mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Shailend ChandandgVisor bot
e428bbea51
linkat(AT_EMPTY_PATH) needs to check for CAP_DAC_READ_SEARCH in the userns in which the fd was opened, not the userns of the task running linkat(). To get at that userns, vfs.FileDescription now saves a pointer to the creds at the time of its creation: plumbing these creds in accounts for much of the diff. This is similar to how `struct file` stores creds in `f_cred` in Linux. Moreover, since the Linux patch "vfs: relax linkat() AT_EMPTY_PATH..." [1], the need for this cap is excused if the creds of the calling task are literally the same as the one stored in the fd. [1] https://github.com/torvalds/linux/commit/42bd2af5950456d PiperOrigin-RevId: 853374474
23 lines
501 B
Python
23 lines
501 B
Python
load("//tools:defs.bzl", "go_library")
|
|
|
|
package(default_applicable_licenses = ["//:license"])
|
|
|
|
licenses(["notice"])
|
|
|
|
go_library(
|
|
name = "timerfd",
|
|
srcs = ["timerfd.go"],
|
|
visibility = ["//pkg/sentry:internal"],
|
|
deps = [
|
|
"//pkg/atomicbitops",
|
|
"//pkg/context",
|
|
"//pkg/errors/linuxerr",
|
|
"//pkg/hostarch",
|
|
"//pkg/sentry/kernel/auth",
|
|
"//pkg/sentry/ktime",
|
|
"//pkg/sentry/vfs",
|
|
"//pkg/usermem",
|
|
"//pkg/waiter",
|
|
],
|
|
)
|