Skip to content

Correct mempolicy syscalls and add setfs{uid,gid}#92

Merged
jserv merged 1 commit into
mainfrom
setfsuid
Jun 10, 2026
Merged

Correct mempolicy syscalls and add setfs{uid,gid}#92
jserv merged 1 commit into
mainfrom
setfsuid

Conversation

@jserv

@jserv jserv commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Dispatch table is generated from abi.h, so a wrong SYS_* number silently routes a handler to the wrong slot. SYS_get_mempolicy was defined as 239 and SYS_set_mempolicy as 238; the asm-generic numbers are 236 and 237. Guest calls to the real 236/237 fell through to unimplemented-syscall warning, while real 238/239 (migrate_pages, move_pages) silently invoked the misplaced mempolicy handlers: get_mempolicy on slot 239 wrote to whatever pointers the move_pages caller had loaded into x0/x1.

setfsuid (151) and setfsgid (152) were never wired. procps brackets its /proc walks with setfsuid(uid) / setfsuid(0), so ps and top warned twice on every refresh. Linux returns the previous fs{uid,gid} from these calls; elfuse does not track fsuid separately from euid, so the stub returns proc_get_{euid,egid}() and ignores the argument. procps observes a stable cred snapshot on both brackets, which is what its access-bracketing pattern needs. The glibc query idiom setfsuid(-1) also reports the current euid, so permission-validation callers (setfsuid(target); setfsuid(-1) != target) still detect a failed transition correctly.

The cred fields in proc-identity.c are _Atomic uint32_t, so unbracketed read in the stub is word-tear safe and matches the existing sc_geteuid pattern; CRED_BRACKETED is reserved for mutating syscalls that need to raise ATTN_BIT_CRED for sibling vCPUs.


Summary by cubic

Corrected mempolicy syscall numbers and wired setfsuid/setfsgid. This fixes wrong syscall dispatch and removes ps/top warnings during /proc walks.

  • Bug Fixes

    • Set mempolicy numbers to 236/237 in abi.h and dispatch; real 236/237 now handled, and 238/239 no longer hit the wrong handlers.
    • Updated tests to use the correct numbers.
  • New Features

    • Added setfsuid/setfsgid stubs that return current euid/egid without changing state; supports the -1 query idiom.
    • Wired the syscalls in dispatch.tbl and added credential tests; procps /proc walks now see a stable snapshot and stop warning.

Written for commit faefa45. Summary will update on new commits.

Review in cubic

cubic-dev-ai[bot]

This comment was marked as resolved.

Dispatch table is generated from abi.h, so a wrong SYS_* number silently
routes a handler to the wrong slot. SYS_get_mempolicy was defined as 239
and SYS_set_mempolicy as 238; the asm-generic numbers are 236 and 237.
Guest calls to the real 236/237 fell through to unimplemented-syscall
warning, while real 238/239 (migrate_pages, move_pages) silently invoked
the misplaced mempolicy handlers: get_mempolicy on slot 239 wrote to
whatever pointers the move_pages caller had loaded into x0/x1.

setfsuid (151) and setfsgid (152) were never wired. procps brackets its
/proc walks with setfsuid(uid) / setfsuid(0), so ps and top warned twice
on every refresh. Linux returns the previous fs{uid,gid} from these
calls; elfuse does not track fsuid separately from euid, so the stub
returns proc_get_{euid,egid}() and ignores the argument. procps observes
a stable cred snapshot on both brackets, which is what its
access-bracketing pattern needs. The glibc query idiom setfsuid(-1) also
reports the current euid, so permission-validation callers
(setfsuid(target); setfsuid(-1) != target) still detect a failed
transition correctly.

The cred fields in proc-identity.c are _Atomic uint32_t, so unbracketed
read in the stub is word-tear safe and matches the existing sc_geteuid
pattern; CRED_BRACKETED is reserved for mutating syscalls that need to
raise ATTN_BIT_CRED for sibling vCPUs.
@jserv jserv merged commit c69663d into main Jun 10, 2026
4 checks passed
@jserv jserv deleted the setfsuid branch June 10, 2026 05:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant