netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Use fchmodat(2) to change mode for bound sockets in lisafs gofer.

Browse Source 
PiperOrigin-RevId: 476642321
This commit is contained in:
Ayush Ranjan
2022-09-24 17:29:17 -07:00
committed by gVisor bot
parent 0ec88b7572
commit f841b2511e
2 changed files with 22 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/fsgofer/filter/config.go
+1
View File
@@ -53,6 +53,7 @@ var allowedSyscalls = seccomp.SyscallRules{
},
},
unix.SYS_FCHMOD: {},
unix.SYS_FCHMODAT: {},
unix.SYS_FCHOWNAT: {},
unix.SYS_FCNTL: []seccomp.Rule{
{
runsc/fsgofer/lisafs.go
+21 -4
View File
@@ -208,10 +208,27 @@ func (fd *controlFDLisa) Stat() (linux.Statx, error) {
// SetStat implements lisafs.ControlFDImpl.SetStat.
func (fd *controlFDLisa) SetStat(stat lisafs.SetStatReq) (failureMask uint32, failureErr error) {
if stat.Mask&unix.STATX_MODE != 0 {
if err := unix.Fchmod(fd.hostFD, stat.Mode&^unix.S_IFMT); err != nil {
log.Warningf("SetStat fchmod failed %q, err: %v", fd.Node().FilePath(), err)
failureMask |= unix.STATX_MODE
failureErr = err
if fd.IsSocket() {
// fchmod(2) on socket files created via bind(2) fails. We need to
// fchmodat(2) it from its parent.
sockPath := fd.Node().FilePath()
parent, err := unix.Open(path.Dir(sockPath), openFlags|unix.O_PATH, 0)
if err == nil {
// Note that AT_SYMLINK_NOFOLLOW flag is not currently supported.
err = unix.Fchmodat(parent, path.Base(sockPath), stat.Mode&^unix.S_IFMT, 0 /* flags */)
unix.Close(parent)
}
if err != nil {
log.Warningf("SetStat fchmod failed on socket %q, err: %v", sockPath, err)
failureMask |= unix.STATX_MODE
failureErr = err
}
} else {
if err := unix.Fchmod(fd.hostFD, stat.Mode&^unix.S_IFMT); err != nil {
log.Warningf("SetStat fchmod failed %q, err: %v", fd.Node().FilePath(), err)
failureMask |= unix.STATX_MODE
failureErr = err
}
}
}