diff options
Diffstat (limited to 'pkg/sentry/vfs')
| -rw-r--r-- | pkg/sentry/vfs/permissions.go | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/pkg/sentry/vfs/permissions.go b/pkg/sentry/vfs/permissions.go index db6146fd2..b7704874f 100644 --- a/pkg/sentry/vfs/permissions.go +++ b/pkg/sentry/vfs/permissions.go @@ -326,3 +326,20 @@ func CheckXattrPermissions(creds *auth.Credentials, ats AccessTypes, mode linux. } return nil } + +// ClearSUIDAndSGID clears the setuid and/or setgid bits after a chown or write. +// Depending on the mode, neither bit, only the setuid bit, or both are cleared. +func ClearSUIDAndSGID(mode uint32) uint32 { + // Directories don't have their bits changed. + if mode&linux.ModeDirectory == linux.ModeDirectory { + return mode + } + + // Changing owners always disables the setuid bit. It disables + // the setgid bit when the file is executable. + mode &= ^uint32(linux.ModeSetUID) + if sgid := uint32(linux.ModeSetGID | linux.ModeGroupExec); mode&sgid == sgid { + mode &= ^uint32(linux.ModeSetGID) + } + return mode +} |