sandlock-core: avoid chdir path-rewrite EFAULT for same-path mounts like /proc

Signed-off-by: Cong Wang <cwang@multikernel.io>

Author: congwang-mk

crates/sandlock-core/src/chroot/dispatch.rs

@@ -1531,7 +1531,8 @@ pub(crate) async fn handle_chroot_chdir(
     };
 
     // Build the full virtual path from AT_FDCWD + path.
-    let full_path = if Path::new(&path).is_absolute() {
+    let was_absolute = Path::new(&path).is_absolute();
+    let full_path = if was_absolute {
         path
     } else {
         match std::fs::read_link(format!("/proc/{}/cwd", notif.pid)) {
@@ -1560,6 +1561,29 @@ pub(crate) async fn handle_chroot_chdir(
         Err(errno) => return NotifAction::Errno(errno),
     };
 
+    // Native-chdir fast path. The child runs in the host filesystem (sandlock
+    // does not chroot(2); it confines via on-behalf openat2 + Landlock), so an
+    // absolute chdir resolves against the real host root. When the on-behalf
+    // resolved directory's real host path is identical to the path the child
+    // asked for (the common case for same-path mounts like /proc and /sys), a
+    // raw chdir reaches the exact same directory. Let the kernel run the
+    // original syscall unchanged instead of rewriting the argument to the
+    // longer /proc/self/fd/N: that rewrite goes through process_vm_writev,
+    // which fails with EFAULT when the child passed a read-only string literal
+    // (e.g. busybox `top`'s chdir("/proc")), killing the process. Confinement
+    // is preserved: every subsequent open/stat/getdents is independently
+    // re-resolved on-behalf, and the equality check only holds when no symlink
+    // redirection occurred during the confined open.
+    if was_absolute
+        && std::fs::read_link(format!("/proc/self/fd/{}", src_fd))
+            .ok()
+            .as_deref()
+            == Some(Path::new(&full_path))
+    {
+        unsafe { libc::close(src_fd) };
+        return NotifAction::Continue;
+    }
+
     // Inject fd into child and rewrite path to /proc/self/fd/N.
     let addfd = SeccompNotifAddfd {
         id: notif.id,

crates/sandlock-core/tests/integration/test_chroot.rs

@@ -196,6 +196,44 @@ async fn test_chroot_getcwd() {
     cleanup_rootfs(&rootfs);
 }
 
+/// chdir into a same-path mount (/proc) from a READ-ONLY path buffer must
+/// succeed. Regression for the busybox-`top` EFAULT: rewriting the child's
+/// path argument to /proc/self/fd/N faults when the path lives in read-only
+/// memory (a .rodata literal). The handler instead lets the kernel run the
+/// original chdir unchanged when the on-behalf-resolved directory is identical
+/// to the requested path, which holds for the /proc mount.
+#[tokio::test]
+async fn test_chroot_chdir_proc_readonly_buffer() {
+    let rootfs = build_test_rootfs("chdir-proc-ro");
+
+    let policy = minimal_exec_policy(&rootfs)
+        .fs_mount("/proc", "/proc")
+        .build()
+        .unwrap();
+
+    let result = policy
+        .clone()
+        .with_name("test")
+        .run(&["rootfs-helper", "chdir", "/proc"])
+        .await;
+    match result {
+        Ok(r) => {
+            assert!(
+                r.success(),
+                "chdir(/proc) from a read-only buffer should succeed, stderr: {}",
+                r.stderr_str().unwrap_or("")
+            );
+            // cwd must be /proc (getcwd may render the mount root with a
+            // trailing slash; the meaningful assertion is that we landed there).
+            let cwd = r.stdout_str().unwrap_or("").trim().trim_end_matches('/').to_string();
+            assert_eq!(cwd, "OK /proc", "cwd after chdir should be /proc");
+        }
+        Err(e) => eprintln!("Chroot test skipped: {}", e),
+    }
+
+    cleanup_rootfs(&rootfs);
+}
+
 /// echo hello > /tmp/test.txt && cat /tmp/test.txt works, file appears in rootfs/tmp
 #[tokio::test]
 async fn test_chroot_write_file() {

tests/rootfs-helper.c

@@ -17,6 +17,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/mman.h>
 #include <sys/stat.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
@@ -581,9 +582,39 @@ static int cmd_spawn_loop(int argc, char **argv) {
     return 0;
 }
 
+/* ── chdir (non-standard: chdir from a READ-ONLY path buffer) ─── */
+/*
+ * Copies the target path onto a freshly mmap'd page, flips it to PROT_READ,
+ * then chdir()s through that read-only pointer. This reproduces how real
+ * programs (e.g. busybox `top`'s chdir("/proc")) pass a .rodata string
+ * literal: the chroot chdir handler must not assume the child's path buffer
+ * is writable, since rewriting it in place would fault. On success prints the
+ * resulting cwd so the caller can confirm the directory actually changed.
+ */
+static int cmd_chdir(int argc, char **argv) {
+    if (argc < 1) { fprintf(stderr, "chdir: missing operand\n"); return 1; }
+    size_t n = strlen(argv[0]) + 1;
+    long pg = sysconf(_SC_PAGESIZE);
+    size_t maplen = ((n + pg - 1) / pg) * pg;
+    char *ro = mmap(NULL, maplen, PROT_READ | PROT_WRITE,
+                    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    if (ro == MAP_FAILED) { perror("chdir: mmap"); return 1; }
+    memcpy(ro, argv[0], n);
+    if (mprotect(ro, maplen, PROT_READ) != 0) { perror("chdir: mprotect"); return 1; }
+    if (chdir(ro) != 0) {
+        fprintf(stderr, "chdir: %s: %s\n", argv[0], strerror(errno));
+        return 1;
+    }
+    char buf[4096];
+    if (!getcwd(buf, sizeof(buf))) { perror("chdir: getcwd"); return 1; }
+    printf("OK %s\n", buf);
+    return 0;
+}
+
 /* ── dispatch ───────────────────────────────────────────────── */
 
 static int dispatch(const char *cmd, int argc, char **argv) {
+    if (strcmp(cmd, "chdir") == 0)          return cmd_chdir(argc, argv);
     if (strcmp(cmd, "echo") == 0)           return cmd_echo(argc, argv);
     if (strcmp(cmd, "cat") == 0)            return cmd_cat(argc, argv);
     if (strcmp(cmd, "ls") == 0)             return cmd_ls(argc, argv);