Guarantee that getParentFD() doesn't follow symlinks

When opening the parent FD, ensures that none of the paths are symlinks.
This is done to prevent possile attacks that changes a path to a symlink
and makes the name resolution redirect to a different path.

This is a defense in depth measure.

PiperOrigin-RevId: 966826882

README.md

@@ -68,7 +68,7 @@ dependencies are wrapped in a build container. It is possible to use
 
 Make sure the following dependencies are installed:
 
-*   Linux 4.14.77+ ([older linux][old-linux])
+*   Linux 5.6+
 *   [Docker version 17.09.0 or greater][docker]
 
 ### Building
@@ -171,6 +171,5 @@ See [Contributing.md](CONTRIBUTING.md).
 [gvisor-dev-list]: https://groups.google.com/forum/#!forum/gvisor-dev
 [linux]: https://en.wikipedia.org/wiki/Linux_kernel_interfaces
 [oci]: https://www.opencontainers.org
-[old-linux]: https://gvisor.dev/docs/user_guide/networking/#gso
 [sandbox]: https://en.wikipedia.org/wiki/Sandbox_(computer_security)
 [bazelisk]: https://github.com/bazelbuild/bazelisk

g3doc/user_guide/install.md

@@ -2,8 +2,7 @@
 
 [TOC]
 
-> Note: gVisor supports x86\_64 and ARM64, and requires Linux 4.14.77+
-> ([older Linux](./networking.md#gso)).
+> Note: gVisor supports x86\_64 and ARM64, and requires Linux 5.6+.
 
 ## Install from an `apt` repository {#apt}
 

runsc/fsgofer/filter/config.go

@@ -147,6 +147,7 @@ var allowedSyscalls = seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{
 	unix.SYS_MUNMAP:    seccomp.MatchAll{},
 	unix.SYS_NANOSLEEP: seccomp.MatchAll{},
 	unix.SYS_OPENAT:    seccomp.MatchAll{},
+	unix.SYS_OPENAT2:   seccomp.MatchAll{},
 	unix.SYS_PPOLL:     seccomp.MatchAll{},
 	unix.SYS_PRCTL: seccomp.PerArg{
 		seccomp.EqualTo(unix.PR_SET_VMA),

runsc/fsgofer/lisafs.go

@@ -276,7 +276,12 @@ func (fd *controlFDLisa) getParentFD() (int, string, error) {
 		log.Warningf("getParentFD() call on the root")
 		return -1, "", unix.EINVAL
 	}
-	parent, err := unix.Open(path.Dir(filePath), openFlags|unix.O_PATH, 0)
+	// As a defense-in-depth measure, do not follow symlinks in the parent's path
+	// to prevent attackers from redirecting the parent to a different location.
+	parent, err := unix.Openat2(unix.AT_FDCWD, path.Dir(filePath), &unix.OpenHow{
+		Flags:   uint64(openFlags | unix.O_PATH),
+		Resolve: unix.RESOLVE_NO_SYMLINKS,
+	})
 	return parent, path.Base(filePath), err
 }
 

website/_includes/required_linux.html

@@ -1,2 +1 @@
-> Note: gVisor supports only x86\_64 and requires Linux 4.14.77+
-> ([older Linux](/docs/user_guide/networking/#gso)).
+> Note: gVisor supports x86\_64 and ARM64, and requires Linux 5.6+.