diff options
| author | Kevin Krakauer <krakauer@google.com> | 2019-06-12 15:21:22 -0700 |
|---|---|---|
| committer | Kevin Krakauer <krakauer@google.com> | 2019-06-12 15:21:22 -0700 |
| commit | 0bbbcafd68154e7c7b46692b84a39fb6bb5f1568 (patch) | |
| tree | d8fba01ad76900715665b0418a786de2d77e2a05 /pkg/sentry/kernel/task_exec.go | |
| parent | 06a83df533244dc2b3b8adfc1bf0608d3753c1d9 (diff) | |
| parent | 70578806e8d3e01fae2249b3e602cd5b05d378a0 (diff) | |
Merge branch 'master' into iptables-1-pkg
Change-Id: I7457a11de4725e1bf3811420c505d225b1cb6943
Diffstat (limited to 'pkg/sentry/kernel/task_exec.go')
| -rw-r--r-- | pkg/sentry/kernel/task_exec.go | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/pkg/sentry/kernel/task_exec.go b/pkg/sentry/kernel/task_exec.go index 5d1425d5c..35d5cb90c 100644 --- a/pkg/sentry/kernel/task_exec.go +++ b/pkg/sentry/kernel/task_exec.go @@ -68,6 +68,7 @@ import ( "gvisor.googlesource.com/gvisor/pkg/abi/linux" "gvisor.googlesource.com/gvisor/pkg/sentry/arch" "gvisor.googlesource.com/gvisor/pkg/sentry/fs" + "gvisor.googlesource.com/gvisor/pkg/sentry/mm" "gvisor.googlesource.com/gvisor/pkg/syserror" ) @@ -198,6 +199,12 @@ func (r *runSyscallAfterExecStop) execute(t *Task) taskRunState { return flags.CloseOnExec }) + // NOTE(b/30815691): We currently do not implement privileged + // executables (set-user/group-ID bits and file capabilities). This + // allows us to unconditionally enable user dumpability on the new mm. + // See fs/exec.c:setup_new_exec. + r.tc.MemoryManager.SetDumpability(mm.UserDumpable) + // Switch to the new process. t.MemoryManager().Deactivate() t.mu.Lock() |