Use O_CLOEXEC when dup'ing FDs
The sentry doesn't allow execve, but it's a good defense in-depth measure. PiperOrigin-RevId: 305958737
This commit is contained in:
parent
ca868e3e38
commit
96f9142959
|
@ -273,7 +273,7 @@ func (i *inodeFileState) recreateReadHandles(ctx context.Context, writer *handle
|
|||
// operations on the old will see the new data. Then, make the new handle take
|
||||
// ownereship of the old FD and mark the old readHandle to not close the FD
|
||||
// when done.
|
||||
if err := syscall.Dup3(h.Host.FD(), i.readHandles.Host.FD(), 0); err != nil {
|
||||
if err := syscall.Dup3(h.Host.FD(), i.readHandles.Host.FD(), syscall.O_CLOEXEC); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
|
|
|
@ -1089,7 +1089,7 @@ func (d *dentry) ensureSharedHandle(ctx context.Context, read, write, trunc bool
|
|||
// description, but this doesn't matter since they refer to the
|
||||
// same file (unless d.fs.opts.overlayfsStaleRead is true,
|
||||
// which we handle separately).
|
||||
if err := syscall.Dup3(int(h.fd), int(d.handle.fd), 0); err != nil {
|
||||
if err := syscall.Dup3(int(h.fd), int(d.handle.fd), syscall.O_CLOEXEC); err != nil {
|
||||
d.handleMu.Unlock()
|
||||
ctx.Warningf("gofer.dentry.ensureSharedHandle: failed to dup fd %d to fd %d: %v", h.fd, d.handle.fd, err)
|
||||
h.close(ctx)
|
||||
|
|
|
@ -44,7 +44,7 @@ var allowedSyscalls = seccomp.SyscallRules{
|
|||
{
|
||||
seccomp.AllowAny{},
|
||||
seccomp.AllowAny{},
|
||||
seccomp.AllowValue(0),
|
||||
seccomp.AllowValue(syscall.O_CLOEXEC),
|
||||
},
|
||||
},
|
||||
syscall.SYS_EPOLL_CREATE1: {},
|
||||
|
|
|
@ -291,7 +291,7 @@ func main() {
|
|||
// want with them. Since Docker and Containerd both eat boot's stderr, we
|
||||
// dup our stderr to the provided log FD so that panics will appear in the
|
||||
// logs, rather than just disappear.
|
||||
if err := syscall.Dup3(fd, int(os.Stderr.Fd()), 0); err != nil {
|
||||
if err := syscall.Dup3(fd, int(os.Stderr.Fd()), syscall.O_CLOEXEC); err != nil {
|
||||
cmd.Fatalf("error dup'ing fd %d to stderr: %v", fd, err)
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue