gofer connects to host unix sockets without the caller's supplementary groups
Author: dany74qCreated Sep 17, 2026Updated Sep 17, 2026
ConnectWithCreds switches the gofer thread to the caller's effective gid and uid before the host connect (runsc/fsgofer/lisafs.go:904, :914) and never sets its supplementary groups, so a sandboxed process whose only right to a host unix socket comes through a supplementary group is refused where Linux connects.
Reproducer# a socket only group 1337 may reach
python3 -c 'import os,socket; s=socket.socket(socket.AF_UNIX); s.bind("/tmp/s"); os.chown("/tmp/s",0,1337); os.chmod("/tmp/s",0o660); s.listen(1)
while True: s.accept()' &
# uid 1000 with supplementary group 1337
setpriv --reuid=1000 --regid=1000 --groups=1337 python3 -c 'import socket; socket.socket(socket.AF_UNIX).connect("/tmp/s"); print("connected")'
connected
runsc --host-uds=open --network=none do setpriv --reuid=1000 --regid=1000 --groups=1337 python3 -c 'import socket; socket.socket(socket.AF_UNIX).connect("/tmp/s"); print("connected")'
ConnectionRefusedError: [Errno 111] Connection refusedProposed fix in #14808.
Source: google/gvisor