dsh-wsl-desktop 0.7.5 → 0.7.6

package/lib/wsl/confinement.js

@@ -765,15 +765,28 @@ function postConditions(keep) {
     // where the flag is the authority, i.e. on a target that is not storage. For
     // a socket/FIFO/device, `[ -w ]` says nothing about the mount (see
     // {@link KERNEL_SURFACES} and the module note), so the flag is what decides.
-    '  if [ -d "$target" ] || [ -f "$target" ]; then',
+    //
+    // WHICH test applies is decided by the inode TYPE from `stat -c %F`, NOT by
+    // `-f`/`-d`. Measured: after the fence binds the workspace onto itself, a
+    // unix socket bind-mounted UNDER the workspace answers `-f` TRUE, while the
+    // same socket answers `-f` FALSE before that bind — the shell test follows
+    // the mount the path resolves to, and the workspace bind changes what that
+    // is. Gating on `-f`/`-d` therefore sent the socket down the storage branch,
+    // where it failed with "is still writable": the issue #2 symptom this change
+    // exists to remove, reproduced by the fix itself. `stat` reports the inode
+    // class directly and is not fooled by the bind.
+    '  kind=$(stat -c %F "$target" 2>/dev/null) || kind="";',
+    '  case "$kind" in',
+    "    'regular file'|'regular empty file'|directory|'symbolic link')",
     // Storage inode: `[ -w ]` decides. It already covers a covered record (the
     // write would land on the reachable mount) and needs no flag test.
-    '    if [ -w "$target" ]; then fail "$target is still writable"; fi;',
-    '  else',
-    // Not storage: the mount flag decides, and it must be `ro` as a comma member
-    // (a mount's VFS options are a comma list; `ro` is not pinned to a position).
-    '    case ",$opts," in *,ro,*) ;; *) fail "$target is not read-only (mount options: $opts)" ;; esac;',
-    '  fi;',
+    '      if [ -w "$target" ]; then fail "$target is still writable"; fi;;',
+    '    *)',
+    // Not storage, or unreadable: the mount flag decides, and it must be `ro` as
+    // a comma member (a mount's VFS options are a comma list; `ro` has no fixed
+    // position).
+    '      case ",$opts," in *,ro,*) ;; *) fail "$target is not read-only (mount options: $opts)" ;; esac;;',
+    '  esac;',
     // The trailing `true` keeps the pipeline itself green: this while is the
     // LAST element of a pipeline, and anything that ends the body with a
     // non-zero status would fail the whole pipeline under `set -o pipefail` and

package/lib/wsl/dsh-wsl-confine.sh

@@ -36,8 +36,8 @@
 # fence to the forged uid: root WRITE on the distribution's filesystem and on
 # /mnt/c, with only the namespace and NO_NEW_PRIVS left standing.
 #
-# This script runs as root and calls twelve tools by bare name (getent, cut, sed,
-# tr, mount, findmnt, grep, mountpoint, setpriv, env, bash, unshare). sudo's
+# This script runs as root and calls thirteen tools by bare name (getent, cut, sed,
+# tr, mount, findmnt, grep, mountpoint, setpriv, env, bash, unshare, stat). sudo's
 # env_reset does not save it: an exported PATH is replaced when sudoers sets
 # secure_path, but a PATH handed over as a sudo command-line assignment still
 # reaches us (measured on debian, debian-dev and arch), and the NOPASSWD grant is
@@ -47,7 +47,7 @@
 # here, as the FIRST statement, rather than depending on a deployment option we
 # cannot verify.
 #
-# The pin is unconditional and has NO fallback: the twelve tools must be reachable
+# The pin is unconditional and has NO fallback: the thirteen tools must be reachable
 # in these six directories. A distribution where one is not fails CLOSED - nothing
 # runs: a missing getent leaves the caller record empty and the gate refuses it, a
 # missing cut fails the pipeline under pipefail (127) before the fence, and the
@@ -170,6 +170,11 @@ fi
 command -v unshare >/dev/null 2>&1 || { echo 'dsh-wsl-sandbox: setup failed: unshare not found' >&2; exit 97; }
 command -v setpriv >/dev/null 2>&1 || { echo 'dsh-wsl-sandbox: setup failed: setpriv not found' >&2; exit 97; }
 command -v findmnt >/dev/null 2>&1 || { echo 'dsh-wsl-sandbox: setup failed: findmnt not found' >&2; exit 97; }
+# `stat` classifies the post-condition's target and is called INSIDE the fence,
+# where a bare-name lookup failure would leave kind empty — that routes to the
+# flag branch, which is fail-closed, but the report would then be a confusing
+# "not read-only" rather than the real cause. Preflight it like the others.
+command -v stat >/dev/null 2>&1 || { echo 'dsh-wsl-sandbox: setup failed: stat not found' >&2; exit 97; }
 
 # The allow-list pattern is built HERE, from the validated parameters, with every
 # entry escaped so a PATH stays data and never becomes regex syntax. Unescaped,
@@ -234,30 +239,52 @@ findmnt -rno TARGET | while IFS= read -r raw; do printf "%b\n" "$raw"; done | {
 done
 mountpoint -q /tmp || fail "/tmp is not a private tmpfs"
 findmnt -rno OPTIONS / | grep -q "^ro" || fail "/ is not read-only"
+# NOTE: this block lives inside the single-quoted FENCE string. A BACKTICK here
+# would close the quoting and let bash run its contents as a command
+# substitution — measured: eight backticks around the test -w mention made the
+# helper exit 127 with "read-only: command not found" before the fence ran at
+# all. Keep this comment free of backticks and of single quotes.
 # The postcondition pairs two tests, and each is load-bearing where the other is
 # blind. A target can be STACKED — findmnt lists one record per mount — and
-# `remount,ro,bind` by path only ever reaches the TOPMOST one (measured: after
+# remount,ro,bind by path only ever reaches the TOPMOST one (measured: after
 # remounting /run/user, a covered record still reported rw while a write through
 # the path failed EROFS — unreachable storage, not a hole). So:
-#   * a REGULAR FILE or DIRECTORY is judged by `[ -w ]`: it answers about the
+#   * a REGULAR FILE or DIRECTORY is judged by test -w: it answers about the
 #     mount a write would actually land on, covered record or not;
 #   * anything else (socket, FIFO, device) is judged by the MOUNT FLAG, because
-#     `[ -w ]` is meaningless there: access(W_OK) narrows the kernel's read-only
+#     test -w is meaningless there: access(W_OK) narrows the kernel read-only
 #     answer to S_ISREG/S_ISDIR/S_ISLNK (sb_permission), do_faccessat() adds a
 #     special_file() exclusion, and this fragment runs as root (CAP_DAC_OVERRIDE)
 #     before the setpriv drop. A socket therefore reported "writable" on a mount
 #     that WAS remounted read-only: measured as exit 97 for the unix socket under
 #     /mnt/wsl/podman-sockets with podman machine running, refusing every
-#     confined command including a bare `true` (github issue #2).
+#     confined command including a bare true (github issue #2).
 findmnt -rno TARGET,OPTIONS | while IFS=" " read -r raw opts; do
   target=$(printf "%b" "$raw")
   if printf "%s\n" "$target" | grep -Eq "^(${DROP_EXEMPT})\$"; then continue; fi
-  if [[ -d "$target" || -f "$target" ]]; then
-    if [[ -w "$target" ]]; then fail "$target is still writable"; fi
-  else
-    # Comma-delimited membership, not a ^ro prefix: ro is not pinned to a position.
-    case ",$opts," in *,ro,*) ;; *) fail "$target is not read-only (mount options: $opts)" ;; esac
-  fi
+  # WHICH test applies is decided by the inode TYPE, read from stat, and NOT by
+  # the -f/-d shell tests. Measured: after the fence binds the workspace onto
+  # itself, a unix socket bind-mounted UNDER the workspace answers -f TRUE, while
+  # the same socket answers -f FALSE before that bind — the shell test follows the
+  # mount the path resolves to and the workspace bind changes what that is. So
+  # -f/-d cannot tell "storage" from "special file" here, and using them sent the
+  # socket down the -w branch, where it failed with "is still writable" exactly as
+  # issue #2 reported. stat -c %F reports the inode class directly.
+  kind=$(stat -c %F "$target" 2>/dev/null) || kind=""
+  # NOTE: double quotes, never single: this block is inside the single-quoted
+  # FENCE string, so a single quote would close it. The case PATTERNS below are
+  # matched literally, so their quoting form is part of the comparison.
+  case "$kind" in
+    "regular file"|"regular empty file"|directory|"symbolic link")
+      # Storage: test -w answers about the mount a write would actually land on.
+      if [[ -w "$target" ]]; then fail "$target is still writable"; fi
+      ;;
+    *)
+      # Not storage (socket, fifo, device, or unreadable): the mount FLAG decides.
+      # Comma-delimited membership, not a ^ro prefix: ro is not pinned to a position.
+      case ",$opts," in *,ro,*) ;; *) fail "$target is not read-only (mount options: $opts)" ;; esac
+      ;;
+  esac
   true
 done
 cd "$DROP_CWD"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-wsl-desktop",
-  "version": "0.7.5",
+  "version": "0.7.6",
   "type": "module",
   "main": "lib/index.js",
   "icon": "./lib/icon.svg",