WasmFS: chdir() and path lookup ignore directory search (execute) permission

Abierto
  • ¿Algo no está bien?
#27,829 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
88/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
cpp, wasm
Área
operating-systems

Línea de trabajo

Start with path resolution in system/lib/wasmfs/paths.cpp and chdir handling in system/lib/wasmfs/syscalls.cpp, then compare the existing access() permission check. Run the provided search_perm.c case and relevant test/wasmfs and test/unistd/access.c tests. Done means lookups through non-searchable directories and chdir report EACCES consistently with the JS file system.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

WasmFS never checks search (execute) permission on directories. chdir() into a directory without x succeeds, and so does any lookup through one (stat, open, …). The JS file system returns EACCES for all of these. So does WasmFS's own access(dir, X_OK), which disagrees with what chdir() then does.

Version of emscripten/emsdk:

emcc (Emscripten gcc/clang-like replacement + linker emulating GNU ld) 6.0.9-git
clang version 22.1.8
Target: wasm32-unknown-emscripten
Thread model: posix
InstalledDir: /nix/store/a0h9ym1ai9yawkmymx2wp0vnh64hsv0r-clang-22.1.8/bin

This is the 6.0.9 release tag as packaged by nixpkgs. nixpkgs builds it against its own LLVM 22.1.8, so there is no commit hash. Node.js v24.20.0, x86_64 Linux.

Test case (search_perm.c):

#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <unistd.h>

static void report(const char *what, int r) {
  printf("%-40s %s\n", what, r < 0 ? strerror(errno) : "succeeded");
}

int main(void) {
  printf("uid %d\n", (int)getuid());
  mkdir("/d", 0777);
  close(open("/d/f", O_CREAT | O_WRONLY, 0666));
  /* Readable and writable, but not searchable. */
  chmod("/d", 0666);

  struct stat st;
  errno = 0;
  report("stat(\"/d/f\")", stat("/d/f", &st));
  errno = 0;
  int fd = open("/d/f", O_RDONLY);
  report("open(\"/d/f\", O_RDONLY)", fd);
  if (fd >= 0)
    close(fd);
  errno = 0;
  report("access(\"/d\", X_OK)", access("/d", X_OK));
  errno = 0;
  report("chdir(\"/d\")", chdir("/d"));
  return 0;
}

Failing command line in full (the same at -O2):

$ emcc -O0 -sWASMFS search_perm.c -o search_perm.js && node search_perm.js
uid 0
stat("/d/f")                             succeeded
open("/d/f", O_RDONLY)                   succeeded
access("/d", X_OK)                       Permission denied
chdir("/d")                              succeeded

Expected, as with the JS file system:

$ emcc -O0 search_perm.c -o search_perm.js && node search_perm.js
uid 0
stat("/d/f")                             Permission denied
open("/d/f", O_RDONLY)                   Permission denied
access("/d", X_OK)                       Permission denied
chdir("/d")                              Permission denied

Both file systems report uid 0. Linux would let root through, but Emscripten enforces permission bits regardless (the JS FS here, and WasmFS's own open, mkdir, unlink and access), ignoring ownership. So this is about WasmFS being consistent with itself and with the JS FS.

Full compile and link output with -v appended (cache and scratch paths shortened) 
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/clang -target wasm32-unknown-emscripten -fignore-exceptions -mllvm -combiner-global-alias-analysis=false -mllvm -enable-emscripten-sjlj -mllvm -disable-lsr --sysroot=$EM_CACHE/sysroot -resource-dir=/nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/ -idirafter$EM_CACHE/sysroot/include -iwithsysroot/include/c++/v1 -Xclang -iwithsysroot/include/fakesdl -Xclang -iwithsysroot/include/compat -v -O0 -c search_perm.c -o /tmp/emscripten_temp_vvo31o3a/search_perm.o
clang version 22.1.8
Target: wasm32-unknown-emscripten
Thread model: posix
InstalledDir: /nix/store/a0h9ym1ai9yawkmymx2wp0vnh64hsv0r-clang-22.1.8/bin
 (in-process)
 "/nix/store/a0h9ym1ai9yawkmymx2wp0vnh64hsv0r-clang-22.1.8/bin/clang-22" -cc1 -triple wasm32-unknown-emscripten -O0 -emit-obj -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name search_perm.c -mrelocation-model static -mframe-pointer=none -ffp-contract=on -fno-rounding-math -mconstructor-aliases -target-cpu generic -fvisibility=hidden -debugger-tuning=gdb -fdebug-compilation-dir=. -v -fcoverage-compilation-dir=. -resource-dir /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/ -idirafter $EM_CACHE/sysroot/include -iwithsysroot /include/c++/v1 -isysroot $EM_CACHE/sysroot -internal-isystem /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/include -internal-isystem $EM_CACHE/sysroot/include/wasm32-emscripten -internal-isystem $EM_CACHE/sysroot/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fignore-exceptions -iwithsysroot/include/fakesdl -iwithsysroot/include/compat -mllvm -combiner-global-alias-analysis=false -mllvm -enable-emscripten-sjlj -mllvm -disable-lsr -o /tmp/emscripten_temp_vvo31o3a/search_perm.o -x c search_perm.c
clang -cc1 version 22.1.8 based upon LLVM 22.1.8 default target x86_64-unknown-linux-gnu
ignoring nonexistent directory "$EM_CACHE/sysroot/include/wasm32-emscripten"
ignoring duplicate directory "$EM_CACHE/sysroot/include"
#include "..." search starts here:
#include <...> search starts here:
 $EM_CACHE/sysroot/include/c++/v1
 $EM_CACHE/sysroot/include/fakesdl
 $EM_CACHE/sysroot/include/compat
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/include
 $EM_CACHE/sysroot/include
End of search list.
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/clang --version
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/wasm-ld -o search_perm.wasm /tmp/tmpnsyiy5q0libemscripten_js_symbols.so -Bstatic --strip-debug --export=emscripten_stack_get_end --export=emscripten_stack_get_free --export=emscripten_stack_get_base --export=emscripten_stack_get_current --export=emscripten_stack_init --export=wasmfs_flush --export=_emscripten_stack_alloc --export=__wasm_call_ctors --export=_emscripten_stack_restore --export-if-defined=__start_em_asm --export-if-defined=__stop_em_asm --export-if-defined=__start_em_lib_deps --export-if-defined=__stop_em_lib_deps --export-if-defined=__start_em_js --export-if-defined=__stop_em_js --export-if-defined=main --export-if-defined=__main_argc_argv --export-if-defined=fflush --export-table -z stack-size=65536 --no-growable-memory --initial-heap=16777216 --no-entry --stack-first --table-base=1 /tmp/emscripten_temp_vvo31o3a/search_perm.o -L$EM_CACHE/sysroot/lib/wasm32-emscripten -L/nix/store/03iyrnrsxnbc64y6r62irmlbnbap5ya2-emscripten-6.0.9/share/emscripten/src/lib -lGL-getprocaddr -lal -lhtml5 -lstubs-debug -lnoexit -lc-debug -ldlmalloc-debug -lclang_rt.builtins -lc++-debug-noexcept -lc++abi-debug-noexcept -lsockets -lwasmfs_no_fs -lwasmfs-debug -mllvm -combiner-global-alias-analysis=false -mllvm -enable-emscripten-sjlj -mllvm -disable-lsr
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/llvm-objcopy search_perm.wasm search_perm.wasm '--remove-section=llvm.func_attr.annotate.*' --remove-section=producers --remove-section=name '--remove-section=.debug*'

Where:

Suggested fix: check search permission on every directory a lookup passes through, including the one the last component is looked up in, and on the target of chdir/fchdir.

--- a/system/lib/wasmfs/paths.cpp
+++ b/system/lib/wasmfs/paths.cpp
@@ -93,6 +93,11 @@
       path.remove_prefix(1);
     }

+    // Looking up anything in a directory needs search permission on it.
+    if (!(curr->locked().getMode() & S_IXUGO)) {
+      return -EACCES;
+    }
+
     // If this is the leaf segment, return.
     size_t segment_end = path.find_first_of('/');
     if (segment_end == std::string_view::npos) {
@@ -100,7 +105,6 @@
     }

     // Try to descend into the child segment.
-    // TODO: Check permissions on intermediate directories.
     auto segment = path.substr(0, segment_end);
     auto child = getChild(curr, segment, FollowLinks, recursions);
     if (auto err = child.getError()) {

--- a/system/lib/wasmfs/syscalls.cpp
+++ b/system/lib/wasmfs/syscalls.cpp
@@ -733,6 +733,9 @@
   if (!dir) {
     return -ENOTDIR;
   }
+  if (!(dir->locked().getMode() & WASMFS_PERM_EXECUTE)) {
+    return -EACCES;
+  }
   wasmFS.setCWD(dir);
   return 0;
 }

With both applied to 6.0.9, the test case matches the JS FS:

uid 0
stat("/d/f")                             Permission denied
open("/d/f", O_RDONLY)                   Permission denied
access("/d", X_OK)                       Permission denied
chdir("/d")                              Permission denied

Several test/wasmfs/*.c programs (chdir, mkdir, dup, getdents, seek, open_append, fdatasync, chown) and test/unistd/access.c give the same results with and without the patch. We didn't run the full suite.

Lenguaje dominante
C++
Estrellas
27.8k
Forks
3.6k
Merge medio
1 d 6 h
PR fusionados (30 d)
181

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de emscripten-core/emscripten

Todos los issues de emscripten-core/emscripten

Issues similares

Más issues de C++

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.