@zenfs/core 2.7.6 → 2.7.7

package/scripts/make-index.js

@@ -94,7 +94,7 @@ function computeEntries(path) {
 		else if (!seenDevs.has(stats.dev))
 			if (options.xdev) {
 				console.warn(
-					`${styleText('yellowBright', `--xdev: Adding entries from device ${stats.dev} (${path}). You may get duplicate inos which MUST be de-duplicated manually.`)}`
+					`${styleText('yellowBright', `--xdev: Adding entries from device ${stats.dev} (${path}). You may get duplicate inos which MUST be de-duplicated manually.`)}`,
 				);
 				seenDevs.add(stats.dev);
 			} else {

package/tests/common/async.test.ts

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+import { Async, InMemory, InMemoryStore, StoreFS } from '@zenfs/core';
+import assert from 'node:assert/strict';
+import { suite, test } from 'node:test';
+
+class AsyncMemory extends Async(StoreFS) {
+	_sync = InMemory.create({ label: 'sync' });
+}
+
+suite('Async()', () => {
+	test('sync operations are applied to the sync cache once', async () => {
+		const fs = new AsyncMemory(new InMemoryStore());
+		fs.checkRootSync();
+		await fs.ready();
+
+		const calls: string[] = [];
+		for (const key of ['mkdirSync', 'rmdirSync', 'createFileSync', 'unlinkSync'] as const) {
+			const original = (fs._sync[key] as (...args: unknown[]) => unknown).bind(fs._sync);
+			(fs._sync as any)[key] = (...args: unknown[]) => {
+				calls.push(key);
+				return original(...args);
+			};
+		}
+
+		const options = { mode: 0o755, uid: 0, gid: 0 };
+		fs.mkdirSync('/dir', options);
+		fs.rmdirSync('/dir');
+		fs.createFileSync('/file', options);
+		fs.unlinkSync('/file');
+		await new Promise(resolve => setTimeout(resolve));
+
+		assert.deepEqual(calls, ['mkdirSync', 'rmdirSync', 'createFileSync', 'unlinkSync']);
+		assert.deepEqual(await fs.readdir('/'), []);
+	});
+});

package/tests/common/config.test.ts

@@ -43,7 +43,7 @@ suite('Sync configuration', () => {
 				configureSync({
 					mounts: { '/': { backend: AsyncBackend } },
 				}),
-			{ errno: Errno.EAGAIN }
+			{ errno: Errno.EAGAIN },
 		);
 	});
 

package/tests/common/file_index.test.ts

@@ -45,7 +45,7 @@ suite('Index', () => {
 		const index = buildIndex(60_000);
 		assert.equal(
 			atDepth(1000, () => index._alloc()),
-			120_002
+			120_002,
 		);
 	});
 });

package/tests/common/mounts.test.ts

@@ -19,6 +19,18 @@ suite('Mounts', () => {
 		fs.rmSync('/nested', { recursive: true, force: true });
 	});
 
+	test('lstat of a mount point is the mounted root #326', async () => {
+		await configure({ mounts: { '/mounted': InMemory } });
+
+		await fs.promises.utimes('/mounted', 1, 1);
+		assert.equal(fs.statSync('/mounted').mtimeMs, 1000);
+		assert.equal(fs.lstatSync('/mounted').mtimeMs, 1000);
+		assert.equal((await fs.promises.lstat('/mounted')).mtimeMs, 1000);
+
+		fs.umount('/mounted');
+		fs.rmdirSync('/mounted');
+	});
+
 	test('Race conditions', async () => {
 		await configure({
 			mounts: {

package/tests/common/vcache.test.ts

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+import { InMemory } from '@zenfs/core';
+import { withExceptionContext } from '@zenfs/core/internal/error';
+import { cacheOf } from '@zenfs/core/vfs/vcache';
+import assert from 'node:assert/strict';
+import { suite, test } from 'node:test';
+
+suite('VCache', () => {
+	test('does not keep the exception context of the first caller', () => {
+		const fs = InMemory.create({ label: 'vcache' });
+		assert.equal(cacheOf(withExceptionContext(fs, { path: '/first' })).fs, fs);
+	});
+});

package/tests/fs/concurrency.test.ts

@@ -67,7 +67,7 @@ suite('Concurrency', config('write', 'async'), () => {
 			const rejected = results.filter(r => r.status === 'rejected');
 			assert.deepEqual(
 				rejected.map(r => r.reason.code ?? r.reason.message),
-				[]
+				[],
 			);
 
 			assert.equal(await fs.promises.readFile('/issue-303.txt', 'utf8'), contents);
@@ -96,7 +96,7 @@ suite('Concurrency', config('write', 'async'), () => {
 		const rejected = results.filter(r => r.status == 'rejected');
 		assert.deepEqual(
 			rejected.map(r => r.reason.code ?? r.reason.message),
-			[]
+			[],
 		);
 
 		for (const path of paths) assert((await fs.promises.stat(path)).isDirectory());
@@ -107,7 +107,7 @@ suite('Concurrency', config('write', 'async'), () => {
 
 		assert.deepEqual(
 			results.filter(result => result !== undefined),
-			['/308-same']
+			['/308-same'],
 		);
 	});
 });

package/tests/fs/links.test.ts

@@ -18,6 +18,16 @@ suite('Links', config('symlinks'), () => {
 		assert(stats.isSymbolicLink());
 	});
 
+	test('symlinks have mode 0o777 #326', async () => {
+		assert.equal((await fs.promises.lstat(symlink)).mode & 0o7777, 0o777);
+
+		fs.symlinkSync(target, 'symlink-sync.js');
+		const stats = fs.lstatSync('symlink-sync.js');
+		assert(stats.isSymbolicLink());
+		assert.equal(stats.mode & 0o7777, 0o777);
+		fs.unlinkSync('symlink-sync.js');
+	});
+
 	test('lstat file inside symlinked directory #241', async () => {
 		await fs.promises.mkdir('/a');
 		await fs.promises.writeFile('/a/hello.txt', 'hello world');
@@ -187,6 +197,72 @@ suite('Links', config('symlinks'), () => {
 		assert(fs.lstatSync('/wfS-dangling').isSymbolicLink());
 	});
 
+	test('operations follow symlinks in parent directories', config('async'), async () => {
+		await fs.promises.mkdir('/parent-real');
+		await fs.promises.symlink('/parent-real', '/parent-link');
+		await fs.promises.writeFile('/parent-real/unlink', 'x');
+		await fs.promises.writeFile('/parent-real/rename', 'x');
+		await fs.promises.mkdir('/parent-real/rmdir');
+		await fs.promises.symlink('/parent-real/renamed', '/parent-real/symlink');
+		await fs.promises.symlink('/parent-real/rmdir', '/parent-real/dir-link');
+
+		await fs.promises.unlink('/parent-link/unlink');
+		await fs.promises.rename('/parent-link/rename', '/parent-link/renamed');
+		assert.equal(await fs.promises.readlink('/parent-link/symlink'), '/parent-real/renamed');
+		await fs.promises.lutimes('/parent-link/symlink', 1, 1);
+		assert.equal((await fs.promises.lstat('/parent-real/symlink')).mtimeMs, 1000);
+
+		await assert.rejects(fs.promises.rmdir('/parent-link/dir-link'), { code: 'ENOTDIR' });
+		await fs.promises.unlink('/parent-link/dir-link');
+		await fs.promises.rmdir('/parent-link/rmdir');
+
+		assert.deepEqual((await fs.promises.readdir('/parent-real')).sort(), ['renamed', 'symlink']);
+	});
+
+	test('operations follow symlinks in parent directories (sync)', config('sync'), () => {
+		fs.mkdirSync('/parentS-real');
+		fs.symlinkSync('/parentS-real', '/parentS-link');
+		fs.writeFileSync('/parentS-real/unlink', 'x');
+		fs.writeFileSync('/parentS-real/rename', 'x');
+		fs.mkdirSync('/parentS-real/rmdir');
+		fs.symlinkSync('/parentS-real/renamed', '/parentS-real/symlink');
+		fs.symlinkSync('/parentS-real/rmdir', '/parentS-real/dir-link');
+
+		fs.unlinkSync('/parentS-link/unlink');
+		fs.renameSync('/parentS-link/rename', '/parentS-link/renamed');
+		assert.equal(fs.readlinkSync('/parentS-link/symlink'), '/parentS-real/renamed');
+		fs.lutimesSync('/parentS-link/symlink', 1, 1);
+		assert.equal(fs.lstatSync('/parentS-real/symlink').mtimeMs, 1000);
+
+		assert.throws(() => fs.rmdirSync('/parentS-link/dir-link'), { code: 'ENOTDIR' });
+		fs.unlinkSync('/parentS-link/dir-link');
+		fs.rmdirSync('/parentS-link/rmdir');
+
+		assert.deepEqual(fs.readdirSync('/parentS-real').sort(), ['renamed', 'symlink']);
+	});
+
+	test('link follows symlinks in parent directories', config('links'), async () => {
+		await fs.promises.link('/parent-link/renamed', '/parent-link/hard');
+		assert.equal(await fs.promises.readFile('/parent-real/hard', 'utf8'), 'x');
+		fs.linkSync('/parentS-link/renamed', '/parentS-link/hard');
+		assert.equal(fs.readFileSync('/parentS-real/hard', 'utf8'), 'x');
+	});
+
+	test('xattr follows symlinks unless noFollow is set', config('xattr'), async () => {
+		await fs.xattr.set('/parent-link/renamed', 'user.parent', 'async');
+		assert.equal(await fs.xattr.get('/parent-real/renamed', 'user.parent', { encoding: 'utf8' }), 'async');
+		fs.xattr.setSync('/parentS-link/renamed', 'user.parent', 'sync');
+		assert.equal(fs.xattr.getSync('/parentS-real/renamed', 'user.parent', { encoding: 'utf8' }), 'sync');
+
+		await fs.xattr.set('/parent-link/symlink', 'user.link', 'on link', { noFollow: true });
+		assert.equal(await fs.xattr.get('/parent-real/symlink', 'user.link', { encoding: 'utf8', noFollow: true }), 'on link');
+		await assert.rejects(fs.xattr.get('/parent-real/renamed', 'user.link'), { code: 'ENODATA' });
+		assert.deepEqual(await fs.xattr.list('/parent-link/symlink'), ['user.parent']);
+
+		await fs.xattr.remove('/parent-link/renamed', 'user.parent');
+		assert.deepEqual(fs.xattr.listSync('/parent-real/renamed'), []);
+	});
+
 	test('cp preserves a symlink by default #304', async () => {
 		await fs.promises.mkdir('/cp-src');
 		await fs.promises.writeFile('/cp-src/real.txt', 'contents');

package/tests/fs/permissions.test.ts

@@ -1,8 +1,10 @@
 // SPDX-License-Identifier: LGPL-3.0-or-later
+import { bindContext, fs as rootFS } from '@zenfs/core';
 import { R_OK, W_OK, X_OK } from '@zenfs/core/constants';
 import { defaultContext } from '@zenfs/core/internal/contexts';
 import { hasAccess } from '@zenfs/core/internal/inode';
 import { join } from '@zenfs/core/path';
+import * as vfsConfig from '@zenfs/core/vfs/config';
 import type { Exception } from 'kerium';
 import assert from 'node:assert/strict';
 import { suite, test } from 'node:test';
@@ -84,6 +86,236 @@ suite('Permissions', config('permissions'), () => {
 		assert(hasAccess(defaultContext, stats, W_OK));
 	}
 
+	test('unprivileged users can read files they do not own #326', async () => {
+		await rootFS.promises.writeFile('/root-owned.txt', 'shared', { mode: 0o644 });
+		const user = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+
+		assert.equal(user.fs.readFileSync('/root-owned.txt', 'utf8'), 'shared');
+		assert.equal(await user.fs.promises.readFile('/root-owned.txt', 'utf8'), 'shared');
+
+		assert.throws(() => user.fs.writeFileSync('/root-owned.txt', 'nope'), { code: 'EACCES' });
+		await assert.rejects(user.fs.promises.writeFile('/root-owned.txt', 'nope'), { code: 'EACCES' });
+	});
+
+	test('access checks follow Linux #326', () => {
+		const as = (uid: number, gid: number, euid = uid, egid = gid, groups: number[] = []) =>
+			bindContext({ credentials: { uid, gid, euid, egid, groups } });
+		const file = (mode: number, uid = 1000, gid = 1000) => ({ mode: 0o100000 | mode, uid, gid });
+
+		assert(!hasAccess(as(1000, 0), file(0o600, 0, 0), R_OK));
+		assert(hasAccess(as(0, 1000), file(0o000, 5, 5), R_OK | W_OK));
+
+		assert(hasAccess(as(1000, 1000, 2000, 1000), file(0o600, 2000, 5), R_OK | W_OK));
+		assert(!hasAccess(as(2000, 1000, 1000, 1000), file(0o600, 2000, 5), R_OK));
+		assert(!hasAccess(as(1000, 0, 1000, 1000), file(0o060, 2000, 0), R_OK));
+
+		assert(!hasAccess(as(1000, 1000), file(0o077), R_OK));
+		assert(!hasAccess(as(1000, 1000), file(0o407, 2000), R_OK));
+		assert(hasAccess(as(1000, 3000), file(0o004, 2000, 2000), R_OK));
+		assert(hasAccess(as(1000, 3000, 1000, 3000, [2000]), file(0o040, 2000, 2000), R_OK));
+		assert(hasAccess(as(1000, 2000), file(0o021, 0, 2000), W_OK));
+		assert(!hasAccess(as(1000, 2000), file(0o021, 0, 2000), X_OK));
+	});
+
+	test('stat needs no permission on the file itself #326', async () => {
+		await rootFS.promises.writeFile('/secret-stat.txt', 'x', { mode: 0o000 });
+		const user = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+
+		assert.equal(user.fs.statSync('/secret-stat.txt').size, 1);
+		assert.equal((await user.fs.promises.lstat('/secret-stat.txt')).size, 1);
+		assert.throws(() => user.fs.readFileSync('/secret-stat.txt'), { code: 'EACCES' });
+	});
+
+	test('removing an entry needs write and search permission on its parent #326', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+
+		await rootFS.promises.mkdir('/removal-root', { mode: 0o755 });
+		await rootFS.promises.writeFile('/removal-root/file', 'x', { mode: 0o666 });
+		await rootFS.promises.mkdir('/removal-root/dir', { mode: 0o777 });
+		await rootFS.promises.mkdir('/removal-own', { mode: 0o755 });
+		await rootFS.promises.lchown('/removal-own', 1000, 1000);
+		await rootFS.promises.writeFile('/removal-own/readonly', 'x', { mode: 0o444 });
+		await rootFS.promises.mkdir('/removal-own/readonly-dir', { mode: 0o555 });
+		await rootFS.promises.mkdir('/removal-unreadable', { mode: 0o300 });
+		await rootFS.promises.lchown('/removal-unreadable', 1000, 1000);
+		await rootFS.promises.writeFile('/removal-unreadable/file', 'x');
+
+		await assert.rejects(alice.fs.promises.unlink('/removal-root/file'), { code: 'EACCES' });
+		assert.throws(() => alice.fs.unlinkSync('/removal-root/file'), { code: 'EACCES' });
+		await assert.rejects(alice.fs.promises.rmdir('/removal-root/dir'), { code: 'EACCES' });
+		assert.throws(() => alice.fs.rmdirSync('/removal-root/dir'), { code: 'EACCES' });
+		assert.throws(() => alice.fs.renameSync('/removal-root/file', '/removal-own/file'), { code: 'EACCES' });
+		await assert.rejects(alice.fs.promises.rename('/removal-own/readonly', '/removal-root/file'), { code: 'EACCES' });
+
+		await alice.fs.promises.unlink('/removal-own/readonly');
+		alice.fs.rmdirSync('/removal-own/readonly-dir');
+		assert.deepEqual(rootFS.readdirSync('/removal-own'), []);
+
+		await alice.fs.promises.rename('/removal-unreadable/file', '/removal-unreadable/renamed');
+		alice.fs.renameSync('/removal-unreadable/renamed', '/removal-unreadable/file');
+	});
+
+	test('sticky directories only let owners remove entries #326', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+		const bob = bindContext({ credentials: { uid: 2000, gid: 2000 } });
+
+		await rootFS.promises.mkdir('/sticky', { mode: 0o1777 });
+		await alice.fs.promises.writeFile('/sticky/alice', 'a', { mode: 0o666 });
+		await alice.fs.promises.mkdir('/sticky/alice-dir', { mode: 0o777 });
+		await bob.fs.promises.writeFile('/sticky/bob', 'b');
+
+		await assert.rejects(bob.fs.promises.unlink('/sticky/alice'), { code: 'EPERM' });
+		assert.throws(() => bob.fs.unlinkSync('/sticky/alice'), { code: 'EPERM' });
+		await assert.rejects(bob.fs.promises.rmdir('/sticky/alice-dir'), { code: 'EPERM' });
+		assert.throws(() => bob.fs.rmdirSync('/sticky/alice-dir'), { code: 'EPERM' });
+		assert.throws(() => bob.fs.renameSync('/sticky/alice', '/sticky/stolen'), { code: 'EPERM' });
+		await assert.rejects(alice.fs.promises.rename('/sticky/alice', '/sticky/bob'), { code: 'EPERM' });
+
+		await alice.fs.promises.unlink('/sticky/alice');
+		alice.fs.rmdirSync('/sticky/alice-dir');
+		await rootFS.promises.unlink('/sticky/bob');
+		assert.deepEqual(rootFS.readdirSync('/sticky'), []);
+
+		await rootFS.promises.mkdir('/sticky-alice', { mode: 0o1777 });
+		await rootFS.promises.lchown('/sticky-alice', 1000, 1000);
+		await bob.fs.promises.writeFile('/sticky-alice/bob', 'b');
+		await alice.fs.promises.unlink('/sticky-alice/bob');
+	});
+
+	test('only owners may change the mode, owner, or times of a file #326', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000, groups: [3000] } });
+		const bob = bindContext({ credentials: { uid: 2000, gid: 2000 } });
+
+		await rootFS.promises.writeFile('/owned', 'x', { mode: 0o666 });
+		rootFS.chownSync('/owned', 1000, 1000);
+
+		assert.throws(() => bob.fs.chmodSync('/owned', 0o600), { code: 'EPERM' });
+		await assert.rejects(bob.fs.promises.chmod('/owned', 0o600), { code: 'EPERM' });
+		assert.throws(() => bob.fs.utimesSync('/owned', 1, 2), { code: 'EPERM' });
+		await assert.rejects(bob.fs.promises.utimes('/owned', 1, 2), { code: 'EPERM' });
+		assert.throws(() => bob.fs.chownSync('/owned', -1, 2000), { code: 'EPERM' });
+		assert.throws(() => bob.fs.chownSync('/owned', 1000, -1), { code: 'EPERM' });
+		bob.fs.chownSync('/owned', -1, -1);
+
+		alice.fs.chmodSync('/owned', 0o644);
+		await alice.fs.promises.utimes('/owned', 1, 2);
+		alice.fs.chownSync('/owned', -1, 3000);
+		await alice.fs.promises.chown('/owned', 1000, 1000);
+		assert.throws(() => alice.fs.chownSync('/owned', -1, 4000), { code: 'EPERM' });
+		assert.throws(() => alice.fs.chownSync('/owned', 2000, -1), { code: 'EPERM' });
+
+		rootFS.chownSync('/owned', 2000, 2000);
+		const stats = rootFS.statSync('/owned');
+		assert.equal(stats.mode & 0o777, 0o644);
+		assert.equal(stats.mtimeMs, 2000);
+		assert.equal(stats.uid, 2000);
+	});
+
+	test('moving a directory to another parent needs write permission on it', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+
+		await rootFS.promises.mkdir('/move-a', { mode: 0o777 });
+		await rootFS.promises.mkdir('/move-b', { mode: 0o777 });
+		await rootFS.promises.mkdir('/move-a/dir', { mode: 0o755 });
+		await rootFS.promises.writeFile('/move-a/file', 'x', { mode: 0o644 });
+
+		assert.throws(() => alice.fs.renameSync('/move-a/dir', '/move-b/dir'), { code: 'EACCES' });
+		await assert.rejects(alice.fs.promises.rename('/move-a/dir', '/move-b/dir'), { code: 'EACCES' });
+		await alice.fs.promises.rename('/move-a/dir', '/move-a/renamed');
+		await alice.fs.promises.rename('/move-a/file', '/move-b/file');
+	});
+
+	test('chmod and chown clear setuid and setgid like Linux', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000, groups: [3000] } });
+		const modeOf = (path: string) => rootFS.statSync(path).mode & 0o7777;
+
+		await rootFS.promises.mkdir('/sid', { mode: 0o777 });
+		await alice.fs.promises.writeFile('/sid/file', 'x');
+		await alice.fs.promises.mkdir('/sid/dir');
+
+		alice.fs.chmodSync('/sid/file', 0o6755);
+		assert.equal(modeOf('/sid/file'), 0o6755);
+		alice.fs.chownSync('/sid/file', -1, -1);
+		assert.equal(modeOf('/sid/file'), 0o755);
+
+		alice.fs.chmodSync('/sid/file', 0o2745);
+		alice.fs.chownSync('/sid/file', -1, 3000);
+		assert.equal(modeOf('/sid/file'), 0o2745);
+
+		rootFS.chmodSync('/sid/file', 0o4755);
+		rootFS.chownSync('/sid/file', 1000, 0);
+		assert.equal(modeOf('/sid/file'), 0o755);
+
+		alice.fs.chmodSync('/sid/file', 0o2755);
+		assert.equal(modeOf('/sid/file'), 0o755);
+
+		await alice.fs.promises.lchmod('/sid/dir', 0o6755);
+		await alice.fs.promises.lchown('/sid/dir', -1, -1);
+		assert.equal(modeOf('/sid/dir'), 0o6755);
+	});
+
+	test('access checks see unsynced changes to an open file', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+
+		await rootFS.promises.writeFile('/unsynced', 'x', { mode: 0o644 });
+		const fd = rootFS.openSync('/unsynced', 'r');
+		rootFS.fchmodSync(fd, 0o600);
+
+		assert.throws(() => alice.fs.readFileSync('/unsynced'), { code: 'EACCES' });
+		await assert.rejects(alice.fs.promises.readFile('/unsynced'), { code: 'EACCES' });
+		rootFS.closeSync(fd);
+	});
+
+	test('reaching a path needs search permission on every directory leading to it #326', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+		const bob = bindContext({ credentials: { uid: 2000, gid: 2000 } });
+
+		await rootFS.promises.mkdir('/private', { mode: 0o700 });
+		await rootFS.promises.lchown('/private', 1000, 1000);
+		await rootFS.promises.mkdir('/private/inner', { mode: 0o755 });
+		await rootFS.promises.writeFile('/private/inner/readable.txt', 'secret', { mode: 0o644 });
+		await rootFS.promises.symlink('/private', '/private-link');
+		await rootFS.promises.mkdir('/search-only', { mode: 0o711 });
+		await rootFS.promises.writeFile('/search-only/known.txt', 'known', { mode: 0o644 });
+		await rootFS.promises.mkdir('/no-search', { mode: 0o722 });
+
+		assert.throws(() => bob.fs.readFileSync('/private-link/inner/readable.txt'), { code: 'EACCES' });
+		await assert.rejects(bob.fs.promises.readFile('/private-link/inner/readable.txt'), { code: 'EACCES' });
+		assert.throws(() => bob.fs.lstatSync('/private/inner'), { code: 'EACCES' });
+		assert.throws(() => bob.fs.mkdirSync('/no-search/dir'), { code: 'EACCES' });
+		assert.throws(() => bob.fs.writeFileSync('/no-search/file', 'x'), { code: 'EACCES' });
+
+		const { checkAccess, resolveFullWalk } = vfsConfig;
+		vfsConfig._setVFSConfig({ checkAccess, resolveFullWalk: true });
+		try {
+			assert.equal(alice.fs.readFileSync('/private/inner/readable.txt', 'utf8'), 'secret');
+			assert.equal(rootFS.readFileSync('/private/inner/readable.txt', 'utf8'), 'secret');
+
+			assert.throws(() => bob.fs.readFileSync('/private/inner/readable.txt'), { code: 'EACCES' });
+			await assert.rejects(bob.fs.promises.readFile('/private/inner/readable.txt'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.statSync('/private/inner/readable.txt'), { code: 'EACCES' });
+			await assert.rejects(bob.fs.promises.stat('/private/inner/readable.txt'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.readdirSync('/private/inner'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.writeFileSync('/private/inner/new.txt', 'x'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.unlinkSync('/private/inner/readable.txt'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.mkdirSync('/private/inner/dir'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.renameSync('/private/inner/readable.txt', '/stolen.txt'), { code: 'EACCES' });
+			assert(rootFS.existsSync('/private/inner/readable.txt'));
+
+			assert.equal(bob.fs.statSync('/private').mode & 0o777, 0o700);
+			assert.throws(() => bob.fs.readdirSync('/private'), { code: 'EACCES' });
+
+			assert.equal(bob.fs.readFileSync('/search-only/known.txt', 'utf8'), 'known');
+			assert.throws(() => bob.fs.readdirSync('/search-only'), { code: 'EACCES' });
+
+			assert.equal(bob.fs.existsSync('/private/inner/readable.txt'), false);
+			assert.equal(await bob.fs.promises.exists('/private/inner/readable.txt'), false);
+			assert.equal(bob.fs.existsSync('/search-only/known.txt'), true);
+		} finally {
+			vfsConfig._setVFSConfig({ checkAccess, resolveFullWalk });
+		}
+	});
+
 	const copy = { ...defaultContext.credentials };
 	Object.assign(defaultContext.credentials, { uid: 1000, gid: 1000, euid: 1000, egid: 1000 });
 	test('Access controls: /', () => test_item('/'));

package/tests/fs/stat.test.ts

@@ -63,7 +63,7 @@ suite('Stats', () => {
 		assert.equal(hasAccess(defaultContext, stat, fs.constants.X_OK), false);
 		// changing group
 
-		Object.assign(defaultContext.credentials, { ...nonRootCredentials, gid: 44 });
+		Object.assign(defaultContext.credentials, { ...nonRootCredentials, gid: 44, egid: 44 });
 
 		assert.equal(hasAccess(defaultContext, stat, fs.constants.R_OK), false);
 		assert.equal(hasAccess(defaultContext, stat, fs.constants.W_OK), false);

package/tests/fs/streams.test.ts

@@ -167,7 +167,7 @@ suite('Streams', config('streams'), () => {
 		assert.deepEqual(sizes.slice(0, -1), Array(sizes.length - 1).fill(highWaterMark));
 		assert.equal(
 			sizes.reduce((a, b) => a + b, 0),
-			large.length
+			large.length,
 		);
 	});
 

package/tests/fs/xattr.test.ts

@@ -22,6 +22,16 @@ suite('Extended Attributes', config('xattr'), () => {
 		assert.equal(value, testValue);
 	});
 
+	test('set is kept when an open handle with unsynced changes is synced', async () => {
+		await using handle = await fs.promises.open(testFile, 'r');
+		await handle.chmod(0o640);
+		await fs.xattr.set(testFile, 'user.unsynced', 'value');
+		await handle.sync();
+
+		assert.equal(await fs.xattr.get(testFile, 'user.unsynced', { encoding: 'utf8' }), 'value');
+		assert.equal((await fs.promises.stat(testFile)).mode & 0o777, 0o640);
+	});
+
 	test('get attributes with buffer encoding', async () => {
 		await fs.xattr.set(testFile, 'user.buffer', 'buffer value');
 		const buffer = await fs.xattr.get(testFile, 'user.buffer', { encoding: 'buffer' });