Skip to content

Fix owner leakage on partial chown in overlay#198

Open
doanbaotrung wants to merge 1 commit into
sysprog21:mainfrom
open-sources-port:chown-leaks-owner-id
Open

Fix owner leakage on partial chown in overlay#198
doanbaotrung wants to merge 1 commit into
sysprog21:mainfrom
open-sources-port:chown-leaks-owner-id

Conversation

@doanbaotrung

@doanbaotrung doanbaotrung commented Jul 13, 2026

Copy link
Copy Markdown
Collaborator

When a guest performs a partial chown to modify only the group
(e.g., chown(path, -1, gid)), the overlay allocates a new entry.
However, it previously initialized both e->uid and e->gid to the
physical host's cur_uid and cur_gid. Since new_owner was -1,
e->uid remained the physical host UID (e.g. 501). When guest later
stats the file, the overlay unconditionally applied the physical UID,
corrupting guest permissions.
Solve this by:

  1. Initializing new overlay entries with (uint32_t)-1 for both
    fields to indicate "no override".
  2. Only applying overrides to st_uid/st_gid in stat if the fields
    do not equal the (uint32_t)-1 sentinel.
  3. Checking effective UIDs/GIDs against host values before removing
    redundant entries.

Fix #137

When a guest performs a partial chown to modify only the group
(e.g., chown(path, -1, gid)), the overlay allocates a new entry.
However, it previously initialized both `e->uid` and `e->gid` to the
physical host's `cur_uid` and `cur_gid`. Since `new_owner` was -1,
`e->uid` remained the physical host UID (e.g. 501). When guest later
stats the file, the overlay unconditionally applied the physical UID,
corrupting guest permissions.

Solve this by:
1. Initializing new overlay entries with `(uint32_t)-1` for both
   fields to indicate "no override".
2. Only applying overrides to `st_uid`/`st_gid` in stat if the fields
   do not equal the `(uint32_t)-1` sentinel.
3. Checking effective UIDs/GIDs against host values before removing
   redundant entries.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 1 file

Re-trigger cubic

@jserv jserv requested a review from Max042004 July 13, 2026 07:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Partial chown Leaks Host Owner ID to Guest

1 participant