dsh-wsl-desktop 0.7.4 → 0.7.6

package/lib/client.js

@@ -245,7 +245,7 @@ window.__ModuleLoader__.load({
       'unmeasured': '未测量',
       'not measured': '未测量',
       'not selected; the runner uses sudo-unshare': '未被选中；运行器使用 sudo-unshare',
-      'not installed or not v1.2': '未安装或版本不是 v1.2',
+      'not installed or not v1.3': '未安装或版本不是 v1.3',
     }
 
     /**
@@ -256,7 +256,7 @@ window.__ModuleLoader__.load({
     function localizeDetail(detail) {
       if (LOCALE !== 'zh' || typeof detail !== 'string') return detail
       if (detail.startsWith('missing: ')) return `${copy('missingPrefix')}${detail.slice('missing: '.length)}`
-      // Version strings carry their own identity (Python x.y, dsh-wsl-confine v1.2).
+      // Version strings carry their own identity (Python x.y, dsh-wsl-confine v1.3).
       if (detail.startsWith('Python ') || detail.startsWith('dsh-wsl-confine ')) return detail
       return DETAIL_ZH[detail] ?? detail
     }

package/lib/protocol.js

@@ -202,8 +202,8 @@ export const CHECK_REMEDIES = deepFreeze({
   },
   helper: {
     kind: 'text',
-    zh: 'helper 未安装或版本不是 v1.2；安装说明见 docs/CONFINEMENT.md。',
-    en: 'The helper is missing or not v1.2; see docs/CONFINEMENT.md for the install command.',
+    zh: 'helper 未安装或版本不是 v1.3；安装说明见 docs/CONFINEMENT.md。',
+    en: 'The helper is missing or not v1.3; see docs/CONFINEMENT.md for the install command.',
   },
   nnp: {
     kind: 'text',

package/lib/wsl/confinement.js

@@ -39,8 +39,20 @@ export const HELPER_PATH = '/usr/local/sbin/dsh-wsl-confine'
  * bypass. The probe below therefore refuses anything older, and the direct
  * sudo-unshare runner is used instead: its in-process builder always escaped, so
  * a stale install degrades to a correct fence rather than a silent hole.
+ *
+ * v1.3 is the first helper whose writability post-condition reads the MOUNT FLAG
+ * instead of `[ -w ]`. v1.2 asked `[ -w ]` about every swept target, which the
+ * kernel answers "writable" for any non-storage inode — a SOCKET, FIFO or device
+ * node — even on a mount that was successfully remounted read-only. With a
+ * unix-socket bind mount present (measured: `/mnt/wsl/podman-sockets` while
+ * `podman machine` runs) that refused EVERY confined command with exit 97,
+ * including a bare `true`, and the terminal path surfaced it only as
+ * "PTY shell exited during startup" (github issue #2). Refusing the old version
+ * is what makes the fix reach an installed helper: the requirement is an exact
+ * match, so an un-reinstalled v1.2 now falls back to the direct runner, whose
+ * in-process builder carries the corrected post-condition.
  */
-export const HELPER_VERSION = 'v1.2'
+export const HELPER_VERSION = 'v1.3'
 
 /** stderr text the kernel produces for a write blocked by the read-only root. */
 export const DENIAL_SIGNATURES = ['Read-only file system', 'read-only file system']
@@ -555,6 +567,40 @@ export const SETUP_FAILURE_MARKER = 'dsh-wsl-sandbox: setup failed'
  */
 export const KERNEL_SURFACES = new Set(['/dev', '/dev/pts', '/dev/mqueue', '/proc', '/sys'])
 
+/**
+ * Kernel surfaces exempt as SUBTREES, not as single mount points.
+ *
+ * A fresh procfs brings its own nested mounts with it, and the distribution's
+ * real ones are not theoretical: measured on a running WSL2 distribution,
+ * `findmnt` lists `/proc/sys/fs/binfmt_misc` AND
+ * `/proc/sys/fs/binfmt_misc/status` as separate mounts, plus a `/proc` record
+ * that is a re-mount of the root procfs. A nested kernel mount cannot be made
+ * read-only — measured: `mount -o remount,ro,bind /proc/sys/fs/binfmt_misc`
+ * answers exit **32** ("mount point not mounted or bad option") on this
+ * distribution, and `umount` answers EBUSY — so exact-entry matching left those
+ * children unexempt and the post-condition found the first one and refused
+ * EVERY confined command (measured: exit 97, `/proc/sys/fs/binfmt_misc is still
+ * writable`).
+ *
+ * This set must agree with `KERNEL_SUBTREE` in `dsh-wsl-confine.sh`, which has
+ * carried the same rule since the two fences were split. It did NOT before: the
+ * helper exempted these subtrees and the in-process builder matched exactly, so
+ * on a distribution with nested kernel mounts the TWO FENCES DISAGREED about
+ * whether the fence could be established at all — the helper's path worked while
+ * the direct `sudo-unshare` runner failed closed on every command. The direct
+ * runner is exactly what an operator gets when the helper is not installed or
+ * its version does not match, so that divergence was a whole-world outage for
+ * this distribution, not an edge case.
+ *
+ * Deliberately NARROWER than `KERNEL_SURFACES`: `/dev` and `/tmp` stay exact
+ * matches, so their writable children keep being swept. `/dev/shm` is shared
+ * memory that must end up READONLY (the post-condition asserts it), and a
+ * workspace under `/tmp` is refused outright. Only the two pseudo-filesystems
+ * whose children are kernel state by construction get the subtree rule, and the
+ * workspace is never one of them.
+ */
+export const KERNEL_SUBTREES = ['/proc', '/sys']
+
 /**
  * Escape ERE metacharacters so a path can only ever match itself.
  * @param {string} text - a mount target or exempt path.
@@ -567,11 +613,19 @@ function escapeEre(text) {
 /**
  * The assembled grep -E pattern for one sweep/postcondition: regex-escaped
  * entries joined with alternation, anchored both ends.
+ *
+ * The subtree entries are emitted the way the helper builds them — the escaped
+ * path followed by `/.*` — inside the same anchored group, so `/proc` exempts
+ * `/proc/sys/fs/binfmt_misc` while the trailing `$` still stops a sibling like
+ * `/procxyz` from matching. See {@link KERNEL_SUBTREES} for why the two fences
+ * must agree on this.
  * @param {string[]} keep - mount targets that stay writable.
  * @returns {string} the pattern, as data (the caller quotes it for the shell).
  */
 function exemptPattern(keep) {
-  return `^(${[...new Set([...keep, ...KERNEL_SURFACES])].map(escapeEre).join('|')})$`
+  const exact = [...new Set([...keep, ...KERNEL_SURFACES])].map(escapeEre)
+  const subtrees = KERNEL_SUBTREES.map((kernel) => `${escapeEre(kernel)}/.*`)
+  return `^(${[...exact, ...subtrees].join('|')})$`
 }
 
 /**
@@ -594,6 +648,12 @@ function sweepHead(pattern) {
  * Enumerated at run time from `findmnt` rather than from a fixed list, because a
  * list is only ever as complete as the machine it was written on: a new drvfs
  * drive or a runtime tmpfs would reopen the hole silently.
+ *
+ * A remount that fails is swallowed here and caught a step later by
+ * {@link postConditions}, which is deliberate: one unmountable target must not
+ * abort the sweep for the others, and a nested kernel mount legitimately cannot
+ * be remounted (measured: `remount,ro,bind /proc/sys/fs/binfmt_misc` answers
+ * exit 32) — those are exempted as subtrees instead, in both fences.
  * @param {string[]} keep - mount targets that stay writable.
  * @returns {string} the fragment.
  */
@@ -626,6 +686,36 @@ function readOnlySweep(keep) {
  * not abort the rest, which means the only trustworthy statement about the
  * boundary is one read back from inside it. A target that is still writable
  * outside the allow-list is a setup failure, not a command failure.
+ *
+ * The writability verdict pairs two tests, and each is load-bearing where the
+ * other is blind.
+ *
+ * **Storage inodes are judged by `[ -w ]`.** `access(W_OK)` answers about the
+ * mount a write would actually land on — including a STACKED target (findmnt
+ * lists one record per mount), where it lands on the topmost, visible layer.
+ * `remount,ro,bind` by path reaches only that top layer, so a covered record's
+ * `rw` flag is not a hole: measured on a running WSL2 distribution, after
+ * remounting the visible `/run/user` the covered record still reported
+ * `rw,relatime` while a write through the path failed `EROFS`. Judging by that
+ * covered flag was a false positive that refused every confined command.
+ *
+ * **Everything else is judged by the MOUNT FLAG.** On a socket, FIFO or device
+ * node `[ -w ]` says nothing about the mount: the kernel's read-only answer is
+ * deliberately narrowed to storage. `sb_permission()` returns `-EROFS` only for
+ * a regular file, directory or symlink (`fs/namei.c`: `S_ISREG || S_ISDIR ||
+ * S_ISLNK`), `do_faccessat()`'s own read-only re-check — the one `[ -w ]`
+ * reaches — repeats the exclusion with `special_file(inode->i_mode)`, and
+ * between them `generic_permission()` lets the check's uid (root, because this
+ * fragment runs before the setpriv drop) through `CAP_DAC_OVERRIDE` for a
+ * `MAY_WRITE`-only mask. A SOCKET therefore reports "writable" on a mount that
+ * was successfully remounted read-only — measured as fence exit 97 for a
+ * bind-mounted unix socket under `/mnt/wsl/podman-sockets` while `podman
+ * machine` was running, refusing every confined command including a bare `true`
+ * (github issue #2).
+ *
+ * Both read ONE `findmnt -rno TARGET,OPTIONS` enumeration, and `ro` is a comma
+ * member rather than a `^ro` prefix: a mount's VFS options are a comma list and
+ * nothing pins `ro` to a position.
  * @param {string[]} keep - mount targets that may stay writable.
  * @returns {string} the fragment.
  */
@@ -634,17 +724,75 @@ function postConditions(keep) {
   return [
     'mountpoint -q /tmp || fail "/tmp is not a private tmpfs"',
     'findmnt -rno OPTIONS / | grep -q "^ro" || fail "/ is not read-only"',
-    // Same line-driven loop, decode-before-match, and single-quoted pattern
-    // as the sweep (fail() is defined in the setup steps). The trailing
-    // `true` matters: the while is the LAST element of a pipeline, so a body
-    // that ends with a failing `[ -w ]` (the normal case — every swept target
-    // IS read-only) would otherwise fail the whole pipeline under
-    // `set -o pipefail` and abort the script before the command runs. A real
-    // `fail` still exits 97 from inside the loop, which pipefail turns into
-    // the script's own setup failure — the marker and exit code still
-    // surface.
-    sweepHead(pattern),
-    '  [ -w "$target" ] && fail "$target is still writable";',
+    // TARGET,OPTIONS in ONE enumeration, and the exemption test applies to the
+    // DECODED TARGET alone. `findmnt -r` escapes a space in a target as \x20, so
+    // the escaped target is a single space-free field and the options are the
+    // rest of the line; the split therefore happens BEFORE the decode, which is
+    // what keeps a spaced target one target (the sweep's own regression) while
+    // the options stay intact for the flag test. Test the target, not the whole
+    // line: the pattern is anchored, so a line carrying options would never
+    // match and every target — the workspace included — would be required to be
+    // read-only.
+    "findmnt -rno TARGET,OPTIONS | while IFS=' ' read -r raw opts; do",
+    // `\${raw}` is ESCAPED: this fragment is a JS template literal, and an
+    // unescaped `${raw}` is JS interpolation (a ReferenceError at build time),
+    // not the shell variable the fence needs.
+    '  target=$(printf \'%b\' "${raw}");',
+    // A failing grep is not a match: the sweep has already failed closed on a
+    // broken pattern (fail "exemption grep failed"), so an unreadable exemption
+    // here can only over-ask, never under-ask. `if ...; then continue; fi` and
+    // NOT `grep ... && continue`: the failing branch of an if returns 0, while
+    // a bare `&&` list would return 1 for every non-exempt target and `set -e`
+    // would abort the fence with status 1 instead of 97.
+    `  if printf '%s\\n' "$target" | grep -Eq ${shellQuote(pattern)}; then continue; fi;`,
+    // WHY THE FLAG TEST IS GATED ON REACHABILITY, and the measurement behind it.
+    // `findmnt` lists ONE RECORD PER MOUNT, and a target can be stacked: measured
+    // on a running WSL2 distribution, `/run/user` appears TWICE (a mode=755 layer
+    // and a relatime layer on top of it) and `/proc/sys/fs/binfmt_misc/status`
+    // is a second record under a first. `mount -o remount,ro,bind "$target"` by
+    // path can only ever reach the TOPMOST mount, so the covered record keeps
+    // `rw` no matter what the sweep does — measured: after remounting the visible
+    // `/run/user`, the other record still reported `rw,relatime` while a write
+    // through the path failed EROFS, i.e. the covered record is NOT a hole (it is
+    // unreachable storage). Failing on its flag was therefore a false positive
+    // that refused every confined command, which is precisely the defect class
+    // this whole change exists to remove.
+    //
+    // `[ -w ]` on the target answers about the mount a WRITE WOULD ACTUALLY
+    // LAND ON — the topmost, reachable one — which is the question the boundary
+    // is about. So the two tests are paired rather than redundant: `[ -w ]` is
+    // the reachability and writability fact, and the flag test is applied only
+    // where the flag is the authority, i.e. on a target that is not storage. For
+    // a socket/FIFO/device, `[ -w ]` says nothing about the mount (see
+    // {@link KERNEL_SURFACES} and the module note), so the flag is what decides.
+    //
+    // WHICH test applies is decided by the inode TYPE from `stat -c %F`, NOT by
+    // `-f`/`-d`. Measured: after the fence binds the workspace onto itself, a
+    // unix socket bind-mounted UNDER the workspace answers `-f` TRUE, while the
+    // same socket answers `-f` FALSE before that bind — the shell test follows
+    // the mount the path resolves to, and the workspace bind changes what that
+    // is. Gating on `-f`/`-d` therefore sent the socket down the storage branch,
+    // where it failed with "is still writable": the issue #2 symptom this change
+    // exists to remove, reproduced by the fix itself. `stat` reports the inode
+    // class directly and is not fooled by the bind.
+    '  kind=$(stat -c %F "$target" 2>/dev/null) || kind="";',
+    '  case "$kind" in',
+    "    'regular file'|'regular empty file'|directory|'symbolic link')",
+    // Storage inode: `[ -w ]` decides. It already covers a covered record (the
+    // write would land on the reachable mount) and needs no flag test.
+    '      if [ -w "$target" ]; then fail "$target is still writable"; fi;;',
+    '    *)',
+    // Not storage, or unreadable: the mount flag decides, and it must be `ro` as
+    // a comma member (a mount's VFS options are a comma list; `ro` has no fixed
+    // position).
+    '      case ",$opts," in *,ro,*) ;; *) fail "$target is not read-only (mount options: $opts)" ;; esac;;',
+    '  esac;',
+    // The trailing `true` keeps the pipeline itself green: this while is the
+    // LAST element of a pipeline, and anything that ends the body with a
+    // non-zero status would fail the whole pipeline under `set -o pipefail` and
+    // abort the script before the command runs. A real `fail` still exits 97
+    // from inside the loop, which pipefail turns into the script's own setup
+    // failure — the marker and exit code still surface.
     '  true;',
     'done',
     'true',

package/lib/wsl/dsh-wsl-confine.sh

@@ -2,7 +2,7 @@
 # Privileged mode (-p): this script runs as root via sudo, and without -p bash would
 # source a caller-supplied BASH_ENV file BEFORE our first line, as root. The
 # startup-defence note below carries the measurement (bash 5.2.37).
-# dsh-wsl-confine v1.2 — DSH WSL confinement helper.
+# dsh-wsl-confine v1.3 — DSH WSL confinement helper.
 #
 # Root-owned fence executor: the ONLY thing this helper does is apply the
 # mount-namespace fence (workspace bind, tmpfs /tmp, read-only /, read-only
@@ -36,8 +36,8 @@
 # fence to the forged uid: root WRITE on the distribution's filesystem and on
 # /mnt/c, with only the namespace and NO_NEW_PRIVS left standing.
 #
-# This script runs as root and calls twelve tools by bare name (getent, cut, sed,
-# tr, mount, findmnt, grep, mountpoint, setpriv, env, bash, unshare). sudo's
+# This script runs as root and calls thirteen tools by bare name (getent, cut, sed,
+# tr, mount, findmnt, grep, mountpoint, setpriv, env, bash, unshare, stat). sudo's
 # env_reset does not save it: an exported PATH is replaced when sudoers sets
 # secure_path, but a PATH handed over as a sudo command-line assignment still
 # reaches us (measured on debian, debian-dev and arch), and the NOPASSWD grant is
@@ -47,7 +47,7 @@
 # here, as the FIRST statement, rather than depending on a deployment option we
 # cannot verify.
 #
-# The pin is unconditional and has NO fallback: the twelve tools must be reachable
+# The pin is unconditional and has NO fallback: the thirteen tools must be reachable
 # in these six directories. A distribution where one is not fails CLOSED - nothing
 # runs: a missing getent leaves the caller record empty and the gate refuses it, a
 # missing cut fails the pipeline under pipefail (127) before the fence, and the
@@ -88,7 +88,7 @@ export PATH
 # purpose: it must not depend on the deployment's sudoers either way.
 
 set -euo pipefail
-VERSION='dsh-wsl-confine v1.2'
+VERSION='dsh-wsl-confine v1.3'
 
 uid=; gid=; home=; cwd=; workspace=; pidns=1
 ARGS=()
@@ -170,6 +170,11 @@ fi
 command -v unshare >/dev/null 2>&1 || { echo 'dsh-wsl-sandbox: setup failed: unshare not found' >&2; exit 97; }
 command -v setpriv >/dev/null 2>&1 || { echo 'dsh-wsl-sandbox: setup failed: setpriv not found' >&2; exit 97; }
 command -v findmnt >/dev/null 2>&1 || { echo 'dsh-wsl-sandbox: setup failed: findmnt not found' >&2; exit 97; }
+# `stat` classifies the post-condition's target and is called INSIDE the fence,
+# where a bare-name lookup failure would leave kind empty — that routes to the
+# flag branch, which is fail-closed, but the report would then be a confusing
+# "not read-only" rather than the real cause. Preflight it like the others.
+command -v stat >/dev/null 2>&1 || { echo 'dsh-wsl-sandbox: setup failed: stat not found' >&2; exit 97; }
 
 # The allow-list pattern is built HERE, from the validated parameters, with every
 # entry escaped so a PATH stays data and never becomes regex syntax. Unescaped,
@@ -234,8 +239,52 @@ findmnt -rno TARGET | while IFS= read -r raw; do printf "%b\n" "$raw"; done | {
 done
 mountpoint -q /tmp || fail "/tmp is not a private tmpfs"
 findmnt -rno OPTIONS / | grep -q "^ro" || fail "/ is not read-only"
-findmnt -rno TARGET | while IFS= read -r raw; do printf "%b\n" "$raw"; done | { grep -Ev "^(${DROP_EXEMPT})\$" || fail "exemption grep failed"; } | while IFS= read -r target; do
-  [[ -w "$target" ]] && fail "$target is still writable"
+# NOTE: this block lives inside the single-quoted FENCE string. A BACKTICK here
+# would close the quoting and let bash run its contents as a command
+# substitution — measured: eight backticks around the test -w mention made the
+# helper exit 127 with "read-only: command not found" before the fence ran at
+# all. Keep this comment free of backticks and of single quotes.
+# The postcondition pairs two tests, and each is load-bearing where the other is
+# blind. A target can be STACKED — findmnt lists one record per mount — and
+# remount,ro,bind by path only ever reaches the TOPMOST one (measured: after
+# remounting /run/user, a covered record still reported rw while a write through
+# the path failed EROFS — unreachable storage, not a hole). So:
+#   * a REGULAR FILE or DIRECTORY is judged by test -w: it answers about the
+#     mount a write would actually land on, covered record or not;
+#   * anything else (socket, FIFO, device) is judged by the MOUNT FLAG, because
+#     test -w is meaningless there: access(W_OK) narrows the kernel read-only
+#     answer to S_ISREG/S_ISDIR/S_ISLNK (sb_permission), do_faccessat() adds a
+#     special_file() exclusion, and this fragment runs as root (CAP_DAC_OVERRIDE)
+#     before the setpriv drop. A socket therefore reported "writable" on a mount
+#     that WAS remounted read-only: measured as exit 97 for the unix socket under
+#     /mnt/wsl/podman-sockets with podman machine running, refusing every
+#     confined command including a bare true (github issue #2).
+findmnt -rno TARGET,OPTIONS | while IFS=" " read -r raw opts; do
+  target=$(printf "%b" "$raw")
+  if printf "%s\n" "$target" | grep -Eq "^(${DROP_EXEMPT})\$"; then continue; fi
+  # WHICH test applies is decided by the inode TYPE, read from stat, and NOT by
+  # the -f/-d shell tests. Measured: after the fence binds the workspace onto
+  # itself, a unix socket bind-mounted UNDER the workspace answers -f TRUE, while
+  # the same socket answers -f FALSE before that bind — the shell test follows the
+  # mount the path resolves to and the workspace bind changes what that is. So
+  # -f/-d cannot tell "storage" from "special file" here, and using them sent the
+  # socket down the -w branch, where it failed with "is still writable" exactly as
+  # issue #2 reported. stat -c %F reports the inode class directly.
+  kind=$(stat -c %F "$target" 2>/dev/null) || kind=""
+  # NOTE: double quotes, never single: this block is inside the single-quoted
+  # FENCE string, so a single quote would close it. The case PATTERNS below are
+  # matched literally, so their quoting form is part of the comparison.
+  case "$kind" in
+    "regular file"|"regular empty file"|directory|"symbolic link")
+      # Storage: test -w answers about the mount a write would actually land on.
+      if [[ -w "$target" ]]; then fail "$target is still writable"; fi
+      ;;
+    *)
+      # Not storage (socket, fifo, device, or unreadable): the mount FLAG decides.
+      # Comma-delimited membership, not a ^ro prefix: ro is not pinned to a position.
+      case ",$opts," in *,ro,*) ;; *) fail "$target is not read-only (mount options: $opts)" ;; esac
+      ;;
+  esac
   true
 done
 cd "$DROP_CWD"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-wsl-desktop",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "type": "module",
   "main": "lib/index.js",
   "icon": "./lib/icon.svg",