diff options
| author | Brian Geffon <bgeffon@google.com> | 2018-07-19 12:41:00 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2018-07-19 12:42:05 -0700 |
| commit | df5a5d388e1fc3349ee70c3476fdffb195fbce9c (patch) | |
| tree | ec1d00909f9a11a415ca6cc11bd65622f5d3bd81 /pkg/sentry | |
| parent | a95640b1e9fb8c3751c54c80f6c04f0dff233aed (diff) | |
Add AT_UID, AT_EUID, AT_GID, AT_EGID to aux vector.
With musl libc when these entries are missing from the aux vector
it's forcing libc.secure (effectively AT_SECURE). This mode prevents
RPATH and LD_LIBRARY_PATH from working.
https://git.musl-libc.org/cgit/musl/tree/ldso/dynlink.c#n1488
As the first entry is a mask of all the aux fields set:
https://git.musl-libc.org/cgit/musl/tree/ldso/dynlink.c#n187
PiperOrigin-RevId: 205284684
Change-Id: I04de7bab241043306b4f732306a81d74edfdff26
Diffstat (limited to 'pkg/sentry')
| -rw-r--r-- | pkg/sentry/loader/BUILD | 1 | ||||
| -rw-r--r-- | pkg/sentry/loader/loader.go | 9 |
2 files changed, 9 insertions, 1 deletions
diff --git a/pkg/sentry/loader/BUILD b/pkg/sentry/loader/BUILD index b7aebd9ec..01a0ec426 100644 --- a/pkg/sentry/loader/BUILD +++ b/pkg/sentry/loader/BUILD @@ -46,6 +46,7 @@ go_library( "//pkg/sentry/fs", "//pkg/sentry/fs/anon", "//pkg/sentry/fs/fsutil", + "//pkg/sentry/kernel/auth", "//pkg/sentry/limits", "//pkg/sentry/memmap", "//pkg/sentry/mm", diff --git a/pkg/sentry/loader/loader.go b/pkg/sentry/loader/loader.go index 1b2e9f183..62b39e52b 100644 --- a/pkg/sentry/loader/loader.go +++ b/pkg/sentry/loader/loader.go @@ -27,6 +27,7 @@ import ( "gvisor.googlesource.com/gvisor/pkg/sentry/arch" "gvisor.googlesource.com/gvisor/pkg/sentry/context" "gvisor.googlesource.com/gvisor/pkg/sentry/fs" + "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/auth" "gvisor.googlesource.com/gvisor/pkg/sentry/mm" "gvisor.googlesource.com/gvisor/pkg/sentry/usermem" "gvisor.googlesource.com/gvisor/pkg/syserror" @@ -247,8 +248,14 @@ func Load(ctx context.Context, m *mm.MemoryManager, mounts *fs.MountNamespace, r return 0, nil, "", err } - // Add generic auxv entries + c := auth.CredentialsFromContext(ctx) + + // Add generic auxv entries. auxv := append(loaded.auxv, arch.Auxv{ + arch.AuxEntry{linux.AT_UID, usermem.Addr(c.RealKUID.In(c.UserNamespace).OrOverflow())}, + arch.AuxEntry{linux.AT_EUID, usermem.Addr(c.EffectiveKUID.In(c.UserNamespace).OrOverflow())}, + arch.AuxEntry{linux.AT_GID, usermem.Addr(c.RealKGID.In(c.UserNamespace).OrOverflow())}, + arch.AuxEntry{linux.AT_EGID, usermem.Addr(c.EffectiveKGID.In(c.UserNamespace).OrOverflow())}, arch.AuxEntry{linux.AT_CLKTCK, linux.CLOCKS_PER_SEC}, arch.AuxEntry{linux.AT_EXECFN, execfn}, arch.AuxEntry{linux.AT_RANDOM, random}, |