@zenfs/core 2.7.6 → 2.8.0

package/tests/common/context.test.ts

@@ -134,4 +134,34 @@ suite('Context', () => {
 
 		assert.doesNotThrow(() => ctx.bind({ credentials: { uid: 500, gid: 500 } }));
 	});
+
+	test('umask is inherited by children', () => {
+		const parent = bindContext({ umask: 0o027 });
+		assert.equal(parent.bind({}).umask, 0o027);
+		assert.equal(parent.bind({ umask: 0o077 }).umask, 0o077);
+	});
+
+	test('umask applies to created files and directories', async () => {
+		fs.mkdirSync('/masked');
+		const masked = bindContext({ root: '/masked', umask: 0o027 });
+
+		masked.fs.writeFileSync('/sync.txt', '', { mode: 0o666 });
+		assert.equal(masked.fs.statSync('/sync.txt').mode & 0o7777, 0o640);
+
+		await masked.fs.promises.writeFile('/async.txt', '', { mode: 0o666 });
+		assert.equal(masked.fs.statSync('/async.txt').mode & 0o7777, 0o640);
+
+		masked.fs.mkdirSync('/a/b', { recursive: true, mode: 0o777 });
+		assert.equal(masked.fs.statSync('/a').mode & 0o7777, 0o750);
+		assert.equal(masked.fs.statSync('/a/b').mode & 0o7777, 0o750);
+
+		await masked.fs.promises.mkdir('/c', 0o1777);
+		assert.equal(masked.fs.statSync('/c').mode & 0o7777, 0o1750);
+
+		masked.fs.symlinkSync('/sync.txt', '/link');
+		assert.equal(masked.fs.lstatSync('/link').mode & 0o7777, 0o777);
+
+		masked.fs.chmodSync('/sync.txt', 0o666);
+		assert.equal(masked.fs.statSync('/sync.txt').mode & 0o7777, 0o666);
+	});
 });

package/tests/common/file_index.test.ts

@@ -45,7 +45,7 @@ suite('Index', () => {
 		const index = buildIndex(60_000);
 		assert.equal(
 			atDepth(1000, () => index._alloc()),
-			120_002
+			120_002,
 		);
 	});
 });

package/tests/common/mounts.test.ts

@@ -19,6 +19,18 @@ suite('Mounts', () => {
 		fs.rmSync('/nested', { recursive: true, force: true });
 	});
 
+	test('lstat of a mount point is the mounted root #326', async () => {
+		await configure({ mounts: { '/mounted': InMemory } });
+
+		await fs.promises.utimes('/mounted', 1, 1);
+		assert.equal(fs.statSync('/mounted').mtimeMs, 1000);
+		assert.equal(fs.lstatSync('/mounted').mtimeMs, 1000);
+		assert.equal((await fs.promises.lstat('/mounted')).mtimeMs, 1000);
+
+		fs.umount('/mounted');
+		fs.rmdirSync('/mounted');
+	});
+
 	test('Race conditions', async () => {
 		await configure({
 			mounts: {

package/tests/common/vcache.test.ts

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+import { InMemory } from '@zenfs/core';
+import { withExceptionContext } from '@zenfs/core/internal/error';
+import { cacheOf } from '@zenfs/core/vfs/vcache';
+import assert from 'node:assert/strict';
+import { suite, test } from 'node:test';
+
+suite('VCache', () => {
+	test('does not keep the exception context of the first caller', () => {
+		const fs = InMemory.create({ label: 'vcache' });
+		assert.equal(cacheOf(withExceptionContext(fs, { path: '/first' })).fs, fs);
+	});
+});

package/tests/fs/concurrency.test.ts

@@ -67,7 +67,7 @@ suite('Concurrency', config('write', 'async'), () => {
 			const rejected = results.filter(r => r.status === 'rejected');
 			assert.deepEqual(
 				rejected.map(r => r.reason.code ?? r.reason.message),
-				[]
+				[],
 			);
 
 			assert.equal(await fs.promises.readFile('/issue-303.txt', 'utf8'), contents);
@@ -96,7 +96,7 @@ suite('Concurrency', config('write', 'async'), () => {
 		const rejected = results.filter(r => r.status == 'rejected');
 		assert.deepEqual(
 			rejected.map(r => r.reason.code ?? r.reason.message),
-			[]
+			[],
 		);
 
 		for (const path of paths) assert((await fs.promises.stat(path)).isDirectory());
@@ -107,7 +107,7 @@ suite('Concurrency', config('write', 'async'), () => {
 
 		assert.deepEqual(
 			results.filter(result => result !== undefined),
-			['/308-same']
+			['/308-same'],
 		);
 	});
 });

package/tests/fs/links.test.ts

@@ -18,6 +18,16 @@ suite('Links', config('symlinks'), () => {
 		assert(stats.isSymbolicLink());
 	});
 
+	test('symlinks have mode 0o777 #326', async () => {
+		assert.equal((await fs.promises.lstat(symlink)).mode & 0o7777, 0o777);
+
+		fs.symlinkSync(target, 'symlink-sync.js');
+		const stats = fs.lstatSync('symlink-sync.js');
+		assert(stats.isSymbolicLink());
+		assert.equal(stats.mode & 0o7777, 0o777);
+		fs.unlinkSync('symlink-sync.js');
+	});
+
 	test('lstat file inside symlinked directory #241', async () => {
 		await fs.promises.mkdir('/a');
 		await fs.promises.writeFile('/a/hello.txt', 'hello world');
@@ -187,6 +197,72 @@ suite('Links', config('symlinks'), () => {
 		assert(fs.lstatSync('/wfS-dangling').isSymbolicLink());
 	});
 
+	test('operations follow symlinks in parent directories', config('async'), async () => {
+		await fs.promises.mkdir('/parent-real');
+		await fs.promises.symlink('/parent-real', '/parent-link');
+		await fs.promises.writeFile('/parent-real/unlink', 'x');
+		await fs.promises.writeFile('/parent-real/rename', 'x');
+		await fs.promises.mkdir('/parent-real/rmdir');
+		await fs.promises.symlink('/parent-real/renamed', '/parent-real/symlink');
+		await fs.promises.symlink('/parent-real/rmdir', '/parent-real/dir-link');
+
+		await fs.promises.unlink('/parent-link/unlink');
+		await fs.promises.rename('/parent-link/rename', '/parent-link/renamed');
+		assert.equal(await fs.promises.readlink('/parent-link/symlink'), '/parent-real/renamed');
+		await fs.promises.lutimes('/parent-link/symlink', 1, 1);
+		assert.equal((await fs.promises.lstat('/parent-real/symlink')).mtimeMs, 1000);
+
+		await assert.rejects(fs.promises.rmdir('/parent-link/dir-link'), { code: 'ENOTDIR' });
+		await fs.promises.unlink('/parent-link/dir-link');
+		await fs.promises.rmdir('/parent-link/rmdir');
+
+		assert.deepEqual((await fs.promises.readdir('/parent-real')).sort(), ['renamed', 'symlink']);
+	});
+
+	test('operations follow symlinks in parent directories (sync)', config('sync'), () => {
+		fs.mkdirSync('/parentS-real');
+		fs.symlinkSync('/parentS-real', '/parentS-link');
+		fs.writeFileSync('/parentS-real/unlink', 'x');
+		fs.writeFileSync('/parentS-real/rename', 'x');
+		fs.mkdirSync('/parentS-real/rmdir');
+		fs.symlinkSync('/parentS-real/renamed', '/parentS-real/symlink');
+		fs.symlinkSync('/parentS-real/rmdir', '/parentS-real/dir-link');
+
+		fs.unlinkSync('/parentS-link/unlink');
+		fs.renameSync('/parentS-link/rename', '/parentS-link/renamed');
+		assert.equal(fs.readlinkSync('/parentS-link/symlink'), '/parentS-real/renamed');
+		fs.lutimesSync('/parentS-link/symlink', 1, 1);
+		assert.equal(fs.lstatSync('/parentS-real/symlink').mtimeMs, 1000);
+
+		assert.throws(() => fs.rmdirSync('/parentS-link/dir-link'), { code: 'ENOTDIR' });
+		fs.unlinkSync('/parentS-link/dir-link');
+		fs.rmdirSync('/parentS-link/rmdir');
+
+		assert.deepEqual(fs.readdirSync('/parentS-real').sort(), ['renamed', 'symlink']);
+	});
+
+	test('link follows symlinks in parent directories', config('links'), async () => {
+		await fs.promises.link('/parent-link/renamed', '/parent-link/hard');
+		assert.equal(await fs.promises.readFile('/parent-real/hard', 'utf8'), 'x');
+		fs.linkSync('/parentS-link/renamed', '/parentS-link/hard');
+		assert.equal(fs.readFileSync('/parentS-real/hard', 'utf8'), 'x');
+	});
+
+	test('xattr follows symlinks unless noFollow is set', config('xattr'), async () => {
+		await fs.xattr.set('/parent-link/renamed', 'user.parent', 'async');
+		assert.equal(await fs.xattr.get('/parent-real/renamed', 'user.parent', { encoding: 'utf8' }), 'async');
+		fs.xattr.setSync('/parentS-link/renamed', 'user.parent', 'sync');
+		assert.equal(fs.xattr.getSync('/parentS-real/renamed', 'user.parent', { encoding: 'utf8' }), 'sync');
+
+		await fs.xattr.set('/parent-link/symlink', 'user.link', 'on link', { noFollow: true });
+		assert.equal(await fs.xattr.get('/parent-real/symlink', 'user.link', { encoding: 'utf8', noFollow: true }), 'on link');
+		await assert.rejects(fs.xattr.get('/parent-real/renamed', 'user.link'), { code: 'ENODATA' });
+		assert.deepEqual(await fs.xattr.list('/parent-link/symlink'), ['user.parent']);
+
+		await fs.xattr.remove('/parent-link/renamed', 'user.parent');
+		assert.deepEqual(fs.xattr.listSync('/parent-real/renamed'), []);
+	});
+
 	test('cp preserves a symlink by default #304', async () => {
 		await fs.promises.mkdir('/cp-src');
 		await fs.promises.writeFile('/cp-src/real.txt', 'contents');

package/tests/fs/permissions.test.ts

@@ -1,8 +1,10 @@
 // SPDX-License-Identifier: LGPL-3.0-or-later
+import { bindContext, fs as rootFS } from '@zenfs/core';
 import { R_OK, W_OK, X_OK } from '@zenfs/core/constants';
 import { defaultContext } from '@zenfs/core/internal/contexts';
 import { hasAccess } from '@zenfs/core/internal/inode';
 import { join } from '@zenfs/core/path';
+import * as vfsConfig from '@zenfs/core/vfs/config';
 import type { Exception } from 'kerium';
 import assert from 'node:assert/strict';
 import { suite, test } from 'node:test';
@@ -84,6 +86,257 @@ suite('Permissions', config('permissions'), () => {
 		assert(hasAccess(defaultContext, stats, W_OK));
 	}
 
+	test('unprivileged users can read files they do not own #326', async () => {
+		await rootFS.promises.writeFile('/root-owned.txt', 'shared', { mode: 0o644 });
+		const user = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+
+		assert.equal(user.fs.readFileSync('/root-owned.txt', 'utf8'), 'shared');
+		assert.equal(await user.fs.promises.readFile('/root-owned.txt', 'utf8'), 'shared');
+
+		assert.throws(() => user.fs.writeFileSync('/root-owned.txt', 'nope'), { code: 'EACCES' });
+		await assert.rejects(user.fs.promises.writeFile('/root-owned.txt', 'nope'), { code: 'EACCES' });
+	});
+
+	test('access checks follow Linux #326', () => {
+		const as = (uid: number, gid: number, euid = uid, egid = gid, groups: number[] = []) =>
+			bindContext({ credentials: { uid, gid, euid, egid, groups } });
+		const file = (mode: number, uid = 1000, gid = 1000) => ({ mode: 0o100000 | mode, uid, gid });
+
+		assert(!hasAccess(as(1000, 0), file(0o600, 0, 0), R_OK));
+		assert(hasAccess(as(0, 1000), file(0o000, 5, 5), R_OK | W_OK));
+
+		assert(hasAccess(as(1000, 1000, 2000, 1000), file(0o600, 2000, 5), R_OK | W_OK));
+		assert(!hasAccess(as(2000, 1000, 1000, 1000), file(0o600, 2000, 5), R_OK));
+		assert(!hasAccess(as(1000, 0, 1000, 1000), file(0o060, 2000, 0), R_OK));
+
+		assert(!hasAccess(as(1000, 1000), file(0o077), R_OK));
+		assert(!hasAccess(as(1000, 1000), file(0o407, 2000), R_OK));
+		assert(hasAccess(as(1000, 3000), file(0o004, 2000, 2000), R_OK));
+		assert(hasAccess(as(1000, 3000, 1000, 3000, [2000]), file(0o040, 2000, 2000), R_OK));
+		assert(hasAccess(as(1000, 2000), file(0o021, 0, 2000), W_OK));
+		assert(!hasAccess(as(1000, 2000), file(0o021, 0, 2000), X_OK));
+	});
+
+	test('stat needs no permission on the file itself #326', async () => {
+		await rootFS.promises.writeFile('/secret-stat.txt', 'x', { mode: 0o000 });
+		const user = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+
+		assert.equal(user.fs.statSync('/secret-stat.txt').size, 1);
+		assert.equal((await user.fs.promises.lstat('/secret-stat.txt')).size, 1);
+		assert.throws(() => user.fs.readFileSync('/secret-stat.txt'), { code: 'EACCES' });
+	});
+
+	test('removing an entry needs write and search permission on its parent #326', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+
+		await rootFS.promises.mkdir('/removal-root', { mode: 0o755 });
+		await rootFS.promises.writeFile('/removal-root/file', 'x', { mode: 0o666 });
+		await rootFS.promises.mkdir('/removal-root/dir', { mode: 0o777 });
+		await rootFS.promises.mkdir('/removal-own', { mode: 0o755 });
+		await rootFS.promises.chown('/removal-own', 1000, 1000);
+		await rootFS.promises.writeFile('/removal-own/readonly', 'x', { mode: 0o444 });
+		await rootFS.promises.mkdir('/removal-own/readonly-dir', { mode: 0o555 });
+		await rootFS.promises.mkdir('/removal-unreadable', { mode: 0o300 });
+		await rootFS.promises.chown('/removal-unreadable', 1000, 1000);
+		await rootFS.promises.writeFile('/removal-unreadable/file', 'x');
+
+		await assert.rejects(alice.fs.promises.unlink('/removal-root/file'), { code: 'EACCES' });
+		assert.throws(() => alice.fs.unlinkSync('/removal-root/file'), { code: 'EACCES' });
+		await assert.rejects(alice.fs.promises.rmdir('/removal-root/dir'), { code: 'EACCES' });
+		assert.throws(() => alice.fs.rmdirSync('/removal-root/dir'), { code: 'EACCES' });
+		assert.throws(() => alice.fs.renameSync('/removal-root/file', '/removal-own/file'), { code: 'EACCES' });
+		await assert.rejects(alice.fs.promises.rename('/removal-own/readonly', '/removal-root/file'), { code: 'EACCES' });
+
+		await alice.fs.promises.unlink('/removal-own/readonly');
+		alice.fs.rmdirSync('/removal-own/readonly-dir');
+		assert.deepEqual(rootFS.readdirSync('/removal-own'), []);
+
+		await alice.fs.promises.rename('/removal-unreadable/file', '/removal-unreadable/renamed');
+		alice.fs.renameSync('/removal-unreadable/renamed', '/removal-unreadable/file');
+	});
+
+	test('sticky directories only let owners remove entries #326', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+		const bob = bindContext({ credentials: { uid: 2000, gid: 2000 } });
+
+		await rootFS.promises.mkdir('/sticky', { mode: 0o1777 });
+		await alice.fs.promises.writeFile('/sticky/alice', 'a', { mode: 0o666 });
+		await alice.fs.promises.mkdir('/sticky/alice-dir', { mode: 0o777 });
+		await bob.fs.promises.writeFile('/sticky/bob', 'b');
+
+		await assert.rejects(bob.fs.promises.unlink('/sticky/alice'), { code: 'EPERM' });
+		assert.throws(() => bob.fs.unlinkSync('/sticky/alice'), { code: 'EPERM' });
+		await assert.rejects(bob.fs.promises.rmdir('/sticky/alice-dir'), { code: 'EPERM' });
+		assert.throws(() => bob.fs.rmdirSync('/sticky/alice-dir'), { code: 'EPERM' });
+		assert.throws(() => bob.fs.renameSync('/sticky/alice', '/sticky/stolen'), { code: 'EPERM' });
+		await assert.rejects(alice.fs.promises.rename('/sticky/alice', '/sticky/bob'), { code: 'EPERM' });
+
+		await alice.fs.promises.unlink('/sticky/alice');
+		alice.fs.rmdirSync('/sticky/alice-dir');
+		await rootFS.promises.unlink('/sticky/bob');
+		assert.deepEqual(rootFS.readdirSync('/sticky'), []);
+
+		await rootFS.promises.mkdir('/sticky-alice', { mode: 0o1777 });
+		await rootFS.promises.chown('/sticky-alice', 1000, 1000);
+		await bob.fs.promises.writeFile('/sticky-alice/bob', 'b');
+		await alice.fs.promises.unlink('/sticky-alice/bob');
+	});
+
+	test('only owners may change the mode, owner, or times of a file #326', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000, groups: [3000] } });
+		const bob = bindContext({ credentials: { uid: 2000, gid: 2000 } });
+
+		await rootFS.promises.writeFile('/owned', 'x', { mode: 0o666 });
+		rootFS.chownSync('/owned', 1000, 1000);
+
+		assert.throws(() => bob.fs.chmodSync('/owned', 0o600), { code: 'EPERM' });
+		await assert.rejects(bob.fs.promises.chmod('/owned', 0o600), { code: 'EPERM' });
+		assert.throws(() => bob.fs.utimesSync('/owned', 1, 2), { code: 'EPERM' });
+		await assert.rejects(bob.fs.promises.utimes('/owned', 1, 2), { code: 'EPERM' });
+		assert.throws(() => bob.fs.chownSync('/owned', -1, 2000), { code: 'EPERM' });
+		assert.throws(() => bob.fs.chownSync('/owned', 1000, -1), { code: 'EPERM' });
+		bob.fs.chownSync('/owned', -1, -1);
+
+		alice.fs.chmodSync('/owned', 0o644);
+		await alice.fs.promises.utimes('/owned', 1, 2);
+		alice.fs.chownSync('/owned', -1, 3000);
+		await alice.fs.promises.chown('/owned', 1000, 1000);
+		assert.throws(() => alice.fs.chownSync('/owned', -1, 4000), { code: 'EPERM' });
+		assert.throws(() => alice.fs.chownSync('/owned', 2000, -1), { code: 'EPERM' });
+
+		rootFS.chownSync('/owned', 2000, 2000);
+		const stats = rootFS.statSync('/owned');
+		assert.equal(stats.mode & 0o777, 0o644);
+		assert.equal(stats.mtimeMs, 2000);
+		assert.equal(stats.uid, 2000);
+	});
+
+	test('changing metadata needs no read or write access, even on directories #327', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+
+		await rootFS.promises.writeFile('/metadata-file', 'x', { mode: 0o000 });
+		await rootFS.promises.mkdir('/metadata-dir', { mode: 0o000 });
+
+		for (const path of ['/metadata-file', '/metadata-dir']) {
+			rootFS.chownSync(path, 1000, 1000);
+			alice.fs.chmodSync(path, 0o500);
+			await alice.fs.promises.chmod(path, 0o400);
+			alice.fs.utimesSync(path, 1, 2);
+			await alice.fs.promises.utimes(path, 3, 4);
+			alice.fs.chownSync(path, -1, -1);
+			await alice.fs.promises.chown(path, -1, -1);
+
+			const stats = rootFS.statSync(path);
+			assert.equal(stats.mode & 0o777, 0o400);
+			assert.equal(stats.mtimeMs, 4000);
+		}
+	});
+
+	test('moving a directory to another parent needs write permission on it', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+
+		await rootFS.promises.mkdir('/move-a', { mode: 0o777 });
+		await rootFS.promises.mkdir('/move-b', { mode: 0o777 });
+		await rootFS.promises.mkdir('/move-a/dir', { mode: 0o755 });
+		await rootFS.promises.writeFile('/move-a/file', 'x', { mode: 0o644 });
+
+		assert.throws(() => alice.fs.renameSync('/move-a/dir', '/move-b/dir'), { code: 'EACCES' });
+		await assert.rejects(alice.fs.promises.rename('/move-a/dir', '/move-b/dir'), { code: 'EACCES' });
+		await alice.fs.promises.rename('/move-a/dir', '/move-a/renamed');
+		await alice.fs.promises.rename('/move-a/file', '/move-b/file');
+	});
+
+	test('chmod and chown clear setuid and setgid like Linux', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000, groups: [3000] } });
+		const modeOf = (path: string) => rootFS.statSync(path).mode & 0o7777;
+
+		await rootFS.promises.mkdir('/sid', { mode: 0o777 });
+		await alice.fs.promises.writeFile('/sid/file', 'x');
+		await alice.fs.promises.mkdir('/sid/dir');
+
+		alice.fs.chmodSync('/sid/file', 0o6755);
+		assert.equal(modeOf('/sid/file'), 0o6755);
+		alice.fs.chownSync('/sid/file', -1, -1);
+		assert.equal(modeOf('/sid/file'), 0o755);
+
+		alice.fs.chmodSync('/sid/file', 0o2745);
+		alice.fs.chownSync('/sid/file', -1, 3000);
+		assert.equal(modeOf('/sid/file'), 0o2745);
+
+		rootFS.chmodSync('/sid/file', 0o4755);
+		rootFS.chownSync('/sid/file', 1000, 0);
+		assert.equal(modeOf('/sid/file'), 0o755);
+
+		alice.fs.chmodSync('/sid/file', 0o2755);
+		assert.equal(modeOf('/sid/file'), 0o755);
+
+		await alice.fs.promises.chmod('/sid/dir', 0o6755);
+		await alice.fs.promises.chown('/sid/dir', -1, -1);
+		assert.equal(modeOf('/sid/dir'), 0o6755);
+	});
+
+	test('access checks see unsynced changes to an open file', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+
+		await rootFS.promises.writeFile('/unsynced', 'x', { mode: 0o644 });
+		const fd = rootFS.openSync('/unsynced', 'r');
+		rootFS.fchmodSync(fd, 0o600);
+
+		assert.throws(() => alice.fs.readFileSync('/unsynced'), { code: 'EACCES' });
+		await assert.rejects(alice.fs.promises.readFile('/unsynced'), { code: 'EACCES' });
+		rootFS.closeSync(fd);
+	});
+
+	test('reaching a path needs search permission on every directory leading to it #326', async () => {
+		const alice = bindContext({ credentials: { uid: 1000, gid: 1000 } });
+		const bob = bindContext({ credentials: { uid: 2000, gid: 2000 } });
+
+		await rootFS.promises.mkdir('/private', { mode: 0o700 });
+		await rootFS.promises.chown('/private', 1000, 1000);
+		await rootFS.promises.mkdir('/private/inner', { mode: 0o755 });
+		await rootFS.promises.writeFile('/private/inner/readable.txt', 'secret', { mode: 0o644 });
+		await rootFS.promises.symlink('/private', '/private-link');
+		await rootFS.promises.mkdir('/search-only', { mode: 0o711 });
+		await rootFS.promises.writeFile('/search-only/known.txt', 'known', { mode: 0o644 });
+		await rootFS.promises.mkdir('/no-search', { mode: 0o722 });
+
+		assert.throws(() => bob.fs.readFileSync('/private-link/inner/readable.txt'), { code: 'EACCES' });
+		await assert.rejects(bob.fs.promises.readFile('/private-link/inner/readable.txt'), { code: 'EACCES' });
+		assert.throws(() => bob.fs.lstatSync('/private/inner'), { code: 'EACCES' });
+		assert.throws(() => bob.fs.mkdirSync('/no-search/dir'), { code: 'EACCES' });
+		assert.throws(() => bob.fs.writeFileSync('/no-search/file', 'x'), { code: 'EACCES' });
+
+		const { checkAccess, resolveFullWalk } = vfsConfig;
+		vfsConfig._setVFSConfig({ checkAccess, resolveFullWalk: true });
+		try {
+			assert.equal(alice.fs.readFileSync('/private/inner/readable.txt', 'utf8'), 'secret');
+			assert.equal(rootFS.readFileSync('/private/inner/readable.txt', 'utf8'), 'secret');
+
+			assert.throws(() => bob.fs.readFileSync('/private/inner/readable.txt'), { code: 'EACCES' });
+			await assert.rejects(bob.fs.promises.readFile('/private/inner/readable.txt'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.statSync('/private/inner/readable.txt'), { code: 'EACCES' });
+			await assert.rejects(bob.fs.promises.stat('/private/inner/readable.txt'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.readdirSync('/private/inner'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.writeFileSync('/private/inner/new.txt', 'x'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.unlinkSync('/private/inner/readable.txt'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.mkdirSync('/private/inner/dir'), { code: 'EACCES' });
+			assert.throws(() => bob.fs.renameSync('/private/inner/readable.txt', '/stolen.txt'), { code: 'EACCES' });
+			assert(rootFS.existsSync('/private/inner/readable.txt'));
+
+			assert.equal(bob.fs.statSync('/private').mode & 0o777, 0o700);
+			assert.throws(() => bob.fs.readdirSync('/private'), { code: 'EACCES' });
+
+			assert.equal(bob.fs.readFileSync('/search-only/known.txt', 'utf8'), 'known');
+			assert.throws(() => bob.fs.readdirSync('/search-only'), { code: 'EACCES' });
+
+			assert.equal(bob.fs.existsSync('/private/inner/readable.txt'), false);
+			assert.equal(await bob.fs.promises.exists('/private/inner/readable.txt'), false);
+			assert.equal(bob.fs.existsSync('/search-only/known.txt'), true);
+		} finally {
+			vfsConfig._setVFSConfig({ checkAccess, resolveFullWalk });
+		}
+	});
+
 	const copy = { ...defaultContext.credentials };
 	Object.assign(defaultContext.credentials, { uid: 1000, gid: 1000, euid: 1000, egid: 1000 });
 	test('Access controls: /', () => test_item('/'));

package/tests/fs/stat.test.ts

@@ -63,7 +63,7 @@ suite('Stats', () => {
 		assert.equal(hasAccess(defaultContext, stat, fs.constants.X_OK), false);
 		// changing group
 
-		Object.assign(defaultContext.credentials, { ...nonRootCredentials, gid: 44 });
+		Object.assign(defaultContext.credentials, { ...nonRootCredentials, gid: 44, egid: 44 });
 
 		assert.equal(hasAccess(defaultContext, stat, fs.constants.R_OK), false);
 		assert.equal(hasAccess(defaultContext, stat, fs.constants.W_OK), false);

package/tests/fs/streams.test.ts

@@ -167,7 +167,7 @@ suite('Streams', config('streams'), () => {
 		assert.deepEqual(sizes.slice(0, -1), Array(sizes.length - 1).fill(highWaterMark));
 		assert.equal(
 			sizes.reduce((a, b) => a + b, 0),
-			large.length
+			large.length,
 		);
 	});
 

package/tests/fs/watch.test.ts

@@ -41,6 +41,20 @@ suite('Watch', config('watch'), () => {
 		assert.equal(filename, 'test.txt');
 	});
 
+	test('Events emitted on metadata change', async () => {
+		const { promise, resolve } = Promise.withResolvers<[string, string]>();
+
+		using watcher = fs.watch(testFile, (eventType, filename) => {
+			resolve([eventType, filename]);
+		});
+
+		fs.chmodSync(testFile, 0o600);
+
+		const [eventType, filename] = await withTimeout(promise);
+		assert.equal(eventType, 'change');
+		assert.equal(filename, 'test.txt');
+	});
+
 	test('Events are emitted on delete', async () => {
 		const { promise, resolve } = Promise.withResolvers<string>();
 

package/tests/fs/xattr.test.ts

@@ -22,6 +22,16 @@ suite('Extended Attributes', config('xattr'), () => {
 		assert.equal(value, testValue);
 	});
 
+	test('set is kept when an open handle with unsynced changes is synced', async () => {
+		await using handle = await fs.promises.open(testFile, 'r');
+		await handle.chmod(0o640);
+		await fs.xattr.set(testFile, 'user.unsynced', 'value');
+		await handle.sync();
+
+		assert.equal(await fs.xattr.get(testFile, 'user.unsynced', { encoding: 'utf8' }), 'value');
+		assert.equal((await fs.promises.stat(testFile)).mode & 0o777, 0o640);
+	});
+
 	test('get attributes with buffer encoding', async () => {
 		await fs.xattr.set(testFile, 'user.buffer', 'buffer value');
 		const buffer = await fs.xattr.get(testFile, 'user.buffer', { encoding: 'buffer' });

package/tests/perf/config.json

@@ -1,6 +1,7 @@
 {
 	"flags": {
-		"prep": ["writeFile", "stream"]
+		"prep": ["writeFile", "stream"],
+		"sbfs_v2": [true, false]
 	},
 	"tests": [
 		{
@@ -79,6 +80,35 @@
 				{ "name": "2000 appends", "value": { "writes": 2000 } },
 				{ "name": "8000 appends", "cpu": 1, "value": { "writes": 8000 } }
 			]
+		},
+		{
+			"path": "single-buffer-read.ts",
+			"name": "Random 4 KB reads from one file in a SingleBuffer",
+			"flags": ["sbfs_v2"],
+			"measure": {
+				"bytes": { "throughput": "s", "unit": "MB" },
+				"reads": { "cost": true, "unit": "read" }
+			},
+			"configurations": [
+				{ "name": "1 MiB", "value": { "size": 1048576, "count": 256 } },
+				{ "name": "8 MiB", "value": { "size": 8388608, "count": 1024 } },
+				{ "name": "32 MiB", "cpu": 1, "value": { "size": 33554432, "count": 1024 } }
+			]
+		},
+		{
+			"path": "single-buffer-write.ts",
+			"name": "Random 4 KB writes to one file in a SingleBuffer",
+			"flags": ["sbfs_v2"],
+			"measure": {
+				"bytes": { "throughput": "s", "unit": "MB" },
+				"writes": { "cost": true, "unit": "write" }
+			},
+			"configurations": [
+				{ "name": "1 MiB, flushed", "value": { "size": 1048576, "count": 256, "flush": 1, "sync": 0 } },
+				{ "name": "1 MiB, O_SYNC", "value": { "size": 1048576, "count": 256, "flush": 0, "sync": 1 } },
+				{ "name": "8 MiB, flushed", "cpu": 1, "value": { "size": 8388608, "count": 1024, "flush": 1, "sync": 0 } },
+				{ "name": "8 MiB, O_SYNC", "cpu": 1, "value": { "size": 8388608, "count": 1024, "flush": 0, "sync": 1 } }
+			]
 		}
 	]
 }

package/tests/perf/single-buffer-random.ts

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+// Helpers for random access to one file in a SingleBuffer.
+import { configureSingle, SingleBuffer } from '@zenfs/core';
+import { fs, KB, MB } from './common.ts';
+
+export { fs };
+
+export const block = 4 * KB;
+
+export interface Config {
+	/** Size of the file */
+	size: number;
+
+	/** Number of blocks accessed, each once */
+	count: number;
+
+	sbfs_v2: boolean;
+}
+
+/** Mounts a SingleBuffer with room for the file twice over, then creates the file */
+export async function mountWithFile(config: Config): Promise<void> {
+	await configureSingle({ backend: SingleBuffer, buffer: new ArrayBuffer(config.size * 2 + 4 * MB), v2: config.sbfs_v2 });
+	fs.writeFileSync('/f', new Uint8Array(config.size).fill(0x5a));
+}
+
+/** Offsets of `count` distinct blocks of the file, in a shuffled order that is the same on every run */
+export function offsets(config: Config): number[] {
+	const blocks = Array.from({ length: config.size / block }, (_, i) => i);
+
+	let seed = 0x2545f491;
+	for (let i = blocks.length - 1; i > 0; i--) {
+		seed = (seed * 1103515245 + 12345) & 0x7fffffff;
+		const j = seed % (i + 1);
+		[blocks[i], blocks[j]] = [blocks[j], blocks[i]];
+	}
+
+	return blocks.slice(0, config.count).map(i => i * block);
+}

package/tests/perf/single-buffer-read.ts

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+// 4 KB reads at random offsets in one file in a SingleBuffer.
+// The file is opened fresh for each iteration, so every read misses the vnode cache and reaches the store.
+import { block, fs, mountWithFile, offsets, type Config } from './single-buffer-random.ts';
+
+interface State {
+	offsets: number[];
+	target: Uint8Array;
+	fd?: number;
+}
+
+export async function setup(config: Config): Promise<State> {
+	await mountWithFile(config);
+	return { offsets: offsets(config), target: new Uint8Array(block) };
+}
+
+export function before(config: Config, state: State): void {
+	state.fd = fs.openSync('/f', 'r');
+}
+
+export function test(config: Config, state: State) {
+	for (const offset of state.offsets) fs.readSync(state.fd!, state.target, 0, block, offset);
+	return { reads: state.offsets.length, bytes: state.offsets.length * block };
+}
+
+export function after(config: Config, state: State): void {
+	fs.closeSync(state.fd!);
+}