mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Shailend ChandandgVisor bot
e428bbea51
linkat(AT_EMPTY_PATH) needs to check for CAP_DAC_READ_SEARCH in the userns in which the fd was opened, not the userns of the task running linkat(). To get at that userns, vfs.FileDescription now saves a pointer to the creds at the time of its creation: plumbing these creds in accounts for much of the diff. This is similar to how `struct file` stores creds in `f_cred` in Linux. Moreover, since the Linux patch "vfs: relax linkat() AT_EMPTY_PATH..." [1], the need for this cap is excused if the creds of the calling task are literally the same as the one stored in the fd. [1] https://github.com/torvalds/linux/commit/42bd2af5950456d PiperOrigin-RevId: 853374474
80 lines
1.6 KiB
Python
80 lines
1.6 KiB
Python
load("//pkg/sync/locking:locking.bzl", "declare_mutex")
|
|
load("//tools:defs.bzl", "go_library", "go_test")
|
|
|
|
package(
|
|
default_applicable_licenses = ["//:license"],
|
|
licenses = ["notice"],
|
|
)
|
|
|
|
declare_mutex(
|
|
name = "vfs_mutex",
|
|
out = "vfs_mutex.go",
|
|
package = "pipe",
|
|
prefix = "vfs",
|
|
)
|
|
|
|
declare_mutex(
|
|
name = "pipe_mutex",
|
|
out = "pipe_mutex.go",
|
|
nested_lock_names = ["pipe"],
|
|
package = "pipe",
|
|
prefix = "pipe",
|
|
)
|
|
|
|
declare_mutex(
|
|
name = "inode_mutex",
|
|
out = "inode_mutex.go",
|
|
package = "pipe",
|
|
prefix = "inode",
|
|
)
|
|
|
|
go_library(
|
|
name = "pipe",
|
|
srcs = [
|
|
"inode_mutex.go",
|
|
"pipe.go",
|
|
"pipe_mutex.go",
|
|
"pipe_unsafe.go",
|
|
"pipe_util.go",
|
|
"save_restore.go",
|
|
"vfs.go",
|
|
],
|
|
visibility = ["//pkg/sentry:internal"],
|
|
deps = [
|
|
"//pkg/abi/linux",
|
|
"//pkg/atomicbitops",
|
|
"//pkg/context",
|
|
"//pkg/errors/linuxerr",
|
|
"//pkg/hostarch",
|
|
"//pkg/log",
|
|
"//pkg/marshal/primitive",
|
|
"//pkg/safemem",
|
|
"//pkg/sentry/arch",
|
|
"//pkg/sentry/fsutil",
|
|
"//pkg/sentry/kernel/auth",
|
|
"//pkg/sentry/vfs",
|
|
"//pkg/sync",
|
|
"//pkg/sync/locking",
|
|
"//pkg/usermem",
|
|
"//pkg/waiter",
|
|
"@org_golang_x_sys//unix:go_default_library",
|
|
],
|
|
)
|
|
|
|
go_test(
|
|
name = "pipe_test",
|
|
size = "small",
|
|
srcs = [
|
|
"pipe_test.go",
|
|
],
|
|
library = ":pipe",
|
|
deps = [
|
|
"//pkg/context",
|
|
"//pkg/errors/linuxerr",
|
|
"//pkg/sentry/contexttest",
|
|
"//pkg/sentry/vfs",
|
|
"//pkg/usermem",
|
|
"//pkg/waiter",
|
|
],
|
|
)
|