sandlock-core: resolve dirfd/cwd-relative open paths to the virtual namespace under chroot

Signed-off-by: Cong Wang <cwang@multikernel.io>

Author: congwang-mk

crates/sandlock-core/src/ca_inject.rs

@@ -39,8 +39,10 @@ pub(crate) fn handle_ca_inject_open(
     inject_paths: &[PathBuf],
     ca_pem: &[u8],
     notif_fd: RawFd,
+    chroot_root: Option<&std::path::Path>,
+    chroot_mounts: &[(PathBuf, PathBuf)],
 ) -> Option<NotifAction> {
-    let resolved = crate::procfs::resolve_open_target(notif, notif_fd)?;
+    let resolved = crate::procfs::resolve_open_target(notif, notif_fd, chroot_root, chroot_mounts)?;
     if !path_matches(&resolved, inject_paths) {
         return None;
     }

crates/sandlock-core/src/chroot/dispatch.rs

@@ -47,7 +47,7 @@ use std::sync::Arc;
 
 use tokio::sync::Mutex;
 
-use crate::chroot::resolve::{confine, resolve_existing_in_root, resolve_in_root, to_virtual_path};
+use crate::chroot::resolve::{confine, resolve_existing_in_root, resolve_in_root};
 use crate::sys::fs::openat2_in_root;
 use crate::seccomp::notif::{read_child_mem, write_child_mem, NotifAction};
 use crate::seccomp::state::{ChrootState, CowState};
@@ -165,22 +165,7 @@ impl ChrootCtx<'_> {
     /// Inverse: given a host path, return the virtual path.
     /// Checks mount targets first, then falls back to chroot root.
     fn host_to_virtual(&self, host_path: &Path) -> Option<PathBuf> {
-        // Check mounts first (longest prefix match)
-        let mut best: Option<(&Path, &Path, usize)> = None;
-        for (vp, hp) in self.mounts {
-            if host_path.starts_with(hp) {
-                let len = hp.as_os_str().len();
-                if best.is_none() || len > best.unwrap().2 {
-                    best = Some((vp.as_path(), hp.as_path(), len));
-                }
-            }
-        }
-        if let Some((mount_vp, mount_hp, _)) = best {
-            let rel = host_path.strip_prefix(mount_hp).ok()?;
-            return Some(mount_vp.join(rel));
-        }
-        // Fall back to chroot root
-        to_virtual_path(self.root, host_path)
+        crate::chroot::resolve::host_to_virtual(self.root, self.mounts, host_path)
     }
 }
 

crates/sandlock-core/src/chroot/resolve.rs

@@ -36,6 +36,28 @@ pub fn to_virtual_path(chroot_root: &Path, host_path: &Path) -> Option<PathBuf>
         .map(|rel| PathBuf::from("/").join(rel))
 }
 
+/// Inverse of mount/chroot resolution: map a real host path back to the
+/// sandbox's virtual path.
+///
+/// The chroot root is just the virtual `/` mount, so this is a single
+/// most-specific-prefix lookup over `{ "/" => chroot_root } ∪ mounts` —
+/// the same rule the kernel uses to pick among overlapping mounts. Returns
+/// None when the host path is under neither the root nor any mount.
+pub fn host_to_virtual(
+    chroot_root: &Path,
+    mounts: &[(PathBuf, PathBuf)],
+    host_path: &Path,
+) -> Option<PathBuf> {
+    std::iter::once((Path::new("/"), chroot_root))
+        .chain(mounts.iter().map(|(v, h)| (v.as_path(), h.as_path())))
+        .filter(|(_, source)| host_path.starts_with(source))
+        .max_by_key(|(_, source)| source.as_os_str().len())
+        .map(|(virtual_base, source)| {
+            // strip_prefix cannot fail: the filter above already matched it.
+            virtual_base.join(host_path.strip_prefix(source).expect("prefix matched"))
+        })
+}
+
 /// Resolve a virtual path within the chroot using `openat2(RESOLVE_IN_ROOT)`.
 ///
 /// The kernel resolves all symlinks and `..` components, keeping the result

crates/sandlock-core/src/procfs.rs

@@ -412,7 +412,12 @@ pub(crate) async fn handle_proc_open(
     // sensitive-path deny, the per-PID filter, and the virtualization
     // string-matches below all see the same canonical form regardless of
     // how the caller spelled it (dirfd-relative, `..`-laden, etc.).
-    let resolved = match resolve_open_target(notif, notif_fd) {
+    let resolved = match resolve_open_target(
+        notif,
+        notif_fd,
+        policy.chroot_root.as_deref(),
+        &policy.chroot_mounts,
+    ) {
         Some(p) => p,
         None => return NotifAction::Continue,
     };
@@ -600,8 +605,10 @@ pub(crate) fn handle_hostname_open(
     notif: &SeccompNotif,
     hostname: &str,
     notif_fd: RawFd,
+    chroot_root: Option<&std::path::Path>,
+    chroot_mounts: &[(std::path::PathBuf, std::path::PathBuf)],
 ) -> Option<NotifAction> {
-    let resolved = resolve_open_target(notif, notif_fd)?;
+    let resolved = resolve_open_target(notif, notif_fd, chroot_root, chroot_mounts)?;
     if resolved != std::path::Path::new("/etc/hostname") {
         return None;
     }
@@ -620,8 +627,10 @@ pub(crate) fn handle_etc_hosts_open(
     notif: &SeccompNotif,
     etc_hosts_content: &str,
     notif_fd: RawFd,
+    chroot_root: Option<&std::path::Path>,
+    chroot_mounts: &[(std::path::PathBuf, std::path::PathBuf)],
 ) -> Option<NotifAction> {
-    let resolved = resolve_open_target(notif, notif_fd)?;
+    let resolved = resolve_open_target(notif, notif_fd, chroot_root, chroot_mounts)?;
     if resolved != std::path::Path::new("/etc/hosts") {
         return None;
     }
@@ -646,6 +655,8 @@ pub(crate) fn handle_etc_hosts_open(
 pub(crate) fn resolve_open_target(
     notif: &SeccompNotif,
     notif_fd: RawFd,
+    chroot_root: Option<&std::path::Path>,
+    chroot_mounts: &[(std::path::PathBuf, std::path::PathBuf)],
 ) -> Option<std::path::PathBuf> {
     let nr = notif.data.nr as i64;
     let (dirfd, path_ptr): (i64, u64) = if Some(nr) == crate::arch::sys_open() {
@@ -659,7 +670,7 @@ pub(crate) fn resolve_open_target(
         return None;
     };
     let path = read_path(notif, path_ptr, notif_fd)?;
-    resolve_to_normalized_absolute(notif.pid, dirfd, &path)
+    resolve_to_normalized_absolute(notif.pid, dirfd, &path, chroot_root, chroot_mounts)
 }
 
 /// Lexical normalization of `(pid, dirfd, path)`:
@@ -677,6 +688,8 @@ fn resolve_to_normalized_absolute(
     pid: u32,
     dirfd: i64,
     path: &str,
+    chroot_root: Option<&std::path::Path>,
+    chroot_mounts: &[(std::path::PathBuf, std::path::PathBuf)],
 ) -> Option<std::path::PathBuf> {
     use std::path::{Component, Path, PathBuf};
 
@@ -688,6 +701,18 @@ fn resolve_to_normalized_absolute(
         } else {
             std::fs::read_link(format!("/proc/{}/fd/{}", pid, dirfd as i32)).ok()?
         };
+        // The dirfd/cwd symlink target is the *real* host directory. Under
+        // chroot, sandlock services /proc, /etc and /dev via on-behalf opens,
+        // so that target is e.g. `<chroot>/proc` while the child's absolute
+        // spelling of the same file is `/proc/...`. Map the base back into the
+        // sandbox's virtual namespace so relative and absolute spellings
+        // resolve identically and the open-family shims (proc synthesis,
+        // /etc/hosts, /etc/hostname, random seed, CA inject) match either way.
+        let base = match chroot_root {
+            Some(root) => crate::chroot::resolve::host_to_virtual(root, chroot_mounts, &base)
+                .unwrap_or(base),
+            None => base,
+        };
         base.join(path)
     };
 

crates/sandlock-core/src/random.rs

@@ -56,11 +56,13 @@ pub(crate) fn handle_random_open(
     notif: &SeccompNotif,
     rng: &mut ChaCha8Rng,
     notif_fd: RawFd,
+    chroot_root: Option<&std::path::Path>,
+    chroot_mounts: &[(std::path::PathBuf, std::path::PathBuf)],
 ) -> Option<NotifAction> {
     // Resolve the open path so dirfd-relative or non-canonical spellings
     // (`/dev/../dev/urandom`, `openat(open("/dev"), "urandom", ...)`)
     // can't sidestep the seed and read real kernel entropy.
-    let resolved = crate::procfs::resolve_open_target(notif, notif_fd)?;
+    let resolved = crate::procfs::resolve_open_target(notif, notif_fd, chroot_root, chroot_mounts)?;
     let path = resolved.to_str()?;
     if path != "/dev/urandom" && path != "/dev/random" {
         return None;

crates/sandlock-core/src/seccomp/dispatch.rs

@@ -376,14 +376,19 @@ pub(crate) fn build_dispatch_table(
     if policy.has_random_seed {
         for nr in open_family_syscalls() {
             let __sup = Arc::clone(ctx);
+            let policy_rand = Arc::clone(policy);
             table.register(nr, move |cx: &HandlerCtx| {
                 let notif = cx.notif;
                 let sup = Arc::clone(&__sup);
+                let policy = Arc::clone(&policy_rand);
                 let notif_fd = cx.notif_fd;
                 async move {
                     let mut tr = sup.time_random.lock().await;
                     if let Some(ref mut rng) = tr.random_state {
-                        if let Some(action) = crate::random::handle_random_open(&notif, rng, notif_fd) {
+                        if let Some(action) = crate::random::handle_random_open(
+                            &notif, rng, notif_fd,
+                            policy.chroot_root.as_deref(), &policy.chroot_mounts,
+                        ) {
                             return action;
                         }
                     }
@@ -430,12 +435,17 @@ pub(crate) fn build_dispatch_table(
         let etc_hosts = policy.virtual_etc_hosts.clone();
         for nr in open_family_syscalls() {
             let etc_hosts = etc_hosts.clone();
+            let policy_hosts = Arc::clone(policy);
             table.register(nr, move |cx: &HandlerCtx| {
                 let notif = cx.notif;
                 let notif_fd = cx.notif_fd;
                 let etc_hosts = etc_hosts.clone();
+                let policy = Arc::clone(&policy_hosts);
                 async move {
-                    if let Some(action) = crate::procfs::handle_etc_hosts_open(&notif, &etc_hosts, notif_fd) {
+                    if let Some(action) = crate::procfs::handle_etc_hosts_open(
+                        &notif, &etc_hosts, notif_fd,
+                        policy.chroot_root.as_deref(), &policy.chroot_mounts,
+                    ) {
                         action
                     } else {
                         NotifAction::Continue
@@ -457,14 +467,17 @@ pub(crate) fn build_dispatch_table(
             for nr in open_family_syscalls() {
                 let ca_pem = std::sync::Arc::clone(&ca_pem);
                 let inject_paths = std::sync::Arc::clone(&inject_paths);
+                let policy_ca = Arc::clone(policy);
                 table.register(nr, move |cx: &HandlerCtx| {
                     let notif = cx.notif;
                     let notif_fd = cx.notif_fd;
                     let ca_pem = std::sync::Arc::clone(&ca_pem);
                     let inject_paths = std::sync::Arc::clone(&inject_paths);
+                    let policy = Arc::clone(&policy_ca);
                     async move {
                         crate::ca_inject::handle_ca_inject_open(
                             &notif, &inject_paths, &ca_pem, notif_fd,
+                            policy.chroot_root.as_deref(), &policy.chroot_mounts,
                         )
                         .unwrap_or(NotifAction::Continue)
                     }
@@ -571,12 +584,17 @@ pub(crate) fn build_dispatch_table(
         });
         for nr in open_family_syscalls() {
             let hostname = hostname_for_open.clone();
+            let policy_hostname = Arc::clone(policy);
             table.register(nr, move |cx: &HandlerCtx| {
                 let notif = cx.notif;
                 let notif_fd = cx.notif_fd;
                 let hostname = hostname.clone();
+                let policy = Arc::clone(&policy_hostname);
                 async move {
-                    if let Some(action) = crate::procfs::handle_hostname_open(&notif, &hostname, notif_fd) {
+                    if let Some(action) = crate::procfs::handle_hostname_open(
+                        &notif, &hostname, notif_fd,
+                        policy.chroot_root.as_deref(), &policy.chroot_mounts,
+                    ) {
                         action
                     } else {
                         NotifAction::Continue

crates/sandlock-core/tests/integration/test_chroot.rs

@@ -234,6 +234,51 @@ async fn test_chroot_chdir_proc_readonly_buffer() {
     cleanup_rootfs(&rootfs);
 }
 
+/// A dirfd-relative /proc read under a chroot with NO /proc mount must still
+/// hit the synthesis shim. Regression: resolve_open_target took the proc
+/// dirfd's real symlink target (`<chroot>/proc`) as the base, so
+/// `openat(open("/proc"), "meminfo")` normalized to `<chroot>/proc/meminfo` and
+/// missed the `== "/proc/meminfo"` synthesis match, falling through to the
+/// chroot handler which ENOENT'd on the empty rootfs procfs, while the absolute
+/// spelling was synthesized. The resolver now maps the dirfd base back into the
+/// virtual namespace so both spellings synthesize identically.
+#[tokio::test]
+async fn test_chroot_proc_dirfd_relative_is_virtualized() {
+    let rootfs = build_test_rootfs("proc-dirfd");
+
+    // No fs_mount for /proc: it is the empty rootfs dir, so the file can only
+    // come from synthesis. max_memory engages the /proc/meminfo shim.
+    let policy = minimal_exec_policy(&rootfs)
+        .max_memory(sandlock_core::sandbox::ByteSize::mib(256))
+        .build()
+        .unwrap();
+
+    let result = policy
+        .clone()
+        .with_name("test")
+        .run(&["rootfs-helper", "proc-dirfd", "meminfo"])
+        .await;
+    match result {
+        Ok(r) => {
+            assert!(
+                r.success(),
+                "dirfd-relative /proc/meminfo must be synthesized (not ENOENT), stderr: {}",
+                r.stderr_str().unwrap_or("")
+            );
+            let out = r.stdout_str().unwrap_or("");
+            assert!(out.contains("MemTotal"), "expected synthesized meminfo, got: {:?}", out);
+            assert!(
+                out.contains("262144"),
+                "expected virtual 256MiB MemTotal (262144 kB), got: {:?}",
+                out
+            );
+        }
+        Err(e) => eprintln!("Chroot test skipped: {}", e),
+    }
+
+    cleanup_rootfs(&rootfs);
+}
+
 /// echo hello > /tmp/test.txt && cat /tmp/test.txt works, file appears in rootfs/tmp
 #[tokio::test]
 async fn test_chroot_write_file() {

tests/rootfs-helper.c

@@ -611,10 +611,34 @@ static int cmd_chdir(int argc, char **argv) {
     return 0;
 }
 
+/* ── proc-dirfd (non-standard: read /proc/<name> via a proc dirfd) ─ */
+/*
+ * Opens /proc as a directory, then openat()s <name> RELATIVE to that fd and
+ * dumps it. This is the dirfd-relative spelling of a /proc access: the open
+ * shims must resolve it to the virtual /proc path (not the real
+ * <chroot>/proc) so virtualization/synthesis applies the same as an absolute
+ * open. Prints the file contents on success.
+ */
+static int cmd_proc_dirfd(int argc, char **argv) {
+    if (argc < 1) { fprintf(stderr, "proc-dirfd: missing operand\n"); return 1; }
+    int dfd = open("/proc", O_RDONLY | O_DIRECTORY);
+    if (dfd < 0) { fprintf(stderr, "proc-dirfd: open /proc: %s\n", strerror(errno)); return 1; }
+    int fd = openat(dfd, argv[0], O_RDONLY);
+    if (fd < 0) { fprintf(stderr, "proc-dirfd: openat %s: %s\n", argv[0], strerror(errno)); return 1; }
+    char buf[8192];
+    ssize_t n = read(fd, buf, sizeof(buf));
+    if (n < 0) { fprintf(stderr, "proc-dirfd: read: %s\n", strerror(errno)); return 1; }
+    write(STDOUT_FILENO, buf, n);
+    close(fd);
+    close(dfd);
+    return 0;
+}
+
 /* ── dispatch ───────────────────────────────────────────────── */
 
 static int dispatch(const char *cmd, int argc, char **argv) {
     if (strcmp(cmd, "chdir") == 0)          return cmd_chdir(argc, argv);
+    if (strcmp(cmd, "proc-dirfd") == 0)     return cmd_proc_dirfd(argc, argv);
     if (strcmp(cmd, "echo") == 0)           return cmd_echo(argc, argv);
     if (strcmp(cmd, "cat") == 0)            return cmd_cat(argc, argv);
     if (strcmp(cmd, "ls") == 0)             return cmd_ls(argc, argv);