diff options
| author | Dean Deng <deandeng@google.com> | 2020-04-28 20:11:43 -0700 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2020-04-28 20:13:01 -0700 |
| commit | ce19497c1c0829af6ba56f0cc68e3a4cb33cf1c8 (patch) | |
| tree | c8fe75216dfda0345e048e72d0641fc0fadcccbb /pkg/sentry/vfs/anonfs.go | |
| parent | 24abccbc1c3b7b0dd06b6da97e5b4c90c8c13907 (diff) | |
Fix Unix socket permissions.
Enforce write permission checks in BoundEndpointAt, which corresponds to the
permission checks in Linux (net/unix/af_unix.c:unix_find_other).
Also, create bound socket files with the correct permissions in VFS2.
Fixes #2324.
PiperOrigin-RevId: 308949084
Diffstat (limited to 'pkg/sentry/vfs/anonfs.go')
| -rw-r--r-- | pkg/sentry/vfs/anonfs.go | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/pkg/sentry/vfs/anonfs.go b/pkg/sentry/vfs/anonfs.go index b1a998590..981bd8caa 100644 --- a/pkg/sentry/vfs/anonfs.go +++ b/pkg/sentry/vfs/anonfs.go @@ -241,6 +241,9 @@ func (fs *anonFilesystem) BoundEndpointAt(ctx context.Context, rp *ResolvingPath if !rp.Final() { return nil, syserror.ENOTDIR } + if err := GenericCheckPermissions(rp.Credentials(), MayWrite, anonFileMode, anonFileUID, anonFileGID); err != nil { + return nil, err + } return nil, syserror.ECONNREFUSED } |