mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Shailend ChandandgVisor bot
2c6185b9d1
There is already some support for privileged executables before this change: file capabilities were taken into account when creating new processes inside the sandbox from external instigation (but not during execve(2)). set-user-id and set-group-id bits were never taken into account, and the Sentry behaved as if NO_NEW_PRIVS is always true. After this change, execve(2) and the external Exec entry point both take the set-user(group)-id bits and file capabilities into account. Because NO_NEW_PRIVS can no longer be assumed to be always set, a couple of extra checks to prevent privilege elevation during execve(2) are needed: the presence of a ptracer and the use of a shared fsContext. Moreover, execve had to be serialized with seccomp(2) when it is syncing filters to all threads in a group. Serializing execve with PTRACE_ATTACH and seccomp required some Task runState gymnastics. Task dumpability is reset when privilege elevation takes place and privilege elevation is denied for binaries living on nosuid mounts. To fix an old bug where some aux vectors were populated using data from the old pre-execve creds, the computation of the (file-privilege-augmented) creds during execve now takes place before the stack for the new program is set up. gvisor users who thus far have exec'd into the sandbox with UID as (sandbox) root will lose the caps an all-powerful namespace root'd have if: 1) the binary is a suid/guid binary 2) the owner of the binary is host root and there is no mapping for host root in the host user namespace of the sandbox. To avoid this surprise, the suid/sgid bits are ignored by default. Users can opt-in via the --allow-suid flag. One result of this change is that sudo now works inside the sandbox. PiperOrigin-RevId: 794414101
54 lines
1.5 KiB
C++
54 lines
1.5 KiB
C++
// Copyright 2025 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
#include <sys/prctl.h>
|
|
#include <unistd.h>
|
|
|
|
#include <iostream>
|
|
|
|
#include "absl/strings/numbers.h"
|
|
|
|
int main(int argc, char** argv, char** envp) {
|
|
if (argc != 4) {
|
|
std::cerr << "Usage: " << argv[0]
|
|
<< " <want_euid> <want_egid> <want_dumpability>" << std::endl;
|
|
return 1;
|
|
}
|
|
uint want_euid;
|
|
if (!absl::SimpleAtoi(argv[1], &want_euid)) {
|
|
std::cerr << "want_euid is not an integer: " << argv[1] << std::endl;
|
|
return 1;
|
|
}
|
|
uint want_egid;
|
|
if (!absl::SimpleAtoi(argv[2], &want_egid)) {
|
|
std::cerr << "want_egid is not an integer: " << argv[2] << std::endl;
|
|
return 1;
|
|
}
|
|
int want_dumpability;
|
|
if (!absl::SimpleAtoi(argv[3], &want_dumpability)) {
|
|
std::cerr << "want_dumpability is not an integer: " << argv[3] << std::endl;
|
|
return 1;
|
|
}
|
|
if (geteuid() != want_euid) {
|
|
return 2;
|
|
}
|
|
if (getegid() != want_egid) {
|
|
return 3;
|
|
}
|
|
if (prctl(PR_GET_DUMPABLE) != want_dumpability) {
|
|
return 4;
|
|
}
|
|
return 0;
|
|
}
|