sandlock-core: confine COW metadata ops (stat/statx/utimensat/readlink/copy-up classify)

Signed-off-by: Cong Wang <cwang@multikernel.io>

Author: congwang-mk

crates/sandlock-core/src/cow/dispatch.rs

@@ -154,22 +154,35 @@ fn map_cow_upper_path(cow: &SeccompCowBranch, path: &str) -> String {
 /// child-controlled path cannot escape the upper/lower tree (issue #112).
 /// Picks the anchor root by prefix, then defers all resolution to the kernel
 /// via `openat2(RESOLVE_IN_ROOT)`.
-fn open_confined(
-    upper_root: &Path,
-    workdir_root: &Path,
+/// Select the layer root (`upper` first, then `workdir`) that `real_path` lives
+/// under and return it with the relative remainder. `Err(EACCES)` if the path
+/// is under neither root. This only selects the anchor; the kernel re-resolves
+/// the relative path under it with `RESOLVE_IN_ROOT`, so the lexical
+/// `strip_prefix` grants no trust.
+fn pick_root_rel<'a>(
+    upper_root: &'a Path,
+    workdir_root: &'a Path,
     real_path: &Path,
-    flags: i32,
-    mode: u32,
-) -> Result<RawFd, i32> {
+) -> Result<(&'a Path, String), i32> {
     let (root, rel) = if let Ok(rel) = real_path.strip_prefix(upper_root) {
         (upper_root, rel)
     } else if let Ok(rel) = real_path.strip_prefix(workdir_root) {
         (workdir_root, rel)
     } else {
         return Err(libc::EACCES);
     };
-    let rel = rel.to_str().ok_or(libc::EINVAL)?;
-    crate::sys::fs::openat2_in_root(root, rel, flags, mode)
+    Ok((root, rel.to_str().ok_or(libc::EINVAL)?.to_string()))
+}
+
+fn open_confined(
+    upper_root: &Path,
+    workdir_root: &Path,
+    real_path: &Path,
+    flags: i32,
+    mode: u32,
+) -> Result<RawFd, i32> {
+    let (root, rel) = pick_root_rel(upper_root, workdir_root, real_path)?;
+    crate::sys::fs::openat2_in_root(root, &rel, flags, mode)
 }
 
 /// Handle openat under workdir: redirect to COW upper/lower.
@@ -702,22 +715,25 @@ pub(crate) async fn handle_cow_utimensat(
         None => return NotifAction::Continue,
     };
 
-    let upper_path = {
+    let (upper_path, upper_root, workdir_root) = {
         let mut st = cow_state.lock().await;
         let cow = match st.branch.as_mut() {
             Some(c) => c,
             None => return NotifAction::Continue,
         };
+        let upper_root = cow.upper_dir().to_path_buf();
+        let workdir_root = cow.workdir().to_path_buf();
         let path = map_cow_upper_path(cow, &path);
         if !cow.matches(&path) {
             return NotifAction::Continue;
         }
-        match cow.handle_utimensat(&path) {
+        let p = match cow.handle_utimensat(&path) {
             Ok(Some(p)) => p,
             Ok(None) => return NotifAction::Continue,
             Err(crate::error::BranchError::QuotaExceeded) => return NotifAction::Errno(libc::ENOSPC),
             Err(_) => return NotifAction::Continue,
-        }
+        };
+        (p, upper_root, workdir_root)
     };
 
     // Read times from child memory (2 x struct timespec = 32 bytes on x86_64)
@@ -736,13 +752,14 @@ pub(crate) async fn handle_cow_utimensat(
         None
     };
 
-    let c_path = match std::ffi::CString::new(upper_path.to_str().unwrap_or("")) {
-        Ok(c) => c,
-        Err(_) => return NotifAction::Continue,
+    let (root, rel) = match pick_root_rel(&upper_root, &workdir_root, &upper_path) {
+        Ok(v) => v,
+        Err(e) => return NotifAction::Errno(e),
     };
     let times_raw = times.as_ref().map(|t| t.as_ptr()).unwrap_or(std::ptr::null());
-    if unsafe { libc::utimensat(libc::AT_FDCWD, c_path.as_ptr(), times_raw, flags) } < 0 {
-        return NotifAction::Errno(libc::EIO);
+    let follow = (flags & libc::AT_SYMLINK_NOFOLLOW) == 0;
+    if let Err(e) = crate::sys::fs::utimensat_in_root(root, &rel, times_raw, follow) {
+        return NotifAction::Errno(e);
     }
     NotifAction::ReturnValue(0)
 }
@@ -771,49 +788,52 @@ pub(crate) async fn handle_cow_stat(
         None => return NotifAction::Continue,
     };
 
-    let st = cow_state.lock().await;
-    let cow = match st.branch.as_ref() {
-        Some(c) => c,
-        None => return NotifAction::Continue,
-    };
-
-    let path = map_cow_upper_path(cow, &path);
-    if !cow.has_changes() || !cow.matches(&path) {
-        return NotifAction::Continue;
-    }
-
-    let real_path = match cow.handle_stat(&path) {
-        Some(p) => p,
-        None => {
-            return NotifAction::Errno(libc::ENOENT);
+    let (real_path, upper_root, workdir_root) = {
+        let st = cow_state.lock().await;
+        let cow = match st.branch.as_ref() {
+            Some(c) => c,
+            None => return NotifAction::Continue,
+        };
+        let upper_root = cow.upper_dir().to_path_buf();
+        let workdir_root = cow.workdir().to_path_buf();
+        let path = map_cow_upper_path(cow, &path);
+        if !cow.has_changes() || !cow.matches(&path) {
+            return NotifAction::Continue;
         }
+        let real = match cow.handle_stat(&path) {
+            Some(p) => p,
+            None => return NotifAction::Errno(libc::ENOENT),
+        };
+        (real, upper_root, workdir_root)
     };
-    drop(st);
 
     if nr == libc::SYS_faccessat || nr == crate::arch::SYS_FACCESSAT2 {
-        // For faccessat, just check if the file exists (we already resolved it)
-        if real_path.exists() || real_path.is_symlink() {
+        // Existence check, confined: lstat succeeds for any present entry
+        // (including a dangling symlink), matching the prior semantics.
+        let (root, rel) = match pick_root_rel(&upper_root, &workdir_root, &real_path) {
+            Ok(v) => v,
+            Err(_) => return NotifAction::Errno(libc::ENOENT),
+        };
+        if crate::sys::fs::statat_in_root(root, &rel, false).is_ok() {
             return NotifAction::ReturnValue(0);
         }
         return NotifAction::Errno(libc::ENOENT);
     }
 
-    // newfstatat — stat the resolved path and write the native libc layout
-    // back to the child. Do not hand-pack struct stat; its layout is
-    // architecture-specific.
+    // newfstatat — stat the resolved path (confined to its layer root) and
+    // write the native libc layout back to the child. Do not hand-pack struct
+    // stat; its layout is architecture-specific.
     let statbuf_addr = notif.data.args[2];
     let flags = (notif.data.args[3] & 0xFFFF_FFFF) as i32;
-    let c_path = match std::ffi::CString::new(real_path.to_str().unwrap_or("")) {
-        Ok(c) => c,
-        Err(_) => return NotifAction::Continue,
+    let follow = (flags & libc::AT_SYMLINK_NOFOLLOW) == 0;
+    let (root, rel) = match pick_root_rel(&upper_root, &workdir_root, &real_path) {
+        Ok(v) => v,
+        Err(e) => return NotifAction::Errno(e),
+    };
+    let statbuf = match crate::sys::fs::statat_in_root(root, &rel, follow) {
+        Ok(s) => s,
+        Err(e) => return NotifAction::Errno(e),
     };
-    let mut statbuf: libc::stat = unsafe { std::mem::zeroed() };
-    if unsafe { libc::fstatat(libc::AT_FDCWD, c_path.as_ptr(), &mut statbuf, flags) } < 0 {
-        let errno = std::io::Error::last_os_error()
-            .raw_os_error()
-            .unwrap_or(libc::EIO);
-        return NotifAction::Errno(errno);
-    }
     let buf = unsafe {
         std::slice::from_raw_parts(
             &statbuf as *const libc::stat as *const u8,
@@ -859,44 +879,32 @@ pub(crate) async fn handle_cow_statx(
         _ => return NotifAction::Continue,
     };
 
-    let real_path = {
+    let (real_path, upper_root, workdir_root) = {
         let st = cow_state.lock().await;
         let cow = match st.branch.as_ref() {
             Some(c) => c,
             None => return NotifAction::Continue,
         };
-
+        let upper_root = cow.upper_dir().to_path_buf();
+        let workdir_root = cow.workdir().to_path_buf();
         let path = map_cow_upper_path(cow, &path);
         if !cow.has_changes() || !cow.matches(&path) {
             return NotifAction::Continue;
         }
-
-        match cow.handle_stat(&path) {
+        let real = match cow.handle_stat(&path) {
             Some(p) => p,
             None => return NotifAction::Errno(libc::ENOENT), // deleted or absent
-        }
+        };
+        (real, upper_root, workdir_root)
     };
 
-    let c_path = match std::ffi::CString::new(real_path.to_str().unwrap_or("")) {
-        Ok(c) => c,
-        Err(_) => return NotifAction::Continue,
+    let (root, rel) = match pick_root_rel(&upper_root, &workdir_root, &real_path) {
+        Ok(v) => v,
+        Err(e) => return NotifAction::Errno(e),
     };
     let mut stx_buf = vec![0u8; 256]; // sizeof(struct statx)
-    let ret = unsafe {
-        libc::syscall(
-            libc::SYS_statx,
-            libc::AT_FDCWD,
-            c_path.as_ptr(),
-            flags,
-            mask,
-            stx_buf.as_mut_ptr(),
-        )
-    };
-    if ret < 0 {
-        let errno = std::io::Error::last_os_error()
-            .raw_os_error()
-            .unwrap_or(libc::EIO);
-        return NotifAction::Errno(errno);
+    if let Err(e) = crate::sys::fs::statx_in_root(root, &rel, flags, mask, &mut stx_buf) {
+        return NotifAction::Errno(e);
     }
 
     if write_child_mem(notif_fd, notif.id, notif.pid, statxbuf_addr, &stx_buf).is_err() {

crates/sandlock-core/src/cow/seccomp.rs

@@ -6,6 +6,8 @@
 
 use std::collections::HashSet;
 use std::fs;
+use std::os::unix::ffi::OsStringExt;
+use std::os::unix::fs::PermissionsExt;
 use std::path::{Path, PathBuf};
 
 use crate::error::BranchError;
@@ -207,7 +209,9 @@ impl SeccompCowBranch {
         let upper_file = self.upper.join(rel_path);
         let lower_file = self.workdir.join(rel_path);
 
-        if upper_file.exists() || upper_file.is_symlink() {
+        // Already materialized in upper? Confined lstat succeeds for any
+        // existing entry (including a dangling symlink).
+        if crate::sys::fs::statat_in_root(&self.upper, rel_path, false).is_ok() {
             return Ok(CowCopyPlan::Ready(upper_file));
         }
 
@@ -216,46 +220,56 @@ impl SeccompCowBranch {
                 .map_err(|e| BranchError::Operation(format!("create parent: {}", e)))?;
         }
 
-        // Symlink — copy immediately (tiny, not worth deferring)
-        if lower_file.is_symlink() {
+        // Classify the lower entry confined to the workdir root, so a symlinked
+        // parent component cannot make us follow out of the tree (issue #112).
+        // The lstat also yields the size of the entry we will actually copy.
+        let st = match crate::sys::fs::statat_in_root(&self.workdir, rel_path, false) {
+            Ok(st) => st,
+            // Absent or confined-out: treat as a new file created in upper.
+            Err(libc::ENOENT) => {
+                self.check_quota(0)?;
+                return Ok(CowCopyPlan::Ready(upper_file));
+            }
+            Err(e) => return Err(BranchError::Operation(format!("stat lower: {}", e))),
+        };
+        let kind = st.st_mode & libc::S_IFMT;
+
+        // Symlink — copy verbatim (tiny, not worth deferring)
+        if kind == libc::S_IFLNK {
             self.check_quota(256)?;
-            let target = fs::read_link(&lower_file)
+            let target = crate::sys::fs::readlink_in_root(&self.workdir, rel_path)
                 .map_err(|e| BranchError::Operation(format!("readlink: {}", e)))?;
+            let target = std::path::PathBuf::from(std::ffi::OsString::from_vec(target));
             std::os::unix::fs::symlink(&target, &upper_file)
                 .map_err(|e| BranchError::Operation(format!("symlink: {}", e)))?;
             self.disk_used += 256;
             return Ok(CowCopyPlan::Ready(upper_file));
         }
 
         // Directory — create immediately (no data copy)
-        if lower_file.is_dir() {
+        if kind == libc::S_IFDIR {
             self.check_quota(4096)?;
             fs::create_dir_all(&upper_file)
                 .map_err(|e| BranchError::Operation(format!("create dir: {}", e)))?;
-            if let Ok(meta) = lower_file.metadata() {
-                let _ = fs::set_permissions(&upper_file, meta.permissions());
-            }
+            let _ = fs::set_permissions(
+                &upper_file,
+                std::fs::Permissions::from_mode(st.st_mode & 0o7777),
+            );
             self.disk_used += 4096;
             return Ok(CowCopyPlan::Ready(upper_file));
         }
 
-        // Regular file — defer the potentially expensive copy
-        if lower_file.exists() {
-            let meta = lower_file.metadata()
-                .map_err(|e| BranchError::Operation(format!("metadata: {}", e)))?;
-            let file_size = meta.len();
-            self.check_quota(file_size)?;
-            self.disk_used += file_size;
-            return Ok(CowCopyPlan::NeedsCopy {
-                upper: upper_file,
-                lower: lower_file,
-                file_size,
-            });
-        }
-
-        // New file (not in lower layer)
-        self.check_quota(0)?;
-        Ok(CowCopyPlan::Ready(upper_file))
+        // Regular file — defer the potentially expensive copy. Size comes from
+        // the confined lstat, so the quota reservation matches the file
+        // execute_copy will actually read.
+        let file_size = st.st_size as u64;
+        self.check_quota(file_size)?;
+        self.disk_used += file_size;
+        Ok(CowCopyPlan::NeedsCopy {
+            upper: upper_file,
+            lower: lower_file,
+            file_size,
+        })
     }
 
     /// Execute a file copy synchronously. Used by `ensure_cow_copy` and the
@@ -704,15 +718,14 @@ impl SeccompCowBranch {
         if self.is_deleted(&rel) {
             return None;
         }
-        let upper = self.upper.join(&rel);
-        let lower = self.workdir.join(&rel);
-        if upper.is_symlink() {
-            fs::read_link(&upper).ok().map(|p| p.to_string_lossy().into_owned())
-        } else if lower.is_symlink() {
-            fs::read_link(&lower).ok().map(|p| p.to_string_lossy().into_owned())
-        } else {
-            None
+        // Read the link confined to each layer root so a symlinked parent
+        // component cannot escape the tree (issue #112).
+        for root in [&self.upper, &self.workdir] {
+            if let Ok(target) = crate::sys::fs::readlink_in_root(root, &rel) {
+                return Some(String::from_utf8_lossy(&target).into_owned());
+            }
         }
+        None
     }
 
     /// List all filesystem changes in the COW layer.
@@ -1554,4 +1567,20 @@ mod tests {
         let meta = std::fs::symlink_metadata(&committed).unwrap();
         assert!(meta.file_type().is_symlink());
     }
+
+    #[test]
+    fn cow_copy_preserves_in_tree_symlink() {
+        // The confined-stat classification in prepare_copy must still treat an
+        // in-tree symlink as a symlink and copy it verbatim into upper.
+        let (workdir, storage) = setup_workdir();
+        std::os::unix::fs::symlink("existing.txt", workdir.path().join("link")).unwrap();
+        let mut branch =
+            SeccompCowBranch::create(workdir.path(), Some(storage.path()), 0).unwrap();
+        let upper = branch.ensure_cow_copy("link").unwrap();
+        assert!(upper.is_symlink(), "in-tree symlink was not preserved");
+        assert_eq!(
+            std::fs::read_link(&upper).unwrap(),
+            std::path::Path::new("existing.txt")
+        );
+    }
 }