Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add uname parsing fallback path to KernelVersion() #823

Closed
wants to merge 1 commit into from
Closed

Add uname parsing fallback path to KernelVersion() #823

wants to merge 1 commit into from

Commits on Oct 21, 2022

  1. Add uname parsing fallback path to KernelVersion() 

    It turns out if filecaps are assigned to a binary, it affects the
processes "dumpability" (see `PR_SET_DUMPABLE` section in `man prctl`).
When a process isn't globally dumpable, `/proc/self/auxv` is owned by
`root:root`.

Put together, what this means is that if an executable uses this library
and is assigned filecaps but run as a normal user, this library errors
out when reading from `/proc/self/auxv`.

You can confirm this existing behavior by running this on master:

    $ cd internal
    $ go test -c
    $ sudo setcap cap_net_admin,cap_sys_admin+p internal.test
    $ ./internal.test
    --- FAIL: TestCurrentKernelVersion (0.00s)
        version_test.go:53: opening auxv: open /proc/self/auxv: permission denied
    FAIL

This commit makes `KernelVersion()` more reliable by adding a
best-effort uname parsing codepath.

More details about the filecaps interaction is available here:
https://dxuuu.xyz/filecaps.html .
    @danobi
    danobi committed Oct 21, 2022
    Configuration menu
    Copy the full SHA
    efc2185 View commit details
    Browse the repository at this point in the history