syscall: Faccessat checks wrong group

[neild]

The syscall.Faccessat function checks whether the calling process can access a file.

Faccessat contains a bug where it checks a file's group permission bits if the process's user is a member of the process's group rather than a member of the file's group.

go/src/syscall/syscall_linux.go

Line 112 in c9fe126

if uint32(gid) == st.Gid || isGroupMember(gid) {

	var fmode uint32
	if uint32(uid) == st.Uid {
		fmode = (st.Mode >> 6) & 7
	} else {
		var gid int
		if flags&_AT_EACCESS != 0 {
			gid = Getegid()
		} else {
			gid = Getgid()
		}

		if uint32(gid) == st.Gid || isGroupMember(gid) { // <-- this should be isGroupMember(st.Gid), not gid
			fmode = (st.Mode >> 3) & 7
		} else {
			fmode = st.Mode & 7
		}
	}

Since a process's user is usually a member of the process's group, this causes Faccessat to usually check a file's group permissions even if the process's user is not a member of the file's group.

Thanks to @256dpi for reporting this.

[neild]

This bug only occurs on Linux systems, and when syscall.Faccessat is called with a non-zero flags parameter.

[gopherbot]

Change https://go.dev/cl/399539 mentions this issue: syscall: check correct group in Faccessat

[gopherbot]

Change https://go.dev/cl/400074 mentions this issue: unix: check correct group in Faccessat

[neild]

"golang.org/x/sys/unix".Faccessat suffers from the same problem, but only on Linux kernels < 5.8.

[neild]

@gopherbot please open backport issues.

[gopherbot]

Backport issue(s) opened: #52439 (for 1.17), #52440 (for 1.18).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/401078 mentions this issue: [release-branch.go1.17] syscall: check correct group in Faccessat

[gopherbot]

Change https://go.dev/cl/401079 mentions this issue: [release-branch.go1.18] syscall: check correct group in Faccessat

[heschi]

This shipped in yesterday's minor releases.

[dmitshur]

Fixed for Go 1.19 in CL 399539. (This didn't get closed because its commit message had "For" rather than "Fixes".)