4 files changed, 47 insertions, 9 deletions
diff --git a/pkg/sentry/fs/tmpfs/BUILD b/pkg/sentry/fs/tmpfs/BUILD
index 90398376a..c36a20afe 100644
--- a/pkg/sentry/fs/tmpfs/BUILD
+++ b/pkg/sentry/fs/tmpfs/BUILD
@@ -15,6 +15,7 @@ go_library(
     deps = [
         "//pkg/abi/linux",
         "//pkg/context",
+        "//pkg/errors/linuxerr",
         "//pkg/hostarch",
         "//pkg/safemem",
         "//pkg/sentry/device",
diff --git a/pkg/sentry/fs/tmpfs/fs.go b/pkg/sentry/fs/tmpfs/fs.go
index bc117ca6a..b48d475ed 100644
--- a/pkg/sentry/fs/tmpfs/fs.go
+++ b/pkg/sentry/fs/tmpfs/fs.go
@@ -151,5 +151,5 @@ func (f *Filesystem) Mount(ctx context.Context, device string, flags fs.MountSou
 	}
 
 	// Construct the tmpfs root.
-	return NewDir(ctx, nil, owner, perms, msrc), nil
+	return NewDir(ctx, nil, owner, perms, msrc, nil /* parent */)
 }
diff --git a/pkg/sentry/fs/tmpfs/inode_file.go b/pkg/sentry/fs/tmpfs/inode_file.go
index f4de8c968..ce6be6386 100644
--- a/pkg/sentry/fs/tmpfs/inode_file.go
+++ b/pkg/sentry/fs/tmpfs/inode_file.go
@@ -21,6 +21,7 @@ import (
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/hostarch"
 	"gvisor.dev/gvisor/pkg/safemem"
 	"gvisor.dev/gvisor/pkg/sentry/fs"
@@ -226,6 +227,12 @@ func (f *fileInodeOperations) Truncate(ctx context.Context, _ *fs.Inode, size in
 		now := ktime.NowFromContext(ctx)
 		f.attr.ModificationTime = now
 		f.attr.StatusChangeTime = now
+
+		// Truncating clears privilege bits.
+		f.attr.Perms.SetUID = false
+		if f.attr.Perms.Group.Execute {
+			f.attr.Perms.SetGID = false
+		}
 	}
 	f.dataMu.Unlock()
 
@@ -363,7 +370,14 @@ func (f *fileInodeOperations) write(ctx context.Context, src usermem.IOSequence,
 	now := ktime.NowFromContext(ctx)
 	f.attr.ModificationTime = now
 	f.attr.StatusChangeTime = now
-	return src.CopyInTo(ctx, &fileReadWriter{f, offset})
+	nwritten, err := src.CopyInTo(ctx, &fileReadWriter{f, offset})
+
+	// Writing clears privilege bits.
+	if nwritten > 0 {
+		f.attr.Perms.DropSetUIDAndMaybeGID()
+	}
+
+	return nwritten, err
 }
 
 type fileReadWriter struct {
@@ -442,7 +456,7 @@ func (rw *fileReadWriter) WriteFromBlocks(srcs safemem.BlockSeq) (uint64, error)
 	end := fs.WriteEndOffset(rw.offset, int64(srcs.NumBytes()))
 	if end == math.MaxInt64 {
 		// Overflow.
-		return 0, syserror.EINVAL
+		return 0, linuxerr.EINVAL
 	}
 
 	// Check if seals prevent either file growth or all writes.
@@ -642,7 +656,7 @@ func GetSeals(inode *fs.Inode) (uint32, error) {
 		return f.seals, nil
 	}
 	// Not a memfd inode.
-	return 0, syserror.EINVAL
+	return 0, linuxerr.EINVAL
 }
 
 // AddSeals adds new file seals to a memfd inode.
@@ -670,5 +684,5 @@ func AddSeals(inode *fs.Inode, val uint32) error {
 		return nil
 	}
 	// Not a memfd inode.
-	return syserror.EINVAL
+	return linuxerr.EINVAL
 }
diff --git a/pkg/sentry/fs/tmpfs/tmpfs.go b/pkg/sentry/fs/tmpfs/tmpfs.go
index 577052888..6aa8ff331 100644
--- a/pkg/sentry/fs/tmpfs/tmpfs.go
+++ b/pkg/sentry/fs/tmpfs/tmpfs.go
@@ -87,7 +87,20 @@ type Dir struct {
 var _ fs.InodeOperations = (*Dir)(nil)
 
 // NewDir returns a new directory.
-func NewDir(ctx context.Context, contents map[string]*fs.Inode, owner fs.FileOwner, perms fs.FilePermissions, msrc *fs.MountSource) *fs.Inode {
+func NewDir(ctx context.Context, contents map[string]*fs.Inode, owner fs.FileOwner, perms fs.FilePermissions, msrc *fs.MountSource, parent *fs.Inode) (*fs.Inode, error) {
+	// If the parent has setgid enabled, the new directory enables it and changes
+	// its GID.
+	if parent != nil {
+		parentUattr, err := parent.UnstableAttr(ctx)
+		if err != nil {
+			return nil, err
+		}
+		if parentUattr.Perms.SetGID {
+			owner.GID = parentUattr.Owner.GID
+			perms.SetGID = true
+		}
+	}
+
 	d := &Dir{
 		ramfsDir: ramfs.NewDir(ctx, contents, owner, perms),
 		kernel:   kernel.KernelFromContext(ctx),
@@ -101,7 +114,7 @@ func NewDir(ctx context.Context, contents map[string]*fs.Inode, owner fs.FileOwn
 		InodeID:   tmpfsDevice.NextIno(),
 		BlockSize: hostarch.PageSize,
 		Type:      fs.Directory,
-	})
+	}), nil
 }
 
 // afterLoad is invoked by stateify.
@@ -219,11 +232,21 @@ func (d *Dir) SetTimestamps(ctx context.Context, i *fs.Inode, ts fs.TimeSpec) er
 func (d *Dir) newCreateOps() *ramfs.CreateOps {
 	return &ramfs.CreateOps{
 		NewDir: func(ctx context.Context, dir *fs.Inode, perms fs.FilePermissions) (*fs.Inode, error) {
-			return NewDir(ctx, nil, fs.FileOwnerFromContext(ctx), perms, dir.MountSource), nil
+			return NewDir(ctx, nil, fs.FileOwnerFromContext(ctx), perms, dir.MountSource, dir)
 		},
 		NewFile: func(ctx context.Context, dir *fs.Inode, perms fs.FilePermissions) (*fs.Inode, error) {
+			// If the parent has setgid enabled, change the GID of the new file.
+			owner := fs.FileOwnerFromContext(ctx)
+			parentUattr, err := dir.UnstableAttr(ctx)
+			if err != nil {
+				return nil, err
+			}
+			if parentUattr.Perms.SetGID {
+				owner.GID = parentUattr.Owner.GID
+			}
+
 			uattr := fs.WithCurrentTime(ctx, fs.UnstableAttr{
-				Owner: fs.FileOwnerFromContext(ctx),
+				Owner: owner,
 				Perms: perms,
 				// Always start unlinked.
 				Links: 0,