Add seccheck field to indicate if executed binary is on overlayfs upper layer.

pkg/sentry/fsimpl/overlay/overlay.go

@@ -1003,3 +1003,12 @@ func (fd *fileDescription) RemoveXattr(ctx context.Context, name string) error {
 	defer fs.renameMu.RUnlock()
 	return fs.removeXattrLocked(ctx, fd.dentry(), fd.vfsfd.Mount(), auth.CredentialsFromContext(ctx), name)
 }
+
+// IsCopiedUp returns true if the given vfs.Dentry is an overlayfs dentry that has
+// been copied up to the upper layer.
+func IsCopiedUp(d *vfs.Dentry) bool {
+	if impl, ok := d.Impl().(*dentry); ok {
+		return impl.isCopiedUp()
+	}
+	return false
+}

pkg/sentry/kernel/BUILD

@@ -387,6 +387,7 @@ go_library(
         "//pkg/sentry/fsimpl/lock",
         "//pkg/sentry/fsimpl/mqfs",
         "//pkg/sentry/fsimpl/nsfs",
+        "//pkg/sentry/fsimpl/overlay",
         "//pkg/sentry/fsimpl/pipefs",
         "//pkg/sentry/fsimpl/sockfs",
         "//pkg/sentry/fsimpl/timerfd",

pkg/sentry/kernel/task_exec.go

@@ -72,6 +72,7 @@ import (
 	"gvisor.dev/gvisor/pkg/cleanup"
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/log"
+	overlay "gvisor.dev/gvisor/pkg/sentry/fsimpl/overlay"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sentry/loader"
 	"gvisor.dev/gvisor/pkg/sentry/mm"
@@ -470,6 +471,7 @@ func getExecveSeccheckInfo(t *Task, argv, env []string, executable *vfs.FileDesc
 	if executable != nil {
 		info.BinaryPath = pathname
 		if fields.Local.Contains(seccheck.FieldSentryExecveBinaryInfo) {
+			info.BinaryOverlayfsUpper = overlay.IsCopiedUp(executable.Dentry())
 			statOpts := vfs.StatOptions{
 				Mask: linux.STATX_TYPE | linux.STATX_MODE | linux.STATX_UID | linux.STATX_GID,
 			}

pkg/sentry/seccheck/points/sentry.proto

@@ -59,6 +59,10 @@ message ExecveInfo {
   // Note that this requires reading the entire file into memory, which is
   // likely to be extremely slow.
   bytes binary_sha256 = 8;
+
+  // binary_overlayfs_upper indicates whether the executable binary is on
+  // the upper layer of the overlay filesystem.
+  bool binary_overlayfs_upper = 9;
 }
 
 message ExitNotifyParentInfo {

test/trace/trace_test.go

@@ -428,6 +428,10 @@ func checkSentryExec(msg test.Message) error {
 		return fmt.Errorf("BinarySha256, want: %q, got: %q", got, want)
 	}
 
+	if p.BinaryOverlayfsUpper {
+		return fmt.Errorf("BinaryOverlayfsUpper, want: false, got: true")
+	}
+
 	return nil
 }