Automated rollback of changelist 798788535

AnilAltinay · gvisor-bot · commit 2f7f776a4464 · 2025-09-05T09:03:06.000-07:00
PiperOrigin-RevId: 803481970
diff --git a/pkg/sentry/socket/hostinet/socket.go b/pkg/sentry/socket/hostinet/socket.go
@@ -24,7 +24,6 @@ import (
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/fdnotifier"
 	"gvisor.dev/gvisor/pkg/log"
-	"gvisor.dev/gvisor/pkg/marshal"
 	"gvisor.dev/gvisor/pkg/marshal/primitive"
 	"gvisor.dev/gvisor/pkg/safemem"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
@@ -829,8 +828,3 @@ func init() {
 		registered[fam] = struct{}{}
 	}
 }
-
-// GetPeerCreds implements socket.Socket.GetPeerCreds
-func (s *Socket) GetPeerCreds(t *kernel.Task) (marshal.Marshallable, *syserr.Error) {
-	return nil, syserr.ErrNotSupported
-}
diff --git a/pkg/sentry/socket/netlink/socket.go b/pkg/sentry/socket/netlink/socket.go
@@ -568,11 +568,6 @@ func (s *Socket) GetPeerName(t *kernel.Task) (linux.SockAddr, uint32, *syserr.Er
 	return sa, uint32(sa.SizeBytes()), nil
 }
 
-// GetPeerCreds implements socket.Socket.GetPeerCreds.
-func (s *Socket) GetPeerCreds(t *kernel.Task) (marshal.Marshallable, *syserr.Error) {
-	return nil, syserr.ErrNotSupported
-}
-
 // RecvMsg implements socket.Socket.RecvMsg.
 func (s *Socket) RecvMsg(t *kernel.Task, dst usermem.IOSequence, flags int, haveDeadline bool, deadline ktime.Time, senderRequested bool, controlDataLen uint64) (int, int, linux.SockAddr, uint32, socket.ControlMessages, *syserr.Error) {
 	from := &linux.SockAddrNetlink{
diff --git a/pkg/sentry/socket/netstack/netstack.go b/pkg/sentry/socket/netstack/netstack.go
@@ -980,7 +980,14 @@ func getSockOptSocket(t *kernel.Task, s socket.Socket, ep commonEndpoint, family
 		if family != linux.AF_UNIX || outLen < unix.SizeofUcred {
 			return nil, syserr.ErrInvalidArgument
 		}
-		return s.GetPeerCreds(t)
+
+		tcred := t.Credentials()
+		creds := linux.ControlMessageCredentials{
+			PID: int32(t.ThreadGroup().ID()),
+			UID: uint32(tcred.EffectiveKUID.In(tcred.UserNamespace).OrOverflow()),
+			GID: uint32(tcred.EffectiveKGID.In(tcred.UserNamespace).OrOverflow()),
+		}
+		return &creds, nil
 
 	case linux.SO_PASSCRED:
 		if outLen < sizeOfInt32 {
@@ -3019,10 +3026,6 @@ func (s *sock) GetPeerName(*kernel.Task) (linux.SockAddr, uint32, *syserr.Error)
 	return a, l, nil
 }
 
-func (s *sock) GetPeerCreds(*kernel.Task) (marshal.Marshallable, *syserr.Error) {
-	return nil, syserr.ErrNotSupported
-}
-
 func (s *sock) fillCmsgInq(cmsg *socket.ControlMessages) {
 	if !s.sockOptInq {
 		return
diff --git a/pkg/sentry/socket/plugin/stack/socket.go b/pkg/sentry/socket/plugin/stack/socket.go
@@ -569,11 +569,6 @@ func (s *socketOperations) GetPeerName(t *kernel.Task) (linux.SockAddr, uint32,
 	return socket.UnmarshalSockAddr(s.family, addr), addrlen, nil
 }
 
-// GetPeerCreds implements socket.Socket.GetPeerCreds.
-func (s *socketOperations) GetPeerCreds(t *kernel.Task) (marshal.Marshallable, *syserr.Error) {
-	return nil, syserr.ErrInvalidEndpointState
-}
-
 // recv is a helper function for doing non-blocking read once.
 // It returns:
 // 1. number of bytes received;
diff --git a/pkg/sentry/socket/socket.go b/pkg/sentry/socket/socket.go
@@ -257,9 +257,6 @@ type Socket interface {
 	// necessarily the actual length of the address.
 	GetPeerName(t *kernel.Task) (addr linux.SockAddr, addrLen uint32, err *syserr.Error)
 
-	// GetPeerCreds returns the peer credentials of the socket.
-	GetPeerCreds(t *kernel.Task) (marshal.Marshallable, *syserr.Error)
-
 	// RecvMsg implements the recvmsg(2) linux unix.
 	//
 	// senderAddrLen is the address length to be returned to the application,
diff --git a/pkg/sentry/socket/unix/BUILD b/pkg/sentry/socket/unix/BUILD
@@ -42,7 +42,6 @@ go_library(
         "//pkg/sentry/fsutil",
         "//pkg/sentry/inet",
         "//pkg/sentry/kernel",
-        "//pkg/sentry/kernel/auth",
         "//pkg/sentry/ktime",
         "//pkg/sentry/socket",
         "//pkg/sentry/socket/control",
diff --git a/pkg/sentry/socket/unix/transport/BUILD b/pkg/sentry/socket/unix/transport/BUILD
@@ -97,7 +97,6 @@ go_library(
         "//pkg/log",
         "//pkg/refs",
         "//pkg/sentry/hostfd",
-        "//pkg/sentry/kernel/auth",
         "//pkg/sentry/uniqueid",
         "//pkg/sync",
         "//pkg/sync/locking",
diff --git a/pkg/sentry/socket/unix/transport/connectioned.go b/pkg/sentry/socket/unix/transport/connectioned.go
@@ -106,14 +106,6 @@ type connectionedEndpoint struct {
 	// tcpip.SockStream.
 	stype linux.SockType
 
-	// peerCreds is used to store the peer credentials.
-	// This will store the socket's own credentials until the connection is
-	// established with connect(2). Once the connection is established, this
-	// will store the peer's credentials. The use of this option is possible
-	// only for connected `AF_UNIX` stream sockets and for `AF_UNIX` stream and
-	// datagram socket pairs created using socketpair(2)
-	peerCreds CredentialsControlMessage
-
 	// acceptedChan is per the TCP endpoint implementation. Note that the
 	// sockets in this channel are _already in the connected state_, and
 	// have another associated connectionedEndpoint.
@@ -282,16 +274,6 @@ func (e *connectionedEndpoint) Close(ctx context.Context) {
 	}
 }
 
-func (e *connectionedEndpoint) swapPeerCreds(ctx context.Context, cend ConnectingEndpoint, ne *connectionedEndpoint) *syserr.Error {
-	ce, ok := cend.(*connectionedEndpoint)
-	if !ok {
-		return syserr.ErrInvalidEndpointState
-	}
-	// Swap peer credentials between the two endpoints.
-	ne.peerCreds, ce.peerCreds = ce.peerCreds, ne.peerCreds
-	return nil
-}
-
 // BidirectionalConnect implements BoundEndpoint.BidirectionalConnect.
 func (e *connectionedEndpoint) BidirectionalConnect(ctx context.Context, ce ConnectingEndpoint, returnConnect func(Receiver, ConnectedEndpoint), opts UnixSocketOpts) *syserr.Error {
 	if ce.Type() != e.stype {
@@ -345,7 +327,6 @@ func (e *connectionedEndpoint) BidirectionalConnect(ctx context.Context, ce Conn
 	ne.ops.SetSendBufferSize(defaultBufferSize, false /* notify */)
 	ne.ops.SetReceiveBufferSize(defaultBufferSize, false /* notify */)
 	ne.SocketOptions().SetPassCred(e.SocketOptions().GetPassCred())
-	ne.peerCreds = e.peerCreds
 
 	readQueue := &queue{ReaderQueue: ce.WaiterQueue(), WriterQueue: ne.Queue, limit: defaultBufferSize}
 	readQueue.InitRefs()
@@ -373,9 +354,6 @@ func (e *connectionedEndpoint) BidirectionalConnect(ctx context.Context, ce Conn
 		}
 		readQueue.IncRef()
 		if e.stype == linux.SOCK_STREAM {
-			if err := e.swapPeerCreds(ctx, ce, ne); err != nil {
-				return err
-			}
 			returnConnect(&streamQueueReceiver{queueReceiver: queueReceiver{readQueue: readQueue}}, connected)
 		} else {
 			returnConnect(&queueReceiver{readQueue: readQueue}, connected)
@@ -677,11 +655,3 @@ func (e *connectionedEndpoint) EventUnregister(we *waiter.Entry) {
 func (e *connectionedEndpoint) GetAcceptConn() bool {
 	return e.Listening()
 }
-
-func (e *connectionedEndpoint) PeerCreds() CredentialsControlMessage {
-	return e.peerCreds
-}
-
-func (e *connectionedEndpoint) SetPeerCreds(creds CredentialsControlMessage) {
-	e.peerCreds = creds
-}
diff --git a/pkg/sentry/socket/unix/transport/connectionless.go b/pkg/sentry/socket/unix/transport/connectionless.go
@@ -158,14 +158,6 @@ func (*connectionlessEndpoint) Accept(context.Context, *Address, UnixSocketOpts)
 	return nil, syserr.ErrNotSupported
 }
 
-func (e *connectionlessEndpoint) PeerCreds() CredentialsControlMessage {
-	return nil
-}
-
-func (e *connectionlessEndpoint) SetPeerCreds(creds CredentialsControlMessage) {
-	// no-op
-}
-
 // Bind binds the connection.
 //
 // For Unix endpoints, this _only sets the address associated with the socket_.
diff --git a/pkg/sentry/socket/unix/transport/unix.go b/pkg/sentry/socket/unix/transport/unix.go
@@ -52,16 +52,6 @@ type CredentialsControlMessage interface {
 	Equals(CredentialsControlMessage) bool
 }
 
-// A PeerCredentialer is a socket or endpoint that supports the SO_PEERCREDS socket
-// option.
-type PeerCredentialer interface {
-	// PeerCreds returns the peer credentials.
-	PeerCreds() CredentialsControlMessage
-
-	// SetPeerCreds sets the peer credentials.
-	SetPeerCreds(creds CredentialsControlMessage)
-}
-
 // A ControlMessages represents a collection of socket control messages.
 //
 // +stateify savable
@@ -161,7 +151,6 @@ type UnixSocketOpts struct {
 // etc. to Unix socket implementations.
 type Endpoint interface {
 	Credentialer
-	PeerCredentialer
 	waiter.Waitable
 
 	// Close puts the endpoint in a closed state and frees all resources
diff --git a/pkg/sentry/socket/unix/unix.go b/pkg/sentry/socket/unix/unix.go
@@ -32,7 +32,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/fsimpl/sockfs"
 	"gvisor.dev/gvisor/pkg/sentry/inet"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
-	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sentry/ktime"
 	"gvisor.dev/gvisor/pkg/sentry/socket"
 	"gvisor.dev/gvisor/pkg/sentry/socket/control"
@@ -423,10 +422,6 @@ func (*provider) Pair(t *kernel.Task, stype linux.SockType, protocol int) (*vfs.
 		ep2.Close(t)
 		return nil, nil, err
 	}
-	// Initialize the peer credentials.
-	creds := control.MakeCreds(t)
-	ep1.SetPeerCreds(creds)
-	ep2.SetPeerCreds(creds)
 
 	return s1, s2, nil
 }
@@ -512,30 +507,6 @@ func (s *Socket) GetPeerName(t *kernel.Task) (linux.SockAddr, uint32, *syserr.Er
 	return a, l, nil
 }
 
-// GetPeerCreds returns the peer credentials of the socket backed by a
-// transport.Endpoint.
-func (s *Socket) GetPeerCreds(t *kernel.Task) (marshal.Marshallable, *syserr.Error) {
-	pCreds := s.ep.PeerCreds()
-	if pCreds == nil {
-		// https://elixir.bootlin.com/linux/v6.16-rc7/source/net/core/sock.c#L1905
-		return &linux.ControlMessageCredentials{
-			PID: 0,
-			UID: auth.NoID,
-			GID: auth.NoID,
-		}, nil
-	}
-	scmCreds, ok := pCreds.(control.SCMCredentials)
-	if !ok {
-		return nil, syserr.ErrInvalidEndpointState
-	}
-	pid, uid, gid := scmCreds.Credentials(t)
-	return &linux.ControlMessageCredentials{
-		PID: int32(pid),
-		UID: uint32(uid),
-		GID: uint32(gid),
-	}, nil
-}
-
 // GetSockName implements the linux syscall getsockname(2) for sockets backed by
 // a transport.Endpoint.
 func (s *Socket) GetSockName(t *kernel.Task) (linux.SockAddr, uint32, *syserr.Error) {
@@ -551,11 +522,7 @@ func (s *Socket) GetSockName(t *kernel.Task) (linux.SockAddr, uint32, *syserr.Er
 // Listen implements the linux syscall listen(2) for sockets backed by
 // a transport.Endpoint.
 func (s *Socket) Listen(t *kernel.Task, backlog int) *syserr.Error {
-	if err := s.ep.Listen(t, backlog); err != nil {
-		return err
-	}
-	s.ep.SetPeerCreds(control.MakeCreds(t))
-	return nil
+	return s.ep.Listen(t, backlog)
 }
 
 // extractEndpoint retrieves the transport.BoundEndpoint associated with a Unix
@@ -614,9 +581,6 @@ func (s *Socket) Connect(t *kernel.Task, sockaddr []byte, blocking bool) *syserr
 	}
 	defer ep.Release(t)
 
-	// Initialize the peer credentials of client endpoint.
-	s.ep.SetPeerCreds(control.MakeCreds(t))
-
 	// Connect the server endpoint.
 	err = s.ep.Connect(t, ep, t.Kernel().UnixSocketOpts)
 
diff --git a/test/syscalls/linux/BUILD b/test/syscalls/linux/BUILD
@@ -394,47 +394,6 @@ cc_binary(
     ],
 )
 
-cc_library(
-    name = "socket_unix_peercred_test_cases",
-    testonly = 1,
-    srcs = [
-        "socket_unix_peercred.cc",
-    ],
-    hdrs = [
-        "socket_unix_peercred.h",
-    ],
-    deps = select_gtest() + [
-        "//test/util:capability_util",
-        "//test/util:cleanup",
-        "//test/util:eventfd_util",
-        "//test/util:file_descriptor",
-        "//test/util:fs_util",
-        "//test/util:logging",
-        "//test/util:memory_util",
-        "//test/util:mount_util",
-        "//test/util:multiprocess_util",
-        "//test/util:posix_error",
-        "//test/util:proc_util",
-        "//test/util:save_util",
-        "//test/util:socket_util",
-        "//test/util:temp_path",
-        "//test/util:test_util",
-        "//test/util:thread_util",
-        "//test/util:time_util",
-        "//test/util:timer_util",
-        "@com_google_absl//absl/algorithm:container",
-        "@com_google_absl//absl/container:btree",
-        "@com_google_absl//absl/container:flat_hash_set",
-        "@com_google_absl//absl/container:node_hash_set",
-        "@com_google_absl//absl/flags:flag",
-        "@com_google_absl//absl/strings",
-        "@com_google_absl//absl/strings:str_format",
-        "@com_google_absl//absl/synchronization",
-        "@com_google_absl//absl/time",
-    ],
-    alwayslink = 1,
-)
-
 cc_binary(
     name = "chdir_test",
     testonly = 1,
@@ -3958,7 +3917,6 @@ cc_binary(
     malloc = "//test/util:errno_safe_allocator",
     deps = select_gtest() + [
         ":socket_unix_cmsg_test_cases",
-        ":socket_unix_peercred_test_cases",
         ":socket_unix_test_cases",
         ":unix_domain_socket_test_util",
         "//test/util:socket_util",
diff --git a/test/syscalls/linux/socket_unix_pair.cc b/test/syscalls/linux/socket_unix_pair.cc
@@ -16,7 +16,6 @@
 
 #include "test/syscalls/linux/socket_unix.h"
 #include "test/syscalls/linux/socket_unix_cmsg.h"
-#include "test/syscalls/linux/socket_unix_peercred.h"
 #include "test/syscalls/linux/unix_domain_socket_test_util.h"
 #include "test/util/socket_util.h"
 #include "test/util/test_util.h"
@@ -40,10 +39,6 @@ INSTANTIATE_TEST_SUITE_P(
     AllUnixDomainSockets, UnixSocketPairCmsgTest,
     ::testing::ValuesIn(IncludeReversals(GetSocketPairs())));
 
-INSTANTIATE_TEST_SUITE_P(
-    AllUnixDomainSockets, UnixSocketPeerCredTest,
-    ::testing::ValuesIn(IncludeReversals(GetSocketPairs())));
-
 }  // namespace
 }  // namespace testing
 }  // namespace gvisor
diff --git a/test/syscalls/linux/socket_unix_peercred.cc b/test/syscalls/linux/socket_unix_peercred.cc
diff --git a/test/syscalls/linux/socket_unix_peercred.h b/test/syscalls/linux/socket_unix_peercred.h
