mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Shailend ChandandgVisor bot
e428bbea51
linkat(AT_EMPTY_PATH) needs to check for CAP_DAC_READ_SEARCH in the userns in which the fd was opened, not the userns of the task running linkat(). To get at that userns, vfs.FileDescription now saves a pointer to the creds at the time of its creation: plumbing these creds in accounts for much of the diff. This is similar to how `struct file` stores creds in `f_cred` in Linux. Moreover, since the Linux patch "vfs: relax linkat() AT_EMPTY_PATH..." [1], the need for this cap is excused if the creds of the calling task are literally the same as the one stored in the fd. [1] https://github.com/torvalds/linux/commit/42bd2af5950456d PiperOrigin-RevId: 853374474
42 lines
901 B
Python
42 lines
901 B
Python
load("//tools:defs.bzl", "go_library", "go_test")
|
|
|
|
package(default_applicable_licenses = ["//:license"])
|
|
|
|
licenses(["notice"])
|
|
|
|
go_library(
|
|
name = "eventfd",
|
|
srcs = [
|
|
"eventfd.go",
|
|
"save_restore.go",
|
|
],
|
|
visibility = ["//pkg/sentry:internal"],
|
|
deps = [
|
|
"//pkg/abi/linux",
|
|
"//pkg/context",
|
|
"//pkg/errors/linuxerr",
|
|
"//pkg/fdnotifier",
|
|
"//pkg/hostarch",
|
|
"//pkg/log",
|
|
"//pkg/sentry/kernel/auth",
|
|
"//pkg/sentry/vfs",
|
|
"//pkg/usermem",
|
|
"//pkg/waiter",
|
|
"@org_golang_x_sys//unix:go_default_library",
|
|
],
|
|
)
|
|
|
|
go_test(
|
|
name = "eventfd_test",
|
|
size = "small",
|
|
srcs = ["eventfd_test.go"],
|
|
library = ":eventfd",
|
|
deps = [
|
|
"//pkg/abi/linux",
|
|
"//pkg/sentry/contexttest",
|
|
"//pkg/sentry/vfs",
|
|
"//pkg/usermem",
|
|
"//pkg/waiter",
|
|
],
|
|
)
|