diff options
| author | Andrei Vagin <avagin@google.com> | 2019-04-04 17:42:51 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2019-04-04 17:43:53 -0700 |
| commit | 88409e983c463b6d9c8085e7fdbe7ff45b3c5184 (patch) | |
| tree | f5ba3e9b1c67a7641a8d4d7c4106bd5bc5c2dcf1 /pkg/sentry/fs/context.go | |
| parent | 75a5ccf5d98876c26305da0feff20e4a148027ec (diff) | |
gvisor: Add support for the MS_NOEXEC mount option
https://github.com/google/gvisor/issues/145
PiperOrigin-RevId: 242044115
Change-Id: I8f140fe05e32ecd438b6be218e224e4b7fe05878
Diffstat (limited to 'pkg/sentry/fs/context.go')
| -rw-r--r-- | pkg/sentry/fs/context.go | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/pkg/sentry/fs/context.go b/pkg/sentry/fs/context.go index 1775d3486..c0e6075e4 100644 --- a/pkg/sentry/fs/context.go +++ b/pkg/sentry/fs/context.go @@ -46,6 +46,11 @@ func ContextCanAccessFile(ctx context.Context, inode *Inode, reqPerms PermMask) p = uattr.Perms.Group } + // Do not allow programs to be executed if MS_NOEXEC is set. + if IsFile(inode.StableAttr) && reqPerms.Execute && inode.MountSource.Flags.NoExec { + return false + } + // Are permissions satisfied without capability checks? if p.SupersetOf(reqPerms) { return true |