Repository navigation
0.18.3 --- a directory handle names a directory and does not read one - #42
Merged
Merged
Conversation
Every kal_dir, the two preopens included, is opened with O_PATH: resolving beneath it, starting a program in it and describing it read nothing, and listing already opens a readable descriptor of its own. Measured on Android 14 under run-as (SELinux runas_app, mcpp#857): the preopen of / failed with EACCES, and every program started by absolute name was reported as not found. The comment on the ENOSYS fallback now states what the code does: each start that meets ENOSYS falls back in the started image, and no start learns it from another. Co-authored-by: speak-agent <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A
kal_diris opened withO_PATH | O_DIRECTORY | O_CLOEXEC: the two preopens andkal_fs_open_dir. Resolving beneath a handle, starting a program in it and describing it need no read right;kal_fs_list_beginopens a readable descriptor of its own when it lists.Why. mcpp-community/mcpp#857: in the Android app sandbox (
run-as, SELinuxrunas_app) every program mcpp starts failed with "not found". A static strace of the failing build (mcpp#861, run 40908273317) shows one failing call, before any process is created:The domain may search
/but not read it, so the root preopen did not exist and every name resolved beneath it failed. Each step of the start itself (openat O_PATH, readlink,fstatat,execveat AT_EMPTY_PATH,execve) succeeds there when called directly (run 40904947962).Test.
tests/search_only_base.cpp: a directory of mode 0111 is a base — a file beneath it opens and reads, a program starts in it — and listing it is refused (for an unprivileged user).Also: the comment on the ENOSYS fallback said a start learns it from an earlier one; the started image is a
clonecopy without shared memory, so each start that meets ENOSYS falls back on its own. The comment now says so.Co-authored-by: speak-agent [email protected]