mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Shailend ChandandgVisor bot
e428bbea51
linkat(AT_EMPTY_PATH) needs to check for CAP_DAC_READ_SEARCH in the userns in which the fd was opened, not the userns of the task running linkat(). To get at that userns, vfs.FileDescription now saves a pointer to the creds at the time of its creation: plumbing these creds in accounts for much of the diff. This is similar to how `struct file` stores creds in `f_cred` in Linux. Moreover, since the Linux patch "vfs: relax linkat() AT_EMPTY_PATH..." [1], the need for this cap is excused if the creds of the calling task are literally the same as the one stored in the fd. [1] https://github.com/torvalds/linux/commit/42bd2af5950456d PiperOrigin-RevId: 853374474
40 lines
889 B
Python
40 lines
889 B
Python
load("//tools:defs.bzl", "go_library", "go_test")
|
|
|
|
package(default_applicable_licenses = ["//:license"])
|
|
|
|
licenses(["notice"])
|
|
|
|
go_library(
|
|
name = "iouringfs",
|
|
srcs = [
|
|
"buffer.go",
|
|
"iouringfs.go",
|
|
"iouringfs_state.go",
|
|
"iouringfs_unsafe.go",
|
|
],
|
|
visibility = ["//pkg/sentry:internal"],
|
|
deps = [
|
|
"//pkg/abi/linux",
|
|
"//pkg/atomicbitops",
|
|
"//pkg/context",
|
|
"//pkg/errors/linuxerr",
|
|
"//pkg/hostarch",
|
|
"//pkg/safemem",
|
|
"//pkg/sentry/kernel",
|
|
"//pkg/sentry/kernel/auth",
|
|
"//pkg/sentry/memmap",
|
|
"//pkg/sentry/pgalloc",
|
|
"//pkg/sentry/usage",
|
|
"//pkg/sentry/vfs",
|
|
"//pkg/usermem",
|
|
],
|
|
)
|
|
|
|
go_test(
|
|
name = "iouringfs_test",
|
|
size = "small",
|
|
srcs = ["iouringfs_test.go"],
|
|
library = ":iouringfs",
|
|
deps = ["//pkg/hostarch"],
|
|
)
|