl/gofer/filesystem.go

@@ -1117,6 +1117,9 @@ func (d *dentry) open(ctx context.Context, rp *vfs.ResolvingPath, opts *vfs.Open
 		if d.isSynthetic() {
 			return d.pipe.Open(ctx, mnt, &d.vfsd, opts.Flags, &d.locks)
 		}
+		if d.fs.opts.disableFifoOpen {
+			return nil, linuxerr.EPERM
+		}
 	}
 
 	if vfd == nil {
@@ -1743,6 +1746,9 @@ func (fs *filesystem) MountOptions() string {
 	if fs.opts.regularFilesUseSpecialFileFD {
 		optsKV = append(optsKV, mopt{moptDisableFileHandleSharing, nil})
 	}
+	if fs.opts.disableFifoOpen {
+		optsKV = append(optsKV, mopt{moptDisableFifoOpen, nil})
+	}
 	if fs.opts.forcePageCache {
 		optsKV = append(optsKV, mopt{moptForcePageCache, nil})
 	}

pkg/sentry/fsimpl/gofer/gofer.go

@@ -84,6 +84,7 @@ const (
 	moptLimitHostFDTranslation   = "limit_host_fd_translation"
 	moptOverlayfsStaleRead       = "overlayfs_stale_read"
 	moptDisableFileHandleSharing = "disable_file_handle_sharing"
+	moptDisableFifoOpen          = "disable_fifo_open"
 
 	// Directfs options.
 	moptDirectfs = "directfs"
@@ -276,6 +277,10 @@ type filesystemOptions struct {
 	// supported with overlayfsStaleRead for now.
 	regularFilesUseSpecialFileFD bool
 
+	// If disableFifoOpen is true, application attempts to open(2) a host FIFO
+	// are disallowed.
+	disableFifoOpen bool
+
 	// directfs holds options for directfs mode.
 	directfs directfsOpts
 }
@@ -460,6 +465,10 @@ func (fstype FilesystemType) GetFilesystem(ctx context.Context, vfsObj *vfs.Virt
 		delete(mopts, moptDisableFileHandleSharing)
 		fsopts.regularFilesUseSpecialFileFD = true
 	}
+	if _, ok := mopts[moptDisableFifoOpen]; ok {
+		delete(mopts, moptDisableFifoOpen)
+		fsopts.disableFifoOpen = true
+	}
 	if _, ok := mopts[moptForcePageCache]; ok {
 		delete(mopts, moptForcePageCache)
 		fsopts.forcePageCache = true

runsc/boot/vfs.go

@@ -311,6 +311,9 @@ func goferMountData(fd int, fa config.FileAccessType, conf *config.Config) []str
 	if conf.DirectFS {
 		opts = append(opts, "directfs")
 	}
+	if !conf.HostFifo.AllowOpen() {
+		opts = append(opts, "disable_fifo_open")
+	}
 	return opts
 }