3 files changed, 67 insertions, 18 deletions
diff --git a/pkg/sentry/fsimpl/overlay/filesystem.go b/pkg/sentry/fsimpl/overlay/filesystem.go
index 84e37f793..46c500427 100644
--- a/pkg/sentry/fsimpl/overlay/filesystem.go
+++ b/pkg/sentry/fsimpl/overlay/filesystem.go
@@ -689,13 +689,9 @@ func (fs *filesystem) MkdirAt(ctx context.Context, rp *vfs.ResolvingPath, opts v
 			}
 			return err
 		}
-		creds := rp.Credentials()
+
 		if err := vfsObj.SetStatAt(ctx, fs.creds, &pop, &vfs.SetStatOptions{
-			Stat: linux.Statx{
-				Mask: linux.STATX_UID | linux.STATX_GID,
-				UID:  uint32(creds.EffectiveKUID),
-				GID:  uint32(creds.EffectiveKGID),
-			},
+			Stat: parent.newChildOwnerStat(opts.Mode, rp.Credentials()),
 		}); err != nil {
 			if cleanupErr := vfsObj.RmdirAt(ctx, fs.creds, &pop); cleanupErr != nil {
 				panic(fmt.Sprintf("unrecoverable overlayfs inconsistency: failed to delete upper layer directory after MkdirAt metadata update failure: %v", cleanupErr))
@@ -750,11 +746,7 @@ func (fs *filesystem) MknodAt(ctx context.Context, rp *vfs.ResolvingPath, opts v
 		}
 		creds := rp.Credentials()
 		if err := vfsObj.SetStatAt(ctx, fs.creds, &pop, &vfs.SetStatOptions{
-			Stat: linux.Statx{
-				Mask: linux.STATX_UID | linux.STATX_GID,
-				UID:  uint32(creds.EffectiveKUID),
-				GID:  uint32(creds.EffectiveKGID),
-			},
+			Stat: parent.newChildOwnerStat(opts.Mode, creds),
 		}); err != nil {
 			if cleanupErr := vfsObj.UnlinkAt(ctx, fs.creds, &pop); cleanupErr != nil {
 				panic(fmt.Sprintf("unrecoverable overlayfs inconsistency: failed to delete upper layer file after MknodAt metadata update failure: %v", cleanupErr))
@@ -963,14 +955,11 @@ func (fs *filesystem) createAndOpenLocked(ctx context.Context, rp *vfs.Resolving
 		}
 		return nil, err
 	}
+
 	// Change the file's owner to the caller. We can't use upperFD.SetStat()
 	// because it will pick up creds from ctx.
 	if err := vfsObj.SetStatAt(ctx, fs.creds, &pop, &vfs.SetStatOptions{
-		Stat: linux.Statx{
-			Mask: linux.STATX_UID | linux.STATX_GID,
-			UID:  uint32(creds.EffectiveKUID),
-			GID:  uint32(creds.EffectiveKGID),
-		},
+		Stat: parent.newChildOwnerStat(opts.Mode, creds),
 	}); err != nil {
 		if cleanupErr := vfsObj.UnlinkAt(ctx, fs.creds, &pop); cleanupErr != nil {
 			panic(fmt.Sprintf("unrecoverable overlayfs inconsistency: failed to delete upper layer file after OpenAt(O_CREAT) metadata update failure: %v", cleanupErr))
diff --git a/pkg/sentry/fsimpl/overlay/overlay.go b/pkg/sentry/fsimpl/overlay/overlay.go
index 58680bc80..454c20d4f 100644
--- a/pkg/sentry/fsimpl/overlay/overlay.go
+++ b/pkg/sentry/fsimpl/overlay/overlay.go
@@ -749,6 +749,27 @@ func (d *dentry) mayDelete(creds *auth.Credentials, child *dentry) error {
 	)
 }
 
+// newChildOwnerStat returns a Statx for configuring the UID, GID, and mode of
+// children.
+func (d *dentry) newChildOwnerStat(mode linux.FileMode, creds *auth.Credentials) linux.Statx {
+	stat := linux.Statx{
+		Mask: uint32(linux.STATX_UID | linux.STATX_GID),
+		UID:  uint32(creds.EffectiveKUID),
+		GID:  uint32(creds.EffectiveKGID),
+	}
+	// Set GID and possibly the SGID bit if the parent is an SGID directory.
+	d.copyMu.RLock()
+	defer d.copyMu.RUnlock()
+	if atomic.LoadUint32(&d.mode)&linux.ModeSetGID == linux.ModeSetGID {
+		stat.GID = atomic.LoadUint32(&d.gid)
+		if stat.Mode&linux.ModeDirectory == linux.ModeDirectory {
+			stat.Mode = uint16(mode) | linux.ModeSetGID
+			stat.Mask |= linux.STATX_MODE
+		}
+	}
+	return stat
+}
+
 // fileDescription is embedded by overlay implementations of
 // vfs.FileDescriptionImpl.
 //
diff --git a/pkg/sentry/fsimpl/overlay/regular_file.go b/pkg/sentry/fsimpl/overlay/regular_file.go
index 25c785fd4..d791c06db 100644
--- a/pkg/sentry/fsimpl/overlay/regular_file.go
+++ b/pkg/sentry/fsimpl/overlay/regular_file.go
@@ -205,6 +205,20 @@ func (fd *regularFileFD) SetStat(ctx context.Context, opts vfs.SetStatOptions) e
 	if err := wrappedFD.SetStat(ctx, opts); err != nil {
 		return err
 	}
+
+	// Changing owners may clear one or both of the setuid and setgid bits,
+	// so we may have to update opts before setting d.mode.
+	if opts.Stat.Mask&(linux.STATX_UID|linux.STATX_GID) != 0 {
+		stat, err := wrappedFD.Stat(ctx, vfs.StatOptions{
+			Mask: linux.STATX_MODE,
+		})
+		if err != nil {
+			return err
+		}
+		opts.Stat.Mode = stat.Mode
+		opts.Stat.Mask |= linux.STATX_MODE
+	}
+
 	d.updateAfterSetStatLocked(&opts)
 	if ev := vfs.InotifyEventFromStatMask(opts.Stat.Mask); ev != 0 {
 		d.InotifyWithParent(ctx, ev, 0, vfs.InodeEvent)
@@ -295,7 +309,11 @@ func (fd *regularFileFD) PWrite(ctx context.Context, src usermem.IOSequence, off
 		return 0, err
 	}
 	defer wrappedFD.DecRef(ctx)
-	return wrappedFD.PWrite(ctx, src, offset, opts)
+	n, err := wrappedFD.PWrite(ctx, src, offset, opts)
+	if err != nil {
+		return n, err
+	}
+	return fd.updateSetUserGroupIDs(ctx, wrappedFD, n)
 }
 
 // Write implements vfs.FileDescriptionImpl.Write.
@@ -307,7 +325,28 @@ func (fd *regularFileFD) Write(ctx context.Context, src usermem.IOSequence, opts
 	if err != nil {
 		return 0, err
 	}
-	return wrappedFD.Write(ctx, src, opts)
+	n, err := wrappedFD.Write(ctx, src, opts)
+	if err != nil {
+		return n, err
+	}
+	return fd.updateSetUserGroupIDs(ctx, wrappedFD, n)
+}
+
+func (fd *regularFileFD) updateSetUserGroupIDs(ctx context.Context, wrappedFD *vfs.FileDescription, written int64) (int64, error) {
+	// Writing can clear the setuid and/or setgid bits. We only have to
+	// check this if something was written and one of those bits was set.
+	dentry := fd.dentry()
+	if written == 0 || atomic.LoadUint32(&dentry.mode)&(linux.S_ISUID|linux.S_ISGID) == 0 {
+		return written, nil
+	}
+	stat, err := wrappedFD.Stat(ctx, vfs.StatOptions{Mask: linux.STATX_MODE})
+	if err != nil {
+		return written, err
+	}
+	dentry.copyMu.Lock()
+	defer dentry.copyMu.Unlock()
+	atomic.StoreUint32(&dentry.mode, uint32(stat.Mode))
+	return written, nil
 }
 
 // Seek implements vfs.FileDescriptionImpl.Seek.