WasmFS: chdir() and path lookup ignore directory search (execute) permission

Start with path resolution in system/lib/wasmfs/paths.cpp and chdir handling in system/lib/wasmfs/syscalls.cpp, then compare the existing access() permission check. Run the provided search_perm.c case and relevant test/wasmfs and test/unistd/access.c tests. Done means lookups through non-searchable directories and chdir report EACCES consistently with the JS file system.

WasmFS never checks search (execute) permission on directories. chdir() into a directory without x succeeds, and so does any lookup through one (stat, open, …). The JS file system returns EACCES for all of these. So does WasmFS's own access(dir, X_OK), which disagrees with what chdir() then does.

Version of emscripten/emsdk:

emcc (Emscripten gcc/clang-like replacement + linker emulating GNU ld) 6.0.9-git
clang version 22.1.8
Target: wasm32-unknown-emscripten
Thread model: posix
InstalledDir: /nix/store/a0h9ym1ai9yawkmymx2wp0vnh64hsv0r-clang-22.1.8/bin

This is the 6.0.9 release tag as packaged by nixpkgs. nixpkgs builds it against its own LLVM 22.1.8, so there is no commit hash. Node.js v24.20.0, x86_64 Linux.

Test case (search_perm.c):

#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <unistd.h>

static void report(const char *what, int r) {
  printf("%-40s %s\n", what, r < 0 ? strerror(errno) : "succeeded");
}

int main(void) {
  printf("uid %d\n", (int)getuid());
  mkdir("/d", 0777);
  close(open("/d/f", O_CREAT | O_WRONLY, 0666));
  /* Readable and writable, but not searchable. */
  chmod("/d", 0666);

  struct stat st;
  errno = 0;
  report("stat(\"/d/f\")", stat("/d/f", &st));
  errno = 0;
  int fd = open("/d/f", O_RDONLY);
  report("open(\"/d/f\", O_RDONLY)", fd);
  if (fd >= 0)
    close(fd);
  errno = 0;
  report("access(\"/d\", X_OK)", access("/d", X_OK));
  errno = 0;
  report("chdir(\"/d\")", chdir("/d"));
  return 0;
}

Failing command line in full (the same at -O2):

$ emcc -O0 -sWASMFS search_perm.c -o search_perm.js && node search_perm.js
uid 0
stat("/d/f")                             succeeded
open("/d/f", O_RDONLY)                   succeeded
access("/d", X_OK)                       Permission denied
chdir("/d")                              succeeded

Expected, as with the JS file system:

$ emcc -O0 search_perm.c -o search_perm.js && node search_perm.js
uid 0
stat("/d/f")                             Permission denied
open("/d/f", O_RDONLY)                   Permission denied
access("/d", X_OK)                       Permission denied
chdir("/d")                              Permission denied

Both file systems report uid 0. Linux would let root through, but Emscripten enforces permission bits regardless (the JS FS here, and WasmFS's own open, mkdir, unlink and access), ignoring ownership. So this is about WasmFS being consistent with itself and with the JS FS.

 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/clang -target wasm32-unknown-emscripten -fignore-exceptions -mllvm -combiner-global-alias-analysis=false -mllvm -enable-emscripten-sjlj -mllvm -disable-lsr --sysroot=$EM_CACHE/sysroot -resource-dir=/nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/ -idirafter$EM_CACHE/sysroot/include -iwithsysroot/include/c++/v1 -Xclang -iwithsysroot/include/fakesdl -Xclang -iwithsysroot/include/compat -v -O0 -c search_perm.c -o /tmp/emscripten_temp_vvo31o3a/search_perm.o
clang version 22.1.8
Target: wasm32-unknown-emscripten
Thread model: posix
InstalledDir: /nix/store/a0h9ym1ai9yawkmymx2wp0vnh64hsv0r-clang-22.1.8/bin
 (in-process)
 "/nix/store/a0h9ym1ai9yawkmymx2wp0vnh64hsv0r-clang-22.1.8/bin/clang-22" -cc1 -triple wasm32-unknown-emscripten -O0 -emit-obj -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name search_perm.c -mrelocation-model static -mframe-pointer=none -ffp-contract=on -fno-rounding-math -mconstructor-aliases -target-cpu generic -fvisibility=hidden -debugger-tuning=gdb -fdebug-compilation-dir=. -v -fcoverage-compilation-dir=. -resource-dir /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/ -idirafter $EM_CACHE/sysroot/include -iwithsysroot /include/c++/v1 -isysroot $EM_CACHE/sysroot -internal-isystem /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/include -internal-isystem $EM_CACHE/sysroot/include/wasm32-emscripten -internal-isystem $EM_CACHE/sysroot/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fignore-exceptions -iwithsysroot/include/fakesdl -iwithsysroot/include/compat -mllvm -combiner-global-alias-analysis=false -mllvm -enable-emscripten-sjlj -mllvm -disable-lsr -o /tmp/emscripten_temp_vvo31o3a/search_perm.o -x c search_perm.c
clang -cc1 version 22.1.8 based upon LLVM 22.1.8 default target x86_64-unknown-linux-gnu
ignoring nonexistent directory "$EM_CACHE/sysroot/include/wasm32-emscripten"
ignoring duplicate directory "$EM_CACHE/sysroot/include"
#include "..." search starts here:
#include <...> search starts here:
 $EM_CACHE/sysroot/include/c++/v1
 $EM_CACHE/sysroot/include/fakesdl
 $EM_CACHE/sysroot/include/compat
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/lib/clang/22/include
 $EM_CACHE/sysroot/include
End of search list.
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/clang --version
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/wasm-ld -o search_perm.wasm /tmp/tmpnsyiy5q0libemscripten_js_symbols.so -Bstatic --strip-debug --export=emscripten_stack_get_end --export=emscripten_stack_get_free --export=emscripten_stack_get_base --export=emscripten_stack_get_current --export=emscripten_stack_init --export=wasmfs_flush --export=_emscripten_stack_alloc --export=__wasm_call_ctors --export=_emscripten_stack_restore --export-if-defined=__start_em_asm --export-if-defined=__stop_em_asm --export-if-defined=__start_em_lib_deps --export-if-defined=__stop_em_lib_deps --export-if-defined=__start_em_js --export-if-defined=__stop_em_js --export-if-defined=main --export-if-defined=__main_argc_argv --export-if-defined=fflush --export-table -z stack-size=65536 --no-growable-memory --initial-heap=16777216 --no-entry --stack-first --table-base=1 /tmp/emscripten_temp_vvo31o3a/search_perm.o -L$EM_CACHE/sysroot/lib/wasm32-emscripten -L/nix/store/03iyrnrsxnbc64y6r62irmlbnbap5ya2-emscripten-6.0.9/share/emscripten/src/lib -lGL-getprocaddr -lal -lhtml5 -lstubs-debug -lnoexit -lc-debug -ldlmalloc-debug -lclang_rt.builtins -lc++-debug-noexcept -lc++abi-debug-noexcept -lsockets -lwasmfs_no_fs -lwasmfs-debug -mllvm -combiner-global-alias-analysis=false -mllvm -enable-emscripten-sjlj -mllvm -disable-lsr
 /nix/store/l05jw62495v8gcd0f2r01klky8i5k52i-emscripten-llvm-6.0.9/bin/llvm-objcopy search_perm.wasm search_perm.wasm '--remove-section=llvm.func_attr.annotate.*' --remove-section=producers --remove-section=name '--remove-section=.debug*'

Where:

• Path resolution has // TODO: Check permissions on intermediate directories. (paths.cpp#L103).
• doChdir checks only that the target is a directory (syscalls.cpp#L731-L738).
• access() does check X_OK (syscalls.cpp#L1266).

Suggested fix: check search permission on every directory a lookup passes through, including the one the last component is looked up in, and on the target of chdir/fchdir.

--- a/system/lib/wasmfs/paths.cpp
+++ b/system/lib/wasmfs/paths.cpp
@@ -93,6 +93,11 @@
       path.remove_prefix(1);
     }

+    // Looking up anything in a directory needs search permission on it.
+    if (!(curr->locked().getMode() & S_IXUGO)) {
+      return -EACCES;
+    }
+
     // If this is the leaf segment, return.
     size_t segment_end = path.find_first_of('/');
     if (segment_end == std::string_view::npos) {
@@ -100,7 +105,6 @@
     }

     // Try to descend into the child segment.
-    // TODO: Check permissions on intermediate directories.
     auto segment = path.substr(0, segment_end);
     auto child = getChild(curr, segment, FollowLinks, recursions);
     if (auto err = child.getError()) {

--- a/system/lib/wasmfs/syscalls.cpp
+++ b/system/lib/wasmfs/syscalls.cpp
@@ -733,6 +733,9 @@
   if (!dir) {
     return -ENOTDIR;
   }
+  if (!(dir->locked().getMode() & WASMFS_PERM_EXECUTE)) {
+    return -EACCES;
+  }
   wasmFS.setCWD(dir);
   return 0;
 }

With both applied to 6.0.9, the test case matches the JS FS:

uid 0
stat("/d/f")                             Permission denied
open("/d/f", O_RDONLY)                   Permission denied
access("/d", X_OK)                       Permission denied
chdir("/d")                              Permission denied

Several test/wasmfs/*.c programs (chdir, mkdir, dup, getdents, seek, open_append, fdatasync, chown) and test/unistd/access.c give the same results with and without the patch. We didn't run the full suite.