netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Update gofer dentry permissions only when needed.

Browse Source 
Without this change, we ask the gofer server to update the permissions
whenever the UID, GID or size is updated via SetStat. Consequently, we don not
generate inotify events when the permissions actually change due to SGID bit
getting cleared.

With this change, we will update the permissions only when needed and generate
inotify events.

PiperOrigin-RevId: 366946842
This commit is contained in:
Ayush Ranjan
2021-04-05 23:48:26 -07:00
committed by gVisor bot
parent 56c69fb0e7
commit fb4c700d06
1 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/sentry/fsimpl/gofer/gofer.go
+11 -8
View File
@@ -1104,24 +1104,27 @@ func (d *dentry) setStat(ctx context.Context, creds *auth.Credentials, opts *vfs
defer d.metadataMu.Unlock()
// As with Linux, if the UID, GID, or file size is changing, we have to
// clear permission bits. Note that when set, clearSGID causes
// permissions to be updated, but does not modify stat.Mask, as
// modification would cause an extra inotify flag to be set.
clearSGID := stat.Mask&linux.STATX_UID != 0 && stat.UID != atomic.LoadUint32(&d.uid) ||
stat.Mask&linux.STATX_GID != 0 && stat.GID != atomic.LoadUint32(&d.gid) ||
// clear permission bits. Note that when set, clearSGID may cause
// permissions to be updated.
clearSGID := (stat.Mask&linux.STATX_UID != 0 && stat.UID != atomic.LoadUint32(&d.uid)) ||
(stat.Mask&linux.STATX_GID != 0 && stat.GID != atomic.LoadUint32(&d.gid)) ||
stat.Mask&linux.STATX_SIZE != 0
if clearSGID {
if stat.Mask&linux.STATX_MODE != 0 {
stat.Mode = uint16(vfs.ClearSUIDAndSGID(uint32(stat.Mode)))
} else {
stat.Mode = uint16(vfs.ClearSUIDAndSGID(atomic.LoadUint32(&d.mode)))
oldMode := atomic.LoadUint32(&d.mode)
if updatedMode := vfs.ClearSUIDAndSGID(oldMode); updatedMode != oldMode {
stat.Mode = uint16(updatedMode)
stat.Mask |= linux.STATX_MODE
}
}
}
if !d.isSynthetic() {
if stat.Mask != 0 {
if err := d.file.setAttr(ctx, p9.SetAttrMask{
Permissions: stat.Mask&linux.STATX_MODE != 0 || clearSGID,
Permissions: stat.Mask&linux.STATX_MODE != 0,
UID: stat.Mask&linux.STATX_UID != 0,
GID: stat.Mask&linux.STATX_GID != 0,
Size: stat.Mask&linux.STATX_SIZE != 0,
@@ -1156,7 +1159,7 @@ func (d *dentry) setStat(ctx context.Context, creds *auth.Credentials, opts *vfs
return nil
}
}
if stat.Mask&linux.STATX_MODE != 0 || clearSGID {
if stat.Mask&linux.STATX_MODE != 0 {
atomic.StoreUint32(&d.mode, d.fileType()|uint32(stat.Mode))
}
if stat.Mask&linux.STATX_UID != 0 {