From beb11cec7669d029172751e5b4dfe21c0672a25a Mon Sep 17 00:00:00 2001
From: Chong Cai <chongc@google.com>
Date: Tue, 23 Mar 2021 11:04:08 -0700
Subject: Allow FSETXATTR/FGETXATTR host calls for Verity

These host calls are needed for Verity fs to generate/verify hashes.

PiperOrigin-RevId: 364598180
---
 runsc/cmd/gofer.go | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

(limited to 'runsc/cmd/gofer.go')

diff --git a/runsc/cmd/gofer.go b/runsc/cmd/gofer.go
index d703e4042..4cb0164dd 100644
--- a/runsc/cmd/gofer.go
+++ b/runsc/cmd/gofer.go
@@ -165,8 +165,8 @@ func (g *Gofer) Execute(_ context.Context, f *flag.FlagSet, args ...interface{})
 	// Start with root mount, then add any other additional mount as needed.
 	ats := make([]p9.Attacher, 0, len(spec.Mounts)+1)
 	ap, err := fsgofer.NewAttachPoint("/", fsgofer.Config{
-		ROMount:     spec.Root.Readonly || conf.Overlay,
-		EnableXattr: conf.Verity,
+		ROMount:           spec.Root.Readonly || conf.Overlay,
+		EnableVerityXattr: conf.Verity,
 	})
 	if err != nil {
 		Fatalf("creating attach point: %v", err)
@@ -178,9 +178,9 @@ func (g *Gofer) Execute(_ context.Context, f *flag.FlagSet, args ...interface{})
 	for _, m := range spec.Mounts {
 		if specutils.Is9PMount(m) {
 			cfg := fsgofer.Config{
-				ROMount:     isReadonlyMount(m.Options) || conf.Overlay,
-				HostUDS:     conf.FSGoferHostUDS,
-				EnableXattr: conf.Verity,
+				ROMount:           isReadonlyMount(m.Options) || conf.Overlay,
+				HostUDS:           conf.FSGoferHostUDS,
+				EnableVerityXattr: conf.Verity,
 			}
 			ap, err := fsgofer.NewAttachPoint(m.Destination, cfg)
 			if err != nil {
@@ -203,6 +203,10 @@ func (g *Gofer) Execute(_ context.Context, f *flag.FlagSet, args ...interface{})
 		filter.InstallUDSFilters()
 	}
 
+	if conf.Verity {
+		filter.InstallXattrFilters()
+	}
+
 	if err := filter.Install(); err != nil {
 		Fatalf("installing seccomp filters: %v", err)
 	}
-- 
cgit v1.2.3