Skip to content

proc allow root and fakeroot guests to switch to any UID/GID #217

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jserv merged 1 commit into from
Jul 18, 2026
+116 −25
Merged

proc allow root and fakeroot guests to switch to any UID/GID #217

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 18 additions & 3 deletions src/syscall/proc-identity.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,35 +107,50 @@ uint32_t proc_get_sgid(void)

static bool uid_is_permitted(uint32_t val)
{
if (emu_euid == 0 || proc_fakeroot_enabled())
Comment thread
cubic-dev-ai[bot] marked this conversation as resolved.
Comment thread
cubic-dev-ai[bot] marked this conversation as resolved.
return true;
return val == emu_uid || val == emu_euid || val == emu_suid;
}

static bool gid_is_permitted(uint32_t val)
{
if (emu_euid == 0 || proc_fakeroot_enabled())
return true;
return val == emu_gid || val == emu_egid || val == emu_sgid;
}

int64_t proc_sys_setuid(uint32_t uid)
{
if (!uid_is_permitted(uid))
return -LINUX_EPERM;
emu_euid = uid;
if (emu_euid == 0 || proc_fakeroot_enabled()) {
emu_uid = uid;
emu_euid = uid;
emu_suid = uid;
} else
emu_euid = uid;
return 0;
}

int64_t proc_sys_setgid(uint32_t gid)
{
if (!gid_is_permitted(gid))
return -LINUX_EPERM;
emu_egid = gid;
if (emu_euid == 0 || proc_fakeroot_enabled()) {
emu_gid = gid;
emu_egid = gid;
emu_sgid = gid;
} else
emu_egid = gid;
return 0;
}

#define DEFINE_SETRE(suffix, real, eff, saved, perm_fn) \
int64_t proc_sys_setre##suffix(uint32_t r, uint32_t e) \
{ \
uint32_t old_real = real; \
if (r != (uint32_t) -1 && r != real && r != eff) \
if (r != (uint32_t) -1 && r != real && r != eff && \
!(emu_euid == 0 || proc_fakeroot_enabled())) \
return -LINUX_EPERM; \
if (e != (uint32_t) -1 && !perm_fn(e)) \
return -LINUX_EPERM; \
Expand Down
118 changes: 96 additions & 22 deletions tests/test-credentials.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
*/

#include <sys/types.h> /* gid_t */
#include <sys/wait.h> /* waitpid */
#include <unistd.h> /* getgroups */

#include "test-harness.h"
Expand Down Expand Up @@ -67,14 +68,22 @@ int main(void)
TEST("setuid(expected) succeeds");
EXPECT_TRUE(raw_syscall1(__NR_setuid, expected_id) == 0, "setuid failed");

/* setuid: setting to arbitrary value must fail with -EPERM */
TEST("setuid(other) returns -EPERM");
/* setuid: setting to arbitrary value must fail with -EPERM for non-root */
TEST("setuid(other) returns expected status");
{
long rc = raw_syscall1(__NR_setuid, expected_id == 0 ? 1000 : 0);
if (rc == -1) /* -EPERM */
PASS();
pid_t pid = fork();
if (pid == 0) {
long rc = raw_syscall1(__NR_setuid, expected_id == 0 ? 1000 : 0);
_exit(rc == 0 ? 0 : 1);
}
int status;
waitpid(pid, &status, 0);
if (expected_id == 0)
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0,
"setuid(1000) failed for root");
else
FAIL("expected -EPERM");
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 1,
"expected -EPERM");
}

/* setresuid: swap euid (no-op but must succeed) */
Expand All @@ -86,15 +95,23 @@ int main(void)
}

/* setresuid: set euid to a value not in {ruid, euid, suid} */
TEST("setresuid(-1,other,-1) returns -EPERM");
TEST("setresuid(-1,other,-1) returns expected status");
{
long rc =
raw_syscall3(__NR_setresuid, (long) (unsigned) -1,
expected_id == 0 ? 1000 : 42, (long) (unsigned) -1);
if (rc == -1) /* -EPERM */
PASS();
pid_t pid = fork();
if (pid == 0) {
long rc = raw_syscall3(__NR_setresuid, (long) (unsigned) -1,
expected_id == 0 ? 1000 : 42,
(long) (unsigned) -1);
_exit(rc == 0 ? 0 : 1);
}
int status;
waitpid(pid, &status, 0);
if (expected_id == 0)
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0,
"setresuid failed for root");
else
FAIL("expected -EPERM");
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 1,
"expected -EPERM");
}

/* setreuid: ruid can only be set to current ruid or euid */
Expand All @@ -105,14 +122,22 @@ int main(void)
EXPECT_TRUE(rc == 0, "setreuid(ruid,-1) failed");
}

TEST("setreuid(other,-1) returns -EPERM");
TEST("setreuid(other,-1) returns expected status");
{
long rc = raw_syscall2(__NR_setreuid, expected_id == 0 ? 1000 : 42,
(long) (unsigned) -1);
if (rc == -1) /* -EPERM */
PASS();
pid_t pid = fork();
if (pid == 0) {
long rc = raw_syscall2(__NR_setreuid, expected_id == 0 ? 1000 : 42,
(long) (unsigned) -1);
_exit(rc == 0 ? 0 : 1);
}
int status;
waitpid(pid, &status, 0);
if (expected_id == 0)
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0,
"setreuid failed for root");
else
FAIL("expected -EPERM");
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 1,
"expected -EPERM");
}

/* getresgid */
Expand All @@ -130,9 +155,22 @@ int main(void)
TEST("setgid(expected) succeeds");
EXPECT_TRUE(raw_syscall1(__NR_setgid, expected_id) == 0, "setgid failed");

TEST("setgid(other) returns -EPERM");
EXPECT_TRUE(raw_syscall1(__NR_setgid, expected_id == 0 ? 1000 : 0) == -1,
"expected -EPERM");
TEST("setgid(other) returns expected status");
{
pid_t pid = fork();
if (pid == 0) {
long rc = raw_syscall1(__NR_setgid, expected_id == 0 ? 1000 : 0);
_exit(rc == 0 ? 0 : 1);
}
int status;
waitpid(pid, &status, 0);
if (expected_id == 0)
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0,
"setgid(1000) failed for root");
else
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 1,
"expected -EPERM");
}

/* setfsuid / setfsgid: Linux contract is to return the previous fsuid /
* fsgid.
Expand Down Expand Up @@ -238,6 +276,42 @@ int main(void)
EXPECT_TRUE(rc > 0 && (mask & 1), "CPU0 not in mask");
}

if (expected_id == 0) {

@Max042004 Max042004 Jul 18, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These root-only assertions never run in CI: test-credentials isn't in tests/manifest.txt (not part of make check), test-matrix.sh invokes it without --fakeroot (default guest UID 1000), and it's listed in QEMU_SKIP for the real-root qemu lane — so expected_id == 0 is unreachable everywhere.

Running it manually with --fakeroot fails 7/27 cases: the earlier setuid(other)/setgid(other) root-branch calls (lines 73/156) now permanently drop identity to 1000 per this PR's own "reset all three fields" fix, but the later setfsuid/setfsgid/getgroups assertions still assume the stale expected_id == 0 identity. Please wire --fakeroot into a test runner so this doesn't silently bit-rot, and fix the stale-identity assumption in those later checks.

@doanbaotrung doanbaotrung Jul 18, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated

TEST("privileged setreuid(1000, -1) sets real ID");
{
pid_t pid = fork();
if (pid == 0) {
long rc =
raw_syscall2(__NR_setreuid, 1000, (long) (unsigned) -1);
_exit(rc == 0 ? 0 : 1);
}
int status;
waitpid(pid, &status, 0);
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0,
"setreuid(1000, -1) failed");
}

TEST("privileged setuid(1000) resets ruid/euid/suid");
{
pid_t pid = fork();
if (pid == 0) {
long rc = raw_syscall1(__NR_setuid, 1000);
if (rc != 0)
_exit(1);
unsigned int ruid = 0, euid = 0, suid = 0;
long grc = raw_syscall3(__NR_getresuid, (long) &ruid,
(long) &euid, (long) &suid);
if (grc == 0 && ruid == 1000 && euid == 1000 && suid == 1000)
_exit(0);
_exit(2);
}
int status;
waitpid(pid, &status, 0);
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0,
"uid triple not fully updated");
}
}

SUMMARY("test-credentials");
return fails ? 1 : 0;
}
2 changes: 2 additions & 0 deletions tests/test-matrix.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,6 +274,7 @@ QEMU_SKIP="
test-mmap-hint
test-msync
test-credentials
test-credentials-fakeroot
test-sched-policy
test-rseq
test-tier-a
Expand Down Expand Up @@ -748,6 +749,7 @@ run_unit_tests()

printf "\nCredential/identity emulation\n"
test_rc "$runner" "test-credentials" 0 "$bindir/test-credentials"
test_rc "$runner" "test-credentials-fakeroot" 0 --fakeroot "$bindir/test-credentials"

printf "\nScheduler policy stub\n"
test_rc "$runner" "test-sched-policy" 0 "$bindir/test-sched-policy"
Expand Down
Loading