kobako 0.29.0 → 0.30.0

data/crates/kobako-runtime/src/filesystem/{directory/spelling.rs → bind/lookup.rs}

@@ -1,71 +1,81 @@
 //! How a host directory spells a name it holds. A host that folds case or
-//! Unicode form reaches one entry by many names, so a Policy judging the
-//! name as asked would see a spelling the host never stored.
+//! Unicode form reaches one entry by many names, so the runtime keeping a
+//! dentry per name as asked would hold one entry under several.
 //!
 //! macOS answers the stored name for any spelling. Elsewhere a listing
 //! finds the entry by its inode, skipped on a Linux filesystem known to
 //! match names exactly; without an inode, a spelling the listing lacks is
 //! refused.
 
+#[cfg(not(target_os = "macos"))]
 use std::io;
 
 use cap_std::fs::Dir;
 
+use super::{to_error, FilesystemError};
+
 /// The name `parent` stores for the entry `name` reaches, a link reached
-/// as itself, or `None` when nothing is there.
-pub(super) fn stored_name(parent: &Dir, name: &str) -> io::Result<Option<String>> {
+/// as itself; `name` as given when nothing is there.
+pub(super) fn lookup(parent: &Dir, name: &str) -> Result<String, FilesystemError> {
     #[cfg(target_os = "macos")]
     {
-        macos::stored_name(parent, name)
+        macos::lookup(parent, name).map_err(to_error)
     }
     #[cfg(not(target_os = "macos"))]
     {
         #[cfg(target_os = "linux")]
         if linux::matches_exactly(parent) {
-            return match parent.symlink_metadata(name) {
-                Ok(_) => Ok(Some(name.to_string())),
-                Err(err) if err.kind() == io::ErrorKind::NotFound => Ok(None),
-                Err(err) => Err(err),
-            };
+            return Ok(name.to_string());
         }
-        stored_name_by_listing(parent, name)
+        lookup_by_listing(parent, name)
     }
 }
 
 /// The name a listing of `parent` holds for `name`: itself when listed,
-/// else the entry sharing its inode.
+/// else the entry sharing its inode. A spelling the listing lacks and no
+/// inode ties to a listed name is refused as `EACCES`.
 #[cfg(not(target_os = "macos"))]
-fn stored_name_by_listing(parent: &Dir, name: &str) -> io::Result<Option<String>> {
+fn lookup_by_listing(parent: &Dir, name: &str) -> Result<String, FilesystemError> {
     let found = match parent.symlink_metadata(name) {
         Ok(found) => found,
-        Err(err) if err.kind() == io::ErrorKind::NotFound => return Ok(None),
-        Err(err) => return Err(err),
+        Err(err) if err.kind() == io::ErrorKind::NotFound => return Ok(name.to_string()),
+        Err(err) => return Err(to_error(err)),
     };
     let mut names = Vec::new();
-    for entry in parent.entries()? {
-        let entry = entry?;
+    for entry in parent.entries().map_err(to_error)? {
+        let entry = entry.map_err(to_error)?;
         if entry.file_name() == name {
-            return Ok(Some(name.to_string()));
+            return Ok(name.to_string());
         }
         names.push(entry);
     }
-    #[cfg(unix)]
-    {
-        use cap_std::fs::MetadataExt;
-        use std::os::unix::fs::DirEntryExt;
-        for entry in names {
-            if entry.ino() == found.ino() {
-                return entry
-                    .file_name()
-                    .into_string()
-                    .map(Some)
-                    .map_err(|_| io::ErrorKind::InvalidData.into());
-            }
-        }
-    }
-    #[cfg(not(unix))]
-    let _ = (found, names);
-    Err(io::ErrorKind::PermissionDenied.into())
+    stored_by_inode(names, &found)
+}
+
+/// The name among `names` sharing the inode of `found`.
+#[cfg(all(unix, not(target_os = "macos")))]
+fn stored_by_inode(
+    names: Vec<cap_std::fs::DirEntry>,
+    found: &cap_std::fs::Metadata,
+) -> Result<String, FilesystemError> {
+    use cap_std::fs::MetadataExt;
+    use std::os::unix::fs::DirEntryExt;
+    names
+        .into_iter()
+        .find(|entry| entry.ino() == found.ino())
+        .ok_or(FilesystemError::PermissionDenied)?
+        .file_name()
+        .into_string()
+        .map_err(|_| to_error(io::ErrorKind::InvalidData.into()))
+}
+
+/// Without an inode nothing ties a spelling to a listed name.
+#[cfg(not(unix))]
+fn stored_by_inode(
+    _names: Vec<cap_std::fs::DirEntry>,
+    _found: &cap_std::fs::Metadata,
+) -> Result<String, FilesystemError> {
+    Err(FilesystemError::PermissionDenied)
 }
 
 #[cfg(target_os = "macos")]
@@ -85,7 +95,7 @@ mod macos {
         data: [u8; 1024],
     }
 
-    pub(super) fn stored_name(parent: &Dir, name: &str) -> io::Result<Option<String>> {
+    pub(super) fn lookup(parent: &Dir, name: &str) -> io::Result<String> {
         let path = CString::new(name).map_err(|_| io::Error::from(io::ErrorKind::InvalidInput))?;
         let mut request = libc::attrlist {
             bitmapcount: libc::ATTR_BIT_MAP_COUNT,
@@ -119,7 +129,7 @@ mod macos {
         if answered != 0 {
             let err = io::Error::last_os_error();
             return match err.kind() {
-                io::ErrorKind::NotFound => Ok(None),
+                io::ErrorKind::NotFound => Ok(name.to_string()),
                 _ => Err(err),
             };
         }
@@ -129,20 +139,18 @@ mod macos {
             .ok()
             .and_then(|offset| offset.checked_sub(size_of::<libc::attrreference_t>()));
         let len = (reply.name.attr_length as usize).checked_sub(1);
-        let stored = start
+        let stored_name = start
             .zip(len)
             .and_then(|(start, len)| reply.data.get(start..start.checked_add(len)?))
             .ok_or(io::ErrorKind::InvalidData)?;
-        String::from_utf8(stored.to_vec())
-            .map(Some)
-            .map_err(|_| io::ErrorKind::InvalidData.into())
+        String::from_utf8(stored_name.to_vec()).map_err(|_| io::ErrorKind::InvalidData.into())
     }
 }
 
 #[cfg(target_os = "linux")]
 mod linux {
     use cap_std::fs::Dir;
-    use rustix::fs::{fstatfs, ioctl_getflags};
+    use rustix::fs::{fstatfs, ioctl_getflags, openat, Mode, OFlags};
 
     /// The 32-bit magic numbers of filesystems matching names byte for
     /// byte unless a directory is marked to fold case: ext4, Btrfs, tmpfs,
@@ -154,17 +162,51 @@ mod linux {
     /// Linux's `FS_CASEFOLD_FL`.
     const CASEFOLD: u32 = 0x4000_0000;
 
+    /// cap-std holds `parent` for its path alone, which answers no flags,
+    /// so they are asked of the same directory opened to read.
     pub(super) fn matches_exactly(parent: &Dir) -> bool {
         let exact = fstatfs(parent).is_ok_and(|stats| EXACT.contains(&(stats.f_type as u32)));
-        exact && ioctl_getflags(parent).is_ok_and(|flags| flags.bits() & CASEFOLD == 0)
+        exact
+            && openat(
+                parent,
+                ".",
+                OFlags::RDONLY | OFlags::DIRECTORY | OFlags::CLOEXEC,
+                Mode::empty(),
+            )
+            .and_then(|readable| ioctl_getflags(&readable))
+            .is_ok_and(|flags| flags.bits() & CASEFOLD == 0)
     }
 
     #[cfg(test)]
     mod tests {
         use cap_std::ambient_authority;
 
-        use super::super::stored_name_by_listing;
-        use super::Dir;
+        use super::super::lookup_by_listing;
+        use super::{fstatfs, matches_exactly, Dir, EXACT};
+
+        // A Directory opens its directories as cap-std does, for a path
+        // alone, and a filesystem known to match exactly still spells
+        // without listing. A host on another filesystem has nothing here
+        // to witness.
+        // @behavior FS-081
+        #[test]
+        fn a_directory_opened_for_its_path_alone_is_known_to_match_exactly() {
+            let path = std::env::temp_dir().join(format!("kobako-exact-{}", std::process::id()));
+            let _ = std::fs::remove_dir_all(&path);
+            std::fs::create_dir_all(&path).expect("the host directory must be created");
+            let dir = Dir::open_ambient_dir(&path, ambient_authority())
+                .expect("the host directory must open");
+            let known = fstatfs(&dir).is_ok_and(|stats| EXACT.contains(&(stats.f_type as u32)));
+            let exact = matches_exactly(&dir);
+            let _ = std::fs::remove_dir_all(&path);
+            if known {
+                assert!(
+                    exact,
+                    "a directory cap-std opened on a filesystem known to match names exactly, \
+                     asked through matches_exactly, must answer that it matches exactly"
+                );
+            }
+        }
 
         // A Linux host whose filesystem is not known to match exactly,
         // XFS among them, spells by listing; the host here matches
@@ -179,15 +221,15 @@ mod linux {
             let dir = Dir::open_ambient_dir(&path, ambient_authority())
                 .expect("the host directory must open");
             let answers = (
-                stored_name_by_listing(&dir, "file").ok(),
-                stored_name_by_listing(&dir, "missing").ok(),
+                lookup_by_listing(&dir, "file").ok(),
+                lookup_by_listing(&dir, "missing").ok(),
             );
             let _ = std::fs::remove_dir_all(&path);
             assert_eq!(
                 answers,
-                (Some(Some("file".to_string())), Some(None)),
+                (Some("file".to_string()), Some("missing".to_string())),
                 "a name the host holds, spelled by listing its directory, must come back as \
-                 given, and a name it lacks as none"
+                 given, and a name it lacks as given too"
             );
         }
     }

data/crates/kobako-runtime/src/filesystem/bind/walk.rs

@@ -0,0 +1,249 @@
+//! Opening a directory several names beneath one held open, in one call
+//! where the host's kernel confines a path itself: Linux's `openat2` with
+//! `RESOLVE_BENEATH` and `RESOLVE_NO_SYMLINKS`, and from macOS 26
+//! `O_RESOLVE_BENEATH` with `O_NOFOLLOW_ANY`. Elsewhere each name opens in
+//! turn without following a link, which answers the same.
+
+use cap_std::fs::Dir;
+
+use super::{open_dir_nofollow, FilesystemError};
+
+/// The directory `names` reach beneath `dir`, a link on the way refused as
+/// a loop, walked in one call as 9p's `Twalk` walks several names. A path past
+/// what the host takes in one call is no name it refuses, so it goes name by
+/// name, where only a name too long for the host is refused.
+pub(super) fn walk(dir: &Dir, names: &[String]) -> Result<Dir, FilesystemError> {
+    match kernel::walk(dir, names) {
+        None | Some(Err(FilesystemError::InvalidFilename)) => by_name(dir, names),
+        Some(opened) => opened,
+    }
+}
+
+/// Each name opened in turn, the way every host can.
+fn by_name(dir: &Dir, names: &[String]) -> Result<Dir, FilesystemError> {
+    let (first, rest) = names.split_first().ok_or(FilesystemError::InvalidInput)?;
+    rest.iter()
+        .try_fold(open_dir_nofollow(dir, first)?, |dir, name| {
+            open_dir_nofollow(&dir, name)
+        })
+}
+
+/// What the host's errno names, a link on the way being a loop. `names` hold no
+/// `..`, so a path leading out of `dir` is one a move carried out as it was
+/// walked, as `complete_walk` answers EXDEV, and nothing stands there now.
+#[cfg(any(target_os = "linux", target_os = "macos"))]
+fn to_error(errno: i32) -> FilesystemError {
+    const LOOP: i32 = rustix::io::Errno::LOOP.raw_os_error();
+    #[cfg(target_os = "linux")]
+    const LEADS_OUT: i32 = rustix::io::Errno::XDEV.raw_os_error();
+    #[cfg(target_os = "macos")]
+    const LEADS_OUT: i32 = libc::ENOTCAPABLE;
+    match errno {
+        LOOP => FilesystemError::FilesystemLoop,
+        LEADS_OUT => FilesystemError::NotFound,
+        _ => super::to_error(std::io::Error::from_raw_os_error(errno)),
+    }
+}
+
+#[cfg(target_os = "linux")]
+mod kernel {
+    use std::fs::File;
+    use std::sync::atomic::{AtomicBool, Ordering};
+
+    use cap_std::fs::Dir;
+    use rustix::fs::{openat2, Mode, OFlags, ResolveFlags};
+    use rustix::io::Errno;
+
+    use super::{to_error, FilesystemError};
+
+    /// Whether this kernel has `openat2`, which arrived in Linux 5.6.
+    static SUPPORTED: AtomicBool = AtomicBool::new(true);
+
+    /// A directory holds its path alone, as cap-std's own opens do, so one a
+    /// host lets a walk search but not read still opens. `names` hold no `..`,
+    /// the one thing `RESOLVE_BENEATH` asks a caller to retry.
+    pub(super) fn walk(dir: &Dir, names: &[String]) -> Option<Result<Dir, FilesystemError>> {
+        if !SUPPORTED.load(Ordering::Relaxed) {
+            return None;
+        }
+        match openat2(
+            dir,
+            names.join("/"),
+            OFlags::PATH | OFlags::DIRECTORY | OFlags::CLOEXEC,
+            Mode::empty(),
+            ResolveFlags::BENEATH | ResolveFlags::NO_SYMLINKS | ResolveFlags::NO_MAGICLINKS,
+        ) {
+            Ok(fd) => Some(Ok(Dir::from_std_file(File::from(fd)))),
+            Err(Errno::NOSYS) => {
+                SUPPORTED.store(false, Ordering::Relaxed);
+                None
+            }
+            Err(errno) => Some(Err(to_error(errno.raw_os_error()))),
+        }
+    }
+}
+
+#[cfg(target_os = "macos")]
+mod kernel {
+    use std::ffi::CString;
+    use std::fs::File;
+    use std::io;
+    use std::os::fd::{AsRawFd, FromRawFd};
+    use std::sync::OnceLock;
+
+    use cap_std::fs::Dir;
+
+    use super::{to_error, FilesystemError};
+
+    /// `O_RESOLVE_BENEATH` as `sys/fcntl.h` numbers it; the libc crate
+    /// names no such flag for macOS.
+    const O_RESOLVE_BENEATH: libc::c_int = 0x1000;
+
+    /// The first Darwin release of macOS 26, below which an older kernel
+    /// could ignore a flag it does not know and follow a link.
+    const DARWIN_OF_MACOS_26: u32 = 25;
+
+    fn is_supported() -> bool {
+        static SUPPORTED: OnceLock<bool> = OnceLock::new();
+        *SUPPORTED.get_or_init(|| {
+            rustix::system::uname()
+                .release()
+                .to_str()
+                .ok()
+                .and_then(|release| release.split('.').next()?.parse::<u32>().ok())
+                .is_some_and(|major| major >= DARWIN_OF_MACOS_26)
+        })
+    }
+
+    pub(super) fn walk(dir: &Dir, names: &[String]) -> Option<Result<Dir, FilesystemError>> {
+        if !is_supported() {
+            return None;
+        }
+        let Ok(path) = CString::new(names.join("/")) else {
+            return Some(Err(FilesystemError::InvalidInput));
+        };
+        // SAFETY: `path` is a NUL-terminated string that outlives the call,
+        // and `dir` holds its descriptor open across it.
+        let fd = unsafe {
+            libc::openat(
+                dir.as_raw_fd(),
+                path.as_ptr(),
+                libc::O_RDONLY
+                    | libc::O_DIRECTORY
+                    | libc::O_CLOEXEC
+                    | libc::O_NOFOLLOW_ANY
+                    | O_RESOLVE_BENEATH,
+            )
+        };
+        if fd < 0 {
+            let errno = io::Error::last_os_error().raw_os_error().unwrap_or(0);
+            return Some(Err(to_error(errno)));
+        }
+        // SAFETY: `openat` just returned `fd`, which nothing else owns.
+        Some(Ok(Dir::from_std_file(unsafe { File::from_raw_fd(fd) })))
+    }
+}
+
+#[cfg(not(any(target_os = "linux", target_os = "macos")))]
+mod kernel {
+    use cap_std::fs::Dir;
+
+    use super::FilesystemError;
+
+    pub(super) fn walk(_dir: &Dir, _names: &[String]) -> Option<Result<Dir, FilesystemError>> {
+        None
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::fs;
+    use std::path::PathBuf;
+
+    use cap_std::ambient_authority;
+
+    use super::*;
+
+    /// A host tree of the test's own: `a/b/c`, a file `a/file`, and a link
+    /// `a/link` to `b`, removed when it drops.
+    struct Tree(PathBuf);
+
+    impl Tree {
+        fn new(name: &str) -> Self {
+            let path =
+                std::env::temp_dir().join(format!("kobako-beneath-{name}-{}", std::process::id()));
+            let _ = fs::remove_dir_all(&path);
+            fs::create_dir_all(path.join("a/b/c")).expect("the tree must be made");
+            fs::write(path.join("a/file"), "x").expect("the file must be made");
+            #[cfg(unix)]
+            std::os::unix::fs::symlink("b", path.join("a/link")).expect("the link must be made");
+            Self(path)
+        }
+
+        fn dir(&self) -> Dir {
+            Dir::open_ambient_dir(&self.0, ambient_authority()).expect("the tree must open")
+        }
+    }
+
+    impl Drop for Tree {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn names(path: &str) -> Vec<String> {
+        path.split('/').map(str::to_string).collect()
+    }
+
+    /// What `open` answers for `path`, only whether it opened kept.
+    fn answer(
+        open: impl Fn(&Dir, &[String]) -> Result<Dir, FilesystemError>,
+        dir: &Dir,
+        path: &str,
+    ) -> Result<(), FilesystemError> {
+        open(dir, &names(path)).map(drop)
+    }
+
+    // The host's kernel path and the one-name-at-a-time path must answer
+    // alike, since which one runs depends on the host.
+    #[test]
+    fn the_kernel_and_each_name_answer_alike() {
+        let tree = Tree::new("alike");
+        let dir = tree.dir();
+        let mut paths = vec!["a/b/c", "a/missing/c", "a/file/c", "a/file"];
+        if cfg!(unix) {
+            paths.extend(["a/link/c", "a/link"]);
+        }
+        for path in paths {
+            assert_eq!(
+                answer(walk, &dir, path),
+                answer(by_name, &dir, path),
+                "{path} opened beneath a directory by the kernel must answer as each name opened \
+                 in turn answers"
+            );
+        }
+    }
+
+    #[test]
+    fn a_link_on_the_way_is_a_loop() {
+        if !cfg!(unix) {
+            return;
+        }
+        let tree = Tree::new("link");
+        assert_eq!(
+            answer(walk, &tree.dir(), "a/link/c"),
+            Err(FilesystemError::FilesystemLoop),
+            "a/link/c opened beneath a directory, through a link, must be refused as a loop"
+        );
+    }
+
+    #[test]
+    fn a_path_reaches_its_directory() {
+        let tree = Tree::new("reach");
+        let opened = walk(&tree.dir(), &names("a/b")).expect("a/b must open");
+        assert!(
+            opened.open_dir("c").is_ok(),
+            "a/b opened beneath a directory must be the directory holding c"
+        );
+    }
+}