{{ message }}
Repository navigation
Connect to host unix sockets with the application's supplementary groups - #16087
Open
copybara-service[bot] wants to merge 1 commit into
Open
copybara-service[bot] wants to merge 1 commit into
copybara-service[bot] wants to merge 1 commit into
Conversation
The gofer connects to a host unix socket on the application's behalf under its effective uid and gid alone, so a socket the application may reach only through a supplementary group, as docker.sock for the docker group, refuses the connect where Linux accepts it. Send the groups in a new ConnectWithGroups message and have the gofer apply them with setgroups(2) on a thread it discards after the connect. The gofer's seccomp filter now admits the call. A user namespace runsc creates for the gofer as root now allows setgroups when host unix sockets are open and runsc's own namespace allows it, since the namespace denies it by default and its ID mappings let the gofer add no group it cannot already take with CAP_SETGID. A gofer without the message keeps the ConnectWithCreds path. The gofer also drops its own supplementary groups at startup when host unix sockets are open and its user namespace allows setgroups, so an application with none connects without that thread. A gofer not permitted to drop them keeps them and does not offer the message. Fixes #14807 FUTURE_COPYBARA_INTEGRATE_REVIEW=#14808 from dany74q:gofer-connect-groups 672ac14 PiperOrigin-RevId: 1003693544
copybara-service
Bot
requested review from
EtiennePerot and
fvoznika
as code owners
October 21, 2026 06:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Connect to host unix sockets with the application's supplementary groups
The gofer connects to a host unix socket on the application's behalf under its
effective uid and gid alone, so a socket the application may reach only through
a supplementary group, as docker.sock for the docker group, refuses the connect
where Linux accepts it.
Send the groups in a new ConnectWithGroups message and have the gofer apply them
with setgroups(2) on a thread it discards after the connect. The gofer's seccomp
filter now admits the call. A user namespace runsc creates for the gofer as root
now allows setgroups when host unix sockets are open and runsc's own namespace
allows it, since the namespace denies it by default and its ID mappings let the
gofer add no group it cannot already take with CAP_SETGID. A gofer without the
message keeps the ConnectWithCreds path.
The gofer also drops its own supplementary groups at startup when host unix
sockets are open and its user namespace allows setgroups, so an application
with none connects without that thread. A gofer not permitted to drop them
keeps them and does not offer the message.
Fixes #14807
FUTURE_COPYBARA_INTEGRATE_REVIEW=#14808 from dany74q:gofer-connect-groups 672ac14