WasmFS: chdir() and path lookup ignore directory search (execute) permission

オープン
  • 何か問題がありますか？
#27,829 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
88/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
cpp, wasm
領域
operating-systems

調査の方向性

Start with path resolution in system/lib/wasmfs/paths.cpp and chdir handling in system/lib/wasmfs/syscalls.cpp, then compare the existing access() permission check. Run the provided search_perm.c case and relevant test/wasmfs and test/unistd/access.c tests. Done means lookups through non-searchable directories and chdir report EACCES consistently with the JS file system.

索引モデルが issue の本文から書いたものです。

説明

WasmFS never checks search (execute) permission on directories. chdir() into a directory without x succeeds, and so does any lookup through one (stat, open, …). The JS file system returns EACCES for all of these. So does WasmFS's own access(dir, X_OK), which disagrees with what chdir() then does.

Version of emscripten/emsdk:

emcc (Emscripten gcc/clang-like replacement + linker emulating GNU ld) 6.0.9-git
clang version 22.1.8
Target: wasm32-unknown-emscripten
Thread model: posix
InstalledDir: /nix/store/a0h9ym1ai9yawkmymx2wp0vnh64hsv0r-clang-22.1.8/bin

This is the 6.0.9 release tag as packaged by nixpkgs. nixpkgs builds it against its own LLVM 22.1.8, so there is no commit hash. Node.js v24.20.0, x86_64 Linux.

Test case (search_perm.c):

#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <unistd.h>

static void report(const char *what, int r) {
  printf("%-40s %s\n", what, r < 0 ? strerror(errno) : "succeeded");
}

int main(void) {
  printf("uid %d\n", (int)getuid());
  mkdir("/d", 0777);
  close(open("/d/f", O_CREAT | O_WRONLY, 0666));
  /* Readable and writable, but not searchable. */
  chmod("/d", 0666);

  struct stat st;
  errno = 0;
  report("stat(\"/d/f\")", stat("/d/f", &st));
  errno = 0;
  int fd = open("/d/f", O_RDONLY);
  report("open(\"/d/f\", O_RDONLY)", fd);
  if (fd >= 0)
    close(fd);
  errno = 0;
  report("access(\"/d\", X_OK)", access("/d", X_OK));
  errno = 0;
  report("chdir(\"/d\")", chdir("/d"));
  return 0;
}

Failing command line in full (the same at -O2):

$ emcc -O0 -sWASMFS search_perm.c -o search_perm.js && node search_perm.js
uid 0
stat("/d/f")                             succeeded
open("/d/f", O_RDONLY)                   succeeded
access("/d", X_OK)                       Permission denied
chdir("/d")                              succeeded

Expected, as with the JS file system:

$ emcc -O0 search_perm.c -o search_perm.js && node search_perm.js
uid 0
stat("/d/f")                             Permission denied
open("/d/f", O_RDONLY)                   Permission denied
access("/d", X_OK)                       Permission denied
chdir("/d")                              Permission denied

Both file systems report uid 0. Linux would let root through, but Emscripten enforces permission bits regardless (the JS FS here, and WasmFS's own open, mkdir, unlink and access), ignoring ownership. So this is about WasmFS being consistent with itself and with the JS FS.

Full compile and link output with -v appended (cache and scratch paths shortened) 
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/clang -target wasm32-unknown-emscripten -fignore-exceptions -mllvm -combiner-global-alias-analysis=false -mllvm -enable-emscripten-sjlj -mllvm -disable-lsr --sysroot=$EM_CACHE/sysroot -resource-dir=/nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/ -idirafter$EM_CACHE/sysroot/include -iwithsysroot/include/c++/v1 -Xclang -iwithsysroot/include/fakesdl -Xclang -iwithsysroot/include/compat -v -O0 -c search_perm.c -o /tmp/emscripten_temp_vvo31o3a/search_perm.o
clang version 22.1.8
Target: wasm32-unknown-emscripten
Thread model: posix
InstalledDir: /nix/store/a0h9ym1ai9yawkmymx2wp0vnh64hsv0r-clang-22.1.8/bin
 (in-process)
 "/nix/store/a0h9ym1ai9yawkmymx2wp0vnh64hsv0r-clang-22.1.8/bin/clang-22" -cc1 -triple wasm32-unknown-emscripten -O0 -emit-obj -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name search_perm.c -mrelocation-model static -mframe-pointer=none -ffp-contract=on -fno-rounding-math -mconstructor-aliases -target-cpu generic -fvisibility=hidden -debugger-tuning=gdb -fdebug-compilation-dir=. -v -fcoverage-compilation-dir=. -resource-dir /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/ -idirafter $EM_CACHE/sysroot/include -iwithsysroot /include/c++/v1 -isysroot $EM_CACHE/sysroot -internal-isystem /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/include -internal-isystem $EM_CACHE/sysroot/include/wasm32-emscripten -internal-isystem $EM_CACHE/sysroot/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fignore-exceptions -iwithsysroot/include/fakesdl -iwithsysroot/include/compat -mllvm -combiner-global-alias-analysis=false -mllvm -enable-emscripten-sjlj -mllvm -disable-lsr -o /tmp/emscripten_temp_vvo31o3a/search_perm.o -x c search_perm.c
clang -cc1 version 22.1.8 based upon LLVM 22.1.8 default target x86_64-unknown-linux-gnu
ignoring nonexistent directory "$EM_CACHE/sysroot/include/wasm32-emscripten"
ignoring duplicate directory "$EM_CACHE/sysroot/include"
#include "..." search starts here:
#include <...> search starts here:
 $EM_CACHE/sysroot/include/c++/v1
 $EM_CACHE/sysroot/include/fakesdl
 $EM_CACHE/sysroot/include/compat
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/include
 $EM_CACHE/sysroot/include
End of search list.
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/clang --version
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/wasm-ld -o search_perm.wasm /tmp/tmpnsyiy5q0libemscripten_js_symbols.so -Bstatic --strip-debug --export=emscripten_stack_get_end --export=emscripten_stack_get_free --export=emscripten_stack_get_base --export=emscripten_stack_get_current --export=emscripten_stack_init --export=wasmfs_flush --export=_emscripten_stack_alloc --export=__wasm_call_ctors --export=_emscripten_stack_restore --export-if-defined=__start_em_asm --export-if-defined=__stop_em_asm --export-if-defined=__start_em_lib_deps --export-if-defined=__stop_em_lib_deps --export-if-defined=__start_em_js --export-if-defined=__stop_em_js --export-if-defined=main --export-if-defined=__main_argc_argv --export-if-defined=fflush --export-table -z stack-size=65536 --no-growable-memory --initial-heap=16777216 --no-entry --stack-first --table-base=1 /tmp/emscripten_temp_vvo31o3a/search_perm.o -L$EM_CACHE/sysroot/lib/wasm32-emscripten -L/nix/store/03iyrnrsxnbc64y6r62irmlbnbap5ya2-emscripten-6.0.9/share/emscripten/src/lib -lGL-getprocaddr -lal -lhtml5 -lstubs-debug -lnoexit -lc-debug -ldlmalloc-debug -lclang_rt.builtins -lc++-debug-noexcept -lc++abi-debug-noexcept -lsockets -lwasmfs_no_fs -lwasmfs-debug -mllvm -combiner-global-alias-analysis=false -mllvm -enable-emscripten-sjlj -mllvm -disable-lsr
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/llvm-objcopy search_perm.wasm search_perm.wasm '--remove-section=llvm.func_attr.annotate.*' --remove-section=producers --remove-section=name '--remove-section=.debug*'

Where:

Suggested fix: check search permission on every directory a lookup passes through, including the one the last component is looked up in, and on the target of chdir/fchdir.

--- a/system/lib/wasmfs/paths.cpp
+++ b/system/lib/wasmfs/paths.cpp
@@ -93,6 +93,11 @@
       path.remove_prefix(1);
     }

+    // Looking up anything in a directory needs search permission on it.
+    if (!(curr->locked().getMode() & S_IXUGO)) {
+      return -EACCES;
+    }
+
     // If this is the leaf segment, return.
     size_t segment_end = path.find_first_of('/');
     if (segment_end == std::string_view::npos) {
@@ -100,7 +105,6 @@
     }

     // Try to descend into the child segment.
-    // TODO: Check permissions on intermediate directories.
     auto segment = path.substr(0, segment_end);
     auto child = getChild(curr, segment, FollowLinks, recursions);
     if (auto err = child.getError()) {

--- a/system/lib/wasmfs/syscalls.cpp
+++ b/system/lib/wasmfs/syscalls.cpp
@@ -733,6 +733,9 @@
   if (!dir) {
     return -ENOTDIR;
   }
+  if (!(dir->locked().getMode() & WASMFS_PERM_EXECUTE)) {
+    return -EACCES;
+  }
   wasmFS.setCWD(dir);
   return 0;
 }

With both applied to 6.0.9, the test case matches the JS FS:

uid 0
stat("/d/f")                             Permission denied
open("/d/f", O_RDONLY)                   Permission denied
access("/d", X_OK)                       Permission denied
chdir("/d")                              Permission denied

Several test/wasmfs/*.c programs (chdir, mkdir, dup, getdents, seek, open_append, fdatasync, chown) and test/unistd/access.c give the same results with and without the patch. We didn't run the full suite.

主要言語
C++
スター
27.8k
フォーク
3.6k
平均マージ
1日 6時間
マージ済み PR（30日）
181

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

emscripten-core/emscripten のほかの issue

emscripten-core/emscripten の issue をすべて見る

似ている issue

C++ の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。