Thus far we were silently ignoring this flag.
While writing the syscall test for this change I realized that we were
using the async-signal-unsafe `FileDescriptor.reset()` (It's unsafe because
it eventually calls `getenv()`) and `exit()`
in various `fork()` contexts, so I fixed the affected syscall tests.
PiperOrigin-RevId: 925064507
In execveat, when dirfd is not AT_FDCWD and pathname is not absolute, the
pathname is now constructed using /dev/fd/. Earlier, we were using MappedName()
which could return paths with " (deleted)" suffix for deleted files, making
them inaccessible from filesystem traversal.
This is consistent with that Linux does, see fs/exec.c:alloc_bprm().
Suggested-by: @dean-deng
Fixes#1090
PiperOrigin-RevId: 850502410
There is already some support for privileged executables before this change:
file capabilities were taken into account when creating new processes inside
the sandbox from external instigation (but not during execve(2)). set-user-id
and set-group-id bits were never taken into account, and the Sentry behaved
as if NO_NEW_PRIVS is always true. After this change, execve(2) and the
external Exec entry point both take the set-user(group)-id bits and file
capabilities into account.
Because NO_NEW_PRIVS can no longer be assumed to be always set, a couple of
extra checks to prevent privilege elevation during execve(2) are needed:
the presence of a ptracer and the use of a shared fsContext. Moreover,
execve had to be serialized with seccomp(2) when it is syncing filters to
all threads in a group. Serializing execve with PTRACE_ATTACH and seccomp
required some Task runState gymnastics.
Task dumpability is reset when privilege elevation takes place and privilege
elevation is denied for binaries living on nosuid mounts. To fix an old bug
where some aux vectors were populated using data from the old pre-execve
creds, the computation of the (file-privilege-augmented) creds during execve
now takes place before the stack for the new program is set up.
gvisor users who thus far have exec'd into the sandbox with UID as (sandbox)
root will lose the caps an all-powerful namespace root'd have if: 1) the binary
is a suid/guid binary 2) the owner of the binary is host root and there is
no mapping for host root in the host user namespace of the sandbox. To avoid
this surprise, the suid/sgid bits are ignored by default. Users can opt-in
via the --allow-suid flag.
One result of this change is that sudo now works inside the sandbox.
PiperOrigin-RevId: 794414101
memFD is linked with the Task instead of MemoryManager. At the time of
read/write, it uses Task's MemoryManager. However, it should have used Task's
MemoryManager from the time when we do open. To fix it, we store the
MemoryManager at the time of opening /proc/self/mem.
Added the reproducer as a test.
PiperOrigin-RevId: 791327639
From setpgid manpage,
EACCES - An attempt was made to change the process group ID of one
of the children of the calling process and the child had
already performed an execve(2) (setpgid(), setpgrp()).
This CL makes gVisor implement this rule and updates the exec test
suite accordingly.
TESTED: http://sponge2/7f364e8a-4f82-463e-ba62-79234c4d054d
PiperOrigin-RevId: 727095560
Later kernels add empty arguments to argv, throwing off return values for the
exec_basic_workload.cc binary. This is result of a bug introduced by
ccbb18b67323b "exec/binfmt_script: Don't modify bprm->buf and then return -
ENOEXEC". Before this change, an empty interpreter string was reported if the
first non-space/non-tab character after "#!" was '\0' (end of file, previously-
overwritten trailing space or tab, or previously-overwritten first newline).
After this change, an empty interpreter string is reported if all characters
after "#!" are spaces or tabs, or the first non-space non-tab character is at
i_end, which is the position of the first newline after "#!". However, if
there is no newline after "#!" (as in ExecTest.InterpreterScriptNoPath),
then i_end = buf_end (= bprm->buf + sizeof(bprm->buf) - 1, the last possible
byte in the buffer) and neither condition holds.
Change white space for script inputs to take into account the above bug.
Co-authored-by: Andrei Vagin <[email protected]>
PiperOrigin-RevId: 378997171
- Only use MAXSYMLINKS/2+1 symlinks for each of the interpreter and script
paths in SymlinkLimitRefreshedForInterpreter to tolerate cases where the
original paths (/tmp, /bin, or /bin/echo) themselves contain symlinks.
- Ensure that UnshareFiles performs execve immediately after clone(CLONE_VFORK)
(no heap allocation for ExecveArray/RunfilesPath).
- Use lstat() rather than stat() for the existence check in fs_util's Exists;
the latter will fail if the symlink target does not exist, even if the
symlink does.
PiperOrigin-RevId: 320110156
The current task can share its fdtable with a few other tasks,
but after exec, this should be a completely separate process.
PiperOrigin-RevId: 314999565
Test now no longer deletes files incorrectly, due to a fix in fs utils
used by TempPath (github.com/google/gvisor/pull/1368).
Fixes#1366
PiperOrigin-RevId: 284814605
When execveat is called on an interpreter script, the symlink count for
resolving the script path should be separate from the count for resolving the
the corresponding interpreter. An ELOOP error should not occur if we do not hit
the symlink limit along any individual path, even if the total number of
symlinks encountered exceeds the limit.
Closes#574
PiperOrigin-RevId: 277358474
When an interpreter script is opened with O_CLOEXEC and the resulting fd is
passed into execveat, an ENOENT error should occur (the script would otherwise
be inaccessible to the interpreter). This matches the actual behavior of
Linux's execveat.
PiperOrigin-RevId: 277306680
Based on the guidelines at
https://opensource.google.com/docs/releasing/authors/.
1. $ rg -l "Google LLC" | xargs sed -i 's/Google LLC.*/The gVisor Authors./'
2. Manual fixup of "Google Inc" references.
3. Add AUTHORS file. Authors may request to be added to this file.
4. Point netstack AUTHORS to gVisor AUTHORS. Drop CONTRIBUTORS.
Fixes#209
PiperOrigin-RevId: 245823212
Change-Id: I64530b24ad021a7d683137459cafc510f5ee1de9
* open_create_test_runsc_ptrace_shared doesn't expect the write access to /
* exec_test_runsc_ptrace_shared could not find /usr/share/zoneinfo/
* clock_gettime_test_runsc_ptrace_shared didn't expect that
a thread cpu time can be zero.
* affinity_test_runsc_ptrace_shared expected minimum 3 cpus
PiperOrigin-RevId: 237509429
Change-Id: I477937e5d2cdf3f8720836bfa972abd35d8220a3
