mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Shailend ChandandgVisor bot
2c6185b9d1
There is already some support for privileged executables before this change: file capabilities were taken into account when creating new processes inside the sandbox from external instigation (but not during execve(2)). set-user-id and set-group-id bits were never taken into account, and the Sentry behaved as if NO_NEW_PRIVS is always true. After this change, execve(2) and the external Exec entry point both take the set-user(group)-id bits and file capabilities into account. Because NO_NEW_PRIVS can no longer be assumed to be always set, a couple of extra checks to prevent privilege elevation during execve(2) are needed: the presence of a ptracer and the use of a shared fsContext. Moreover, execve had to be serialized with seccomp(2) when it is syncing filters to all threads in a group. Serializing execve with PTRACE_ATTACH and seccomp required some Task runState gymnastics. Task dumpability is reset when privilege elevation takes place and privilege elevation is denied for binaries living on nosuid mounts. To fix an old bug where some aux vectors were populated using data from the old pre-execve creds, the computation of the (file-privilege-augmented) creds during execve now takes place before the stack for the new program is set up. gvisor users who thus far have exec'd into the sandbox with UID as (sandbox) root will lose the caps an all-powerful namespace root'd have if: 1) the binary is a suid/guid binary 2) the owner of the binary is host root and there is no mapping for host root in the host user namespace of the sandbox. To avoid this surprise, the suid/sgid bits are ignored by default. Users can opt-in via the --allow-suid flag. One result of this change is that sudo now works inside the sandbox. PiperOrigin-RevId: 794414101
79 lines
2.3 KiB
Go
79 lines
2.3 KiB
Go
// Copyright 2018 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package auth
|
|
|
|
import (
|
|
"gvisor.dev/gvisor/pkg/context"
|
|
)
|
|
|
|
// contextID is the auth package's type for context.Context.Value keys.
|
|
type contextID int
|
|
|
|
const (
|
|
// CtxCredentials is a Context.Value key for Credentials.
|
|
CtxCredentials contextID = iota
|
|
|
|
// CtxThreadGroupID is the current thread group ID when a context represents
|
|
// a task context. The value is represented as an int32.
|
|
CtxThreadGroupID contextID = iota
|
|
)
|
|
|
|
// CredentialsFromContext returns the Credentials used by ctx, or a
|
|
// set of Credentials with no capabilities if ctx does not have Credentials.
|
|
func CredentialsFromContext(ctx context.Context) *Credentials {
|
|
if v := ctx.Value(CtxCredentials); v != nil {
|
|
return v.(*Credentials)
|
|
}
|
|
return NewAnonymousCredentials()
|
|
}
|
|
|
|
// CredentialsOrNilFromContext returns a copy of the Credentials used by ctx,
|
|
// or nil if ctx does not have Credentials.
|
|
func CredentialsOrNilFromContext(ctx context.Context) *Credentials {
|
|
if v := ctx.Value(CtxCredentials); v != nil {
|
|
return v.(*Credentials)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// ThreadGroupIDFromContext returns the current thread group ID when ctx
|
|
// represents a task context.
|
|
func ThreadGroupIDFromContext(ctx context.Context) (tgid int32, ok bool) {
|
|
if tgid := ctx.Value(CtxThreadGroupID); tgid != nil {
|
|
return tgid.(int32), true
|
|
}
|
|
return 0, false
|
|
}
|
|
|
|
// ContextWithCredentials returns a copy of ctx carrying creds.
|
|
func ContextWithCredentials(ctx context.Context, creds *Credentials) context.Context {
|
|
return &authContext{ctx, creds}
|
|
}
|
|
|
|
type authContext struct {
|
|
context.Context
|
|
creds *Credentials
|
|
}
|
|
|
|
// Value implements context.Context.
|
|
func (ac *authContext) Value(key any) any {
|
|
switch key {
|
|
case CtxCredentials:
|
|
return ac.creds
|
|
default:
|
|
return ac.Context.Value(key)
|
|
}
|
|
}
|