Match Linux message-queue unlink permissions

pkg/sentry/fsimpl/mqfs/registry.go

@@ -129,6 +129,9 @@ func (r *RegistryImpl) Unlink(ctx context.Context, name string) error {
 		return err
 	}
 	defer inode.DecRef(ctx)
+	if err := vfs.CheckDeleteSticky(creds, root.Mode(), root.UID(), inode.UID(), inode.GID()); err != nil {
+		return err
+	}
 	return root.Unlink(ctx, name, inode)
 }
 

pkg/sentry/fsimpl/mqfs/root.go

@@ -46,7 +46,7 @@ var _ kernfs.Inode = (*rootInode)(nil)
 // newRootInode returns a new, initialized rootInode.
 func (fs *filesystem) newRootInode(ctx context.Context, creds *auth.Credentials) kernfs.Inode {
 	inode := &rootInode{}
-	inode.InodeAttrs.Init(ctx, creds, linux.UNNAMED_MAJOR, fs.devMinor, fs.NextIno(), linux.ModeDirectory|linux.FileMode(0555))
+	inode.InodeAttrs.Init(ctx, creds, linux.UNNAMED_MAJOR, fs.devMinor, fs.NextIno(), linux.ModeDirectory|linux.ModeSticky|linux.FileMode(0777))
 	inode.OrderedChildren.Init(kernfs.OrderedChildrenOptions{Writable: true})
 	inode.InitRefs()
 	return inode

test/syscalls/linux/BUILD

@@ -5187,6 +5187,8 @@ cc_binary(
         "//test/util:temp_path",
         "//test/util:test_main",
         "//test/util:test_util",
+        "//test/util:thread_util",
+        "@com_google_absl//absl/flags:flag",
         "@com_google_absl//absl/strings:str_format",
     ],
 )

test/syscalls/linux/mq.cc

@@ -18,14 +18,17 @@
 #include <sched.h>
 #include <sys/poll.h>
 #include <sys/stat.h>
+#include <sys/syscall.h>
 #include <unistd.h>
 
 #include <cerrno>
 #include <cstddef>
+#include <cstdint>
 #include <string>
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "absl/flags/flag.h"
 #include "absl/strings/str_format.h"
 #include "test/util/capability_util.h"
 #include "test/util/cleanup.h"
@@ -36,9 +39,12 @@
 #include "test/util/posix_error.h"
 #include "test/util/temp_path.h"
 #include "test/util/test_util.h"
+#include "test/util/thread_util.h"
 
 #define NAME_MAX 255
 
+ABSL_FLAG(int32_t, scratch_uid, 65534, "scratch UID");
+
 namespace gvisor {
 namespace testing {
 namespace {
@@ -202,8 +208,25 @@ TEST(MqTest, NoQueueExists) {
               PosixErrorIs(ENOENT));
 }
 
+TEST(MqTest, UnlinkOtherUserQueue) {
+  SKIP_IF(!ASSERT_NO_ERRNO_AND_VALUE(HaveCapability(CAP_SETUID)));
+  PosixQueue queue = ASSERT_NO_ERRNO_AND_VALUE(
+      MqOpen(O_RDWR | O_CREAT | O_EXCL, 0600, nullptr));
+
+  // Change only this thread's credentials so the owner can clean up afterward.
+  ScopedThread([&] {
+    AutoCapability fowner(CAP_FOWNER, false);
+    ASSERT_THAT(
+        syscall(SYS_setresuid, -1, absl::GetFlag(FLAGS_scratch_uid), -1),
+        SyscallSucceeds());
+    EXPECT_THAT(MqUnlink(queue.name()), PosixErrorIs(EACCES));
+  });
+}
+
 // Test trying to re-open a queue with invalid permissions.
 TEST(MqTest, OpenNoAccess) {
+  AutoCapability dacOverride(CAP_DAC_OVERRIDE, false);
+  AutoCapability dacReadSearch(CAP_DAC_READ_SEARCH, false);
   PosixQueue queue = ASSERT_NO_ERRNO_AND_VALUE(
       MqOpen(O_RDWR | O_CREAT | O_EXCL, 0000, nullptr));
 
@@ -214,6 +237,8 @@ TEST(MqTest, OpenNoAccess) {
 
 // Test trying to re-open a read-only queue for write.
 TEST(MqTest, OpenReadAccess) {
+  AutoCapability dacOverride(CAP_DAC_OVERRIDE, false);
+  AutoCapability dacReadSearch(CAP_DAC_READ_SEARCH, false);
   PosixQueue queue = ASSERT_NO_ERRNO_AND_VALUE(
       MqOpen(O_RDWR | O_CREAT | O_EXCL, 0400, nullptr));
 
@@ -224,6 +249,8 @@ TEST(MqTest, OpenReadAccess) {
 
 // Test trying to re-open a write-only queue for read.
 TEST(MqTest, OpenWriteAccess) {
+  AutoCapability dacOverride(CAP_DAC_OVERRIDE, false);
+  AutoCapability dacReadSearch(CAP_DAC_READ_SEARCH, false);
   PosixQueue queue = ASSERT_NO_ERRNO_AND_VALUE(
       MqOpen(O_RDWR | O_CREAT | O_EXCL, 0200, nullptr));