Add missing Linux capability checks for SO_BINDTODEVICE, mknod, sched_setaffinity, and setpriority

[petrmarinec]

Summary

This patch adds capability and permission checks that the Linux kernel enforces but gVisor currently omits. Each fix was verified against native Linux behavior using bazel test on both native and runsc_ptrace platforms.

Changes

1. SO_BINDTODEVICE: Add CAP_NET_RAW check

File: pkg/sentry/socket/netstack/netstack.go
Linux reference: net/core/sock.c:sock_setsockopt() checks ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW)
Evidence this is unintended: gVisor's own test suite asserts "CAP_NET_RAW is required to use SO_BINDTODEVICE" (test/syscalls/linux/socket_bind_to_device.cc:52), and SO_RCVBUFFORCE in the same file already correctly checks CAP_NET_ADMIN.

2. mknod(S_IFBLK/S_IFCHR): Add CAP_MKNOD check

File: pkg/sentry/syscalls/linux/sys_file.go
Linux reference: fs/namei.c:vfs_mknod() checks capable(CAP_MKNOD) for block/char device creation
Evidence this is unintended: CAP_MKNOD is defined (pkg/abi/linux/capability.go:56), parsed from OCI specs (runsc/specutils/specutils.go:491), and has strace formatting — but is never checked anywhere. Zero HasCapability calls for it exist in the codebase.

3. sched_setaffinity: Add UID match / CAP_SYS_NICE check

File: pkg/sentry/syscalls/linux/sys_thread.go
Linux reference: kernel/sched/core.c:check_same_owner() requires EUID match or CAP_SYS_NICE
Impact: Without this check, any unprivileged process could modify another process's CPU affinity mask.

4. setpriority: Add UID match / CAP_SYS_NICE check

File: pkg/sentry/syscalls/linux/sys_thread.go
Linux reference: kernel/sys.c:set_one_prio() requires UID match or CAP_SYS_NICE
Impact: Without this check, any unprivileged process could change another process's scheduling priority.

Testing

Tests added in test/syscalls/linux/capability_checks.cc, verified on both native Linux and gVisor:

bazel test //test/syscalls:capability_checks_test_native        → 6/6 passed
bazel test //test/syscalls:capability_checks_test_runsc_ptrace  → 4 passed, 2 skipped

The 2 skipped tests are the mknod positive cases (creating device nodes with CAP_MKNOD), which are skipped on gVisor because the sandbox does not permit device node creation regardless of capabilities.

Test	What it verifies
SoBindToDeviceCapTest.RequiresCapNetRaw	EPERM without CAP_NET_RAW
MknodCapTest.CharDevRequiresCapMknod	EPERM for S_IFCHR without CAP_MKNOD (native only)
MknodCapTest.BlockDevRequiresCapMknod	EPERM for S_IFBLK without CAP_MKNOD (native only)
MknodCapTest.FifoDoesNotRequireCapMknod	S_IFIFO succeeds without CAP_MKNOD
SchedSetaffinityCapTest.OtherUidRequiresCapSysNice	EPERM without UID match or CAP_SYS_NICE
SetpriorityCapTest.OtherUidRequiresCapSysNice	EPERM without UID match or CAP_SYS_NICE

Assisted-by: Codex

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[EtiennePerot]

Can you add syscall tests under test/syscalls/linux to exercise these and to ensure consistency with Linux?

[petrmarinec]

Tests added in test/syscalls/linux/capability_checks.cc. I also verified the changes against native Linux and gVisor (runsc_ptrace) using Bazel:

bazel test //test/syscalls:capability_checks_test_native        → 6/6 passed
bazel test //test/syscalls:capability_checks_test_runsc_ptrace  → 4 passed, 2 skipped

During testing I found and fixed a few issues:

1. Build fix: s.HasCapability() doesn't exist on the socket.Socket interface in SetSockOptSocket. Changed to t.HasCapabilityIn(linux.CAP_NET_RAW, t.NetworkNamespace().UserNamespace()).

2. Removed /proc/sys capability checks: After testing on native Linux, writing to tcp_sack, tcp_recovery, tcp_rmem/wmem, ip_local_port_range, and nr_open succeeded even after dropping CAP_NET_ADMIN/CAP_SYS_ADMIN. These checks did not match actual Linux behavior, so I removed them to keep the PR aligned with its goal.

3. mknod tests: Added IsRunningOnGvisor() skip for the positive device creation cases, since the sandbox blocks device node creation regardless of capabilities. The negative tests (EPERM without CAP_MKNOD) still run on both platforms.

The PR now covers 4 verified fixes: SO_BINDTODEVICE, mknod, sched_setaffinity, and setpriority.

[ayushr2]

Could you also sign the CLA?

[ayushr2]

Could you verify that these newly added tests fail without your fixes?

[petrmarinec]

Done. I addressed the SO_BINDTODEVICE test comments and verified the new tests against a scratch build with the implementation checks removed. They fail there because the operations succeed instead of returning EPERM, and pass again with this PR applied.

I also changed the mknod tests to mount an explicit tmpfs so they do not depend on /tmp already being tmpfs.

[ayushr2]

Could you rebase and resolve conflicts?

[petrmarinec]

Rebased and resolved the conflict. I also addressed the setpriority nit.

[ayushr2]

Please squash your commits per https://github.com/google/gvisor/blob/master/CONTRIBUTING.md#code-reviews

Review was addressed

[petrmarinec]

Done, squashed into a single commit.

[petrmarinec]

SO_BINDTODEVICE now only requires CAP_NET_RAW when overwriting an existing binding, and the test now covers first bind without CAP_NET_RAW succeeding plus overwrite without CAP_NET_RAW failing.

mknod now skips whiteouts and checks CAP_MKNOD in the init user namespace.

sched_setaffinity now references kernel/sched/syscalls.c:sched_setaffinity().

For setpriority, I moved the target lookup and permission check into the who != 0 branch. I also rechecked this path against current Linux kernel/sys.c:set_one_prio_perm(); setpriority uses ns_capable(pcred->user_ns, CAP_SYS_NICE), so this remains checked against the target task's user namespace.

[ayushr2]

I also rechecked this path against current Linux kernel/sys.c:set_one_prio_perm(); setpriority uses ns_capable(pcred->user_ns, CAP_SYS_NICE), so this remains checked against the target task's user namespace.

Could you confirm which Linux version source you are looking at. At least since Linux 6.11, the capability check is done on the init userns: https://github.com/torvalds/linux/blob/3cd8b194bf3428dfa53120fee47e827a7c495815/kernel/sched/syscalls.c#L487-L488

[petrmarinec]

I was looking at the same torvalds/linux commit you linked, but at the direct setpriority(2) path in kernel/sys.c.

SYSCALL_DEFINE3(setpriority) calls set_one_prio(), and set_one_prio() calls set_one_prio_perm():
https://github.com/torvalds/linux/blob/3cd8b194bf3428dfa53120fee47e827a7c495815/kernel/sys.c#L259-L286
https://github.com/torvalds/linux/blob/3cd8b194bf3428dfa53120fee47e827a7c495815/kernel/sys.c#L219-L228

That helper checks ns_capable(pcred->user_ns, CAP_SYS_NICE), so I kept the cross-UID setpriority permission check against the target task's user namespace.

The line you linked in kernel/sched/syscalls.c is the sched_setscheduler path, and I see that uses capable(CAP_SYS_NICE). If you prefer gVisor's simplified Setpriority implementation to model that scheduler-side check instead, I can change it.

[ayushr2]

Thanks for the updates! Just nits.

[ayushr2]

Commit title seems incorrect: c427bfec18f2 ("net: core: enable SO_BINDTODEVICE for non-root users")

[ayushr2]

t.HasCapabilityIn(linux.CAP_MKNOD, t.Kernel().RootUserNamespace()) can be simplified to t.HasRootCapability(linux.CAP_MKNOD)

[ayushr2]

switch ft := mode.FileType(); ft {
}

So you can use ft below instead of calling mode.FileType() again.