From 0892420c9796358da06ea3ba375ee3e0fa8595ac Mon Sep 17 00:00:00 2001
From: Jamie Liu <jamieliu@google.com>
Date: Thu, 10 Jun 2021 18:22:18 -0700
Subject: Minor VFS2 xattr changes.

- Allow the gofer client to use most xattr namespaces. As documented by the
  updated comment, this is consistent with e.g. Linux's FUSE client, and allows
  gofers to provide extended attributes from FUSE filesystems.

- Make tmpfs' listxattr omit xattrs in the "trusted" namespace for
  non-privileged users.

PiperOrigin-RevId: 378778854
---
 pkg/sentry/vfs/memxattr/xattr.go | 33 +++++++++++++++++++++++++++++----
 1 file changed, 29 insertions(+), 4 deletions(-)

(limited to 'pkg/sentry/vfs/memxattr/xattr.go')

diff --git a/pkg/sentry/vfs/memxattr/xattr.go b/pkg/sentry/vfs/memxattr/xattr.go
index 638b5d830..9b7953fa3 100644
--- a/pkg/sentry/vfs/memxattr/xattr.go
+++ b/pkg/sentry/vfs/memxattr/xattr.go
@@ -17,7 +17,10 @@
 package memxattr
 
 import (
+	"strings"
+
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sentry/vfs"
 	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/syserror"
@@ -26,6 +29,9 @@ import (
 // SimpleExtendedAttributes implements extended attributes using a map of
 // names to values.
 //
+// SimpleExtendedAttributes calls vfs.CheckXattrPermissions, so callers are not
+// required to do so.
+//
 // +stateify savable
 type SimpleExtendedAttributes struct {
 	// mu protects the below fields.
@@ -34,7 +40,11 @@ type SimpleExtendedAttributes struct {
 }
 
 // GetXattr returns the value at 'name'.
-func (x *SimpleExtendedAttributes) GetXattr(opts *vfs.GetXattrOptions) (string, error) {
+func (x *SimpleExtendedAttributes) GetXattr(creds *auth.Credentials, mode linux.FileMode, kuid auth.KUID, opts *vfs.GetXattrOptions) (string, error) {
+	if err := vfs.CheckXattrPermissions(creds, vfs.MayRead, mode, kuid, opts.Name); err != nil {
+		return "", err
+	}
+
 	x.mu.RLock()
 	value, ok := x.xattrs[opts.Name]
 	x.mu.RUnlock()
@@ -50,7 +60,11 @@ func (x *SimpleExtendedAttributes) GetXattr(opts *vfs.GetXattrOptions) (string,
 }
 
 // SetXattr sets 'value' at 'name'.
-func (x *SimpleExtendedAttributes) SetXattr(opts *vfs.SetXattrOptions) error {
+func (x *SimpleExtendedAttributes) SetXattr(creds *auth.Credentials, mode linux.FileMode, kuid auth.KUID, opts *vfs.SetXattrOptions) error {
+	if err := vfs.CheckXattrPermissions(creds, vfs.MayWrite, mode, kuid, opts.Name); err != nil {
+		return err
+	}
+
 	x.mu.Lock()
 	defer x.mu.Unlock()
 	if x.xattrs == nil {
@@ -73,12 +87,19 @@ func (x *SimpleExtendedAttributes) SetXattr(opts *vfs.SetXattrOptions) error {
 }
 
 // ListXattr returns all names in xattrs.
-func (x *SimpleExtendedAttributes) ListXattr(size uint64) ([]string, error) {
+func (x *SimpleExtendedAttributes) ListXattr(creds *auth.Credentials, size uint64) ([]string, error) {
 	// Keep track of the size of the buffer needed in listxattr(2) for the list.
 	listSize := 0
 	x.mu.RLock()
 	names := make([]string, 0, len(x.xattrs))
+	haveCap := creds.HasCapability(linux.CAP_SYS_ADMIN)
 	for n := range x.xattrs {
+		// Hide extended attributes in the "trusted" namespace from
+		// non-privileged users. This is consistent with Linux's
+		// fs/xattr.c:simple_xattr_list().
+		if !haveCap && strings.HasPrefix(n, linux.XATTR_TRUSTED_PREFIX) {
+			continue
+		}
 		names = append(names, n)
 		// Add one byte per null terminator.
 		listSize += len(n) + 1
@@ -91,7 +112,11 @@ func (x *SimpleExtendedAttributes) ListXattr(size uint64) ([]string, error) {
 }
 
 // RemoveXattr removes the xattr at 'name'.
-func (x *SimpleExtendedAttributes) RemoveXattr(name string) error {
+func (x *SimpleExtendedAttributes) RemoveXattr(creds *auth.Credentials, mode linux.FileMode, kuid auth.KUID, name string) error {
+	if err := vfs.CheckXattrPermissions(creds, vfs.MayWrite, mode, kuid, name); err != nil {
+		return err
+	}
+
 	x.mu.Lock()
 	defer x.mu.Unlock()
 	if _, ok := x.xattrs[name]; !ok {
-- 
cgit v1.2.3