@ai-ecoverse/slicc-kernel 1.77.0 → 1.77.1

package/dist/process-worker.js

@@ -3194,6 +3194,22 @@ function cString(memory, at) {
 function baseOf(Fs, dirfd) {
   return dirfd === AT_FDCWD ? Fs.cwd?.() ?? "/" : Fs.getStream?.(dirfd)?.path ?? "/";
 }
+function readonlyRefusal(Fs, memory, call2) {
+  if (!(call2.amode & W_ACCESS)) return 0;
+  try {
+    const name2 = cString(memory, call2.path);
+    const abs = name2.startsWith("/") ? name2 : `${baseOf(Fs, call2.dirfd)}/${name2}`;
+    const follow2 = (call2.flags & AT_SYMLINK_NOFOLLOW) === 0;
+    const { node } = Fs.lookupPath.call(Fs, abs, {
+      follow: follow2
+    });
+    const bridge = node.live ? node.mount.opts.bridge : void 0;
+    const stat = bridge?.stat;
+    return stat?.(liveNodePath(node)).readonly ? -wasiErrno("EROFS") : 0;
+  } catch {
+    return 0;
+  }
+}
 function kernelChecks(Fs, memory, call2) {
   const name2 = cString(memory, call2.path);
   const abs = name2.startsWith("/") ? name2 : `${baseOf(Fs, call2.dirfd)}/${name2}`;
@@ -3207,9 +3223,12 @@ function kernelChecks(Fs, memory, call2) {
 }
 function kernelAccess(imports, fs, memory, glue) {
   wrapImport(imports, "faccessat", glue, (own) => (dirfd, path, amode, flags) => {
-    const rc = own(dirfd, path, amode, flags);
     const Fs = fs();
     const heap = memory();
+    const call2 = { dirfd, path, amode: amode & 7, flags };
+    const refused = Fs?.lookupPath && heap ? readonlyRefusal(Fs, heap, call2) : 0;
+    if (refused !== 0) return refused;
+    const rc = own(dirfd, path, amode, flags);
     if (rc !== 0 || !Fs?.lookupPath || !heap) return rc;
     try {
       return kernelChecks(Fs, heap, { dirfd, path, amode: amode & 7, flags });
@@ -3228,7 +3247,7 @@ function linuxDevices(Fs) {
     }
   }
 }
-var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS, DEVICE_MODES;
+var O_CLOEXEC, FD_CLOEXEC, F_DUPFD, F_GETFD, F_SETFD, F_GETFL, F_DUPFD_CLOEXEC, tracked, IMPORT_NAMES, EBADF, AT_SYMLINK_NOFOLLOW, EMSCRIPTEN_EPERM, O_PATH, LITERALS, UTIME_NOW, UTIME_OMIT, PROT_WRITE, MAP_PRIVATE, MAP_TYPE, O_WRONLY, MAP_ALIGN, DIR_MODE, LINK_MODE, CHAR_DEVICE, O_ACCMODE2, O_CREAT2, field, pinnedRoot, rootKind, NAME, AT_FDCWD, AT_EACCESS, W_ACCESS, DEVICE_MODES;
 var init_process_fds = __esm({
   "src/process/process-fds.ts"() {
     "use strict";
@@ -3287,6 +3306,7 @@ var init_process_fds = __esm({
     NAME = /^[a-z_][a-z0-9_-]*$/i;
     AT_FDCWD = -100;
     AT_EACCESS = 512;
+    W_ACCESS = 2;
     DEVICE_MODES = [
       ["/", 493],
       ["/dev", 493],
@@ -6921,7 +6941,8 @@ var init_wasi_host = __esm({
               if (this.o.fs.owners && amode & 1) throw new WasiError("EACCES");
               return;
             }
-            pathOwned(path, !nofollow);
+            const st = pathOwned(path, !nofollow);
+            if (amode & 2 && st.readonly) throw new WasiError("EROFS");
             if (!this.o.fs.owners) return;
             const kind = flags & AT_EACCESS2 ? "eaccess" : "access";
             this.o.fs.access?.(path, amode & 7, kind, nofollow);