go
/
gvisor
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

prlimit: don't check credentials on self 

prlimit was erroneously comparing UIDs and GIDs when getting/setting a process'
own limits. From the manpage:

To set or get the resources of a process other than itself, the caller must have
the CAP_SYS_RESOURCE capability, or the real, effective, and saved set user IDs
of the target process must match the real user ID of the caller and the real,
effective, and saved set group IDs of the target process must match the real
group ID of the caller.

PiperOrigin-RevId: 307127266
This commit is contained in:
Kevin Krakauer 2020-04-17 15:31:51 -07:00 committed by gVisor bot
parent 486759a37d
commit e838290e67
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/sentry/syscalls/linux/sys_rlimit.go
View File

@ -197,7 +197,7 @@ func Prlimit64(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
// saved set user IDs of the target process must match the real user ID of
// the caller and the real, effective, and saved set group IDs of the
// target process must match the real group ID of the caller."
if !t.HasCapabilityIn(linux.CAP_SYS_RESOURCE, t.PIDNamespace().UserNamespace()) {
if ot != t && !t.HasCapabilityIn(linux.CAP_SYS_RESOURCE, t.PIDNamespace().UserNamespace()) {
cred, tcred := t.Credentials(), ot.Credentials()
if cred.RealKUID != tcred.RealKUID ||
cred.RealKUID != tcred.EffectiveKUID ||

12
test/syscalls/linux/uidgid.cc
View File

@ -14,6 +14,7 @@
#include <errno.h>
#include <grp.h>
#include <sys/resource.h>
#include <sys/types.h>
#include <unistd.h>
@ -249,6 +250,17 @@ TEST(UidGidRootTest, Setgroups) {
SyscallFailsWithErrno(EFAULT));
}
TEST(UidGidRootTest, Setuid_prlimit) {
SKIP_IF(!ASSERT_NO_ERRNO_AND_VALUE(IsRoot()));
// Change our UID.
EXPECT_THAT(seteuid(65534), SyscallSucceeds());
// Despite the UID change, we should be able to get our own limits.
struct rlimit rl = {};
ASSERT_THAT(prlimit(0, RLIMIT_NOFILE, NULL, &rl), SyscallSucceeds());
}
} // namespace
} // namespace testing