sandlock-core: resolve /proc/self in chroot chdir to the workload pid

Signed-off-by: Cong Wang <cwang@multikernel.io>

Author: congwang-mk

crates/sandlock-core/src/chroot/dispatch.rs

@@ -1640,7 +1640,7 @@ pub(crate) async fn handle_chroot_chdir(
 
     // Build the full virtual path from AT_FDCWD + path.
     let was_absolute = Path::new(&path).is_absolute();
-    let full_path = if was_absolute {
+    let virtual_path = if was_absolute {
         path
     } else {
         match std::fs::read_link(format!("/proc/{}/cwd", notif.pid)) {
@@ -1651,6 +1651,17 @@ pub(crate) async fn handle_chroot_chdir(
             Err(_) => return NotifAction::Errno(libc::EACCES),
         }
     };
+    // Canonicalize /proc/self and /proc/thread-self to the child's own PID,
+    // exactly as the open path does (build_virtual_path). The on-behalf
+    // openat2 below runs in the supervisor task, so the kernel would resolve a
+    // literal "self" against the supervisor and point the child's cwd at a
+    // non-sandbox process's /proc/<pid> dir. Rewriting to the numeric child PID
+    // makes "self" resolve to the real caller and keeps every /proc spelling
+    // subject to the same numeric per-PID filter. For a same-path /proc mount
+    // this also lets the native-chdir fast path below fire: the resolved fd's
+    // host path then equals full_path, so the kernel re-runs the original
+    // "/proc/self" in the child's context (where it resolves correctly).
+    let full_path = canon_proc_self(&virtual_path, notif.pid);
 
     // Open directly via openat2(RESOLVE_IN_ROOT), routing to mount target if applicable.
     let confined = confine(&full_path);

crates/sandlock-core/tests/integration/test_chroot.rs

@@ -234,6 +234,50 @@ async fn test_chroot_chdir_proc_readonly_buffer() {
     cleanup_rootfs(&rootfs);
 }
 
+/// chdir("/proc/self") must land on the CHILD's own /proc/<pid> dir, not the
+/// supervisor's. sandlock services /proc via an on-behalf openat2 in the
+/// supervisor task, so a literal "self" would resolve against the supervisor.
+/// The chdir handler canonicalizes /proc/self to the child's numeric PID (same
+/// as the open path), so getcwd() after the chdir renders the child's own
+/// /proc/<pid> and its basename matches the child's getpid(). Before the fix the
+/// cwd pointed at the supervisor's /proc/<pid> and the basename mismatched.
+#[tokio::test]
+async fn test_chroot_chdir_proc_self_resolves_to_child() {
+    let rootfs = build_test_rootfs("chdir-proc-self");
+
+    let policy = minimal_exec_policy(&rootfs)
+        .fs_mount("/proc", "/proc")
+        .build()
+        .unwrap();
+
+    let result = policy
+        .clone()
+        .with_name("test")
+        .run(&["rootfs-helper", "chdir-self", "/proc/self"])
+        .await;
+    match result {
+        Ok(r) => {
+            assert!(
+                r.success(),
+                "chdir(/proc/self) should succeed, stderr: {}",
+                r.stderr_str().unwrap_or("")
+            );
+            // The helper checks getcwd()'s basename == its own getpid(); "OK"
+            // means "self" resolved to the child's own /proc/<pid>, not the
+            // supervisor's.
+            let out = r.stdout_str().unwrap_or("").trim().to_string();
+            assert!(
+                out.starts_with("OK /proc/"),
+                "self must resolve to the child's own /proc/<pid>, got: {:?}",
+                out
+            );
+        }
+        Err(e) => eprintln!("Chroot test skipped: {}", e),
+    }
+
+    cleanup_rootfs(&rootfs);
+}
+
 /// A dirfd-relative /proc read under a chroot with NO /proc mount must still
 /// hit the synthesis shim. Regression: resolve_open_target took the proc
 /// dirfd's real symlink target (`<chroot>/proc`) as the base, so

tests/rootfs-helper.c

@@ -611,6 +611,37 @@ static int cmd_chdir(int argc, char **argv) {
     return 0;
 }
 
+/* ── chdir-self (chdir into a /proc/self path, confirm it is OUR dir) ─ */
+/*
+ * chdir(argv[0]) (e.g. "/proc/self"), then getcwd() and check its final
+ * component equals our own getpid(). This proves "self" resolved to the CHILD,
+ * not the supervisor that services /proc on-behalf: if it mis-resolved, the cwd
+ * would render as the supervisor's /proc/<pid> and the basename would not match
+ * our pid. Robust to the exec-via-/proc/self/fd/N comm artifact and to pid
+ * namespaces (getcwd and getpid share the child's own view). Prints "OK <cwd>"
+ * on match, "MISMATCH ..." otherwise (returns 0 either way so the caller can
+ * assert on stdout).
+ */
+static int cmd_chdir_self(int argc, char **argv) {
+    if (argc < 1) { fprintf(stderr, "chdir-self: missing operand\n"); return 1; }
+    if (chdir(argv[0]) != 0) {
+        fprintf(stderr, "chdir-self: chdir %s: %s\n", argv[0], strerror(errno));
+        return 1;
+    }
+    char buf[4096];
+    if (!getcwd(buf, sizeof(buf))) { perror("chdir-self: getcwd"); return 1; }
+    const char *slash = strrchr(buf, '/');
+    const char *base = slash ? slash + 1 : buf;
+    char expect[32];
+    snprintf(expect, sizeof(expect), "%d", getpid());
+    if (strcmp(base, expect) == 0) {
+        printf("OK %s\n", buf);
+    } else {
+        printf("MISMATCH cwd=%s pid=%s\n", buf, expect);
+    }
+    return 0;
+}
+
 /* ── proc-dirfd (non-standard: read /proc/<name> via a proc dirfd) ─ */
 /*
  * Opens /proc as a directory, then openat()s <name> RELATIVE to that fd and
@@ -660,6 +691,7 @@ static int cmd_write_fd_link(int argc, char **argv) {
 
 static int dispatch(const char *cmd, int argc, char **argv) {
     if (strcmp(cmd, "chdir") == 0)          return cmd_chdir(argc, argv);
+    if (strcmp(cmd, "chdir-self") == 0)     return cmd_chdir_self(argc, argv);
     if (strcmp(cmd, "proc-dirfd") == 0)     return cmd_proc_dirfd(argc, argv);
     if (strcmp(cmd, "write-fd-link") == 0)  return cmd_write_fd_link(argc, argv);
     if (strcmp(cmd, "echo") == 0)           return cmd_echo(argc, argv);