#define _DEFAULT_SOURCE 1 #define _DARWIN_C_SOURCE 1 #define _POSIX_C_SOURCE 200809L #include "../runtime/yaza_runtime.c.inc" return 0; } #include #include #include typedef struct { char item_path[PATH_MAX]; char temporary_path[PATH_MAX]; char outside_path[PATH_MAX]; atomic_bool started; atomic_bool finished; atomic_bool failed; } fsroot_race_context; static void write_test_file(const char *path, const unsigned char *data, size_t length) { int descriptor = open(path, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, S_IRUSR | S_IWUSR); assert(descriptor >= 0); size_t offset = 0; while (offset < length) { ssize_t count = write(descriptor, data + offset, length - offset); if (count < 0 && errno == EINTR) continue; assert(count > 0); offset += (size_t)count; } assert(close(descriptor) == 0); } static void make_path(char *output, size_t capacity, const char *directory, const char *name) { int count = snprintf(output, capacity, "%s/%s", directory, name); assert(count > 0 && (size_t)count < capacity); } static void make_listing_entry_name(char name[NAME_MAX + 1], size_t index, bool wide) { if (wide) { memset(name, 'a', 240); int count = snprintf(name + 240, NAME_MAX + 1 - 240, "%08zu", index); assert(count == 8); } else { int count = snprintf(name, NAME_MAX + 1, "entry-%05zu", index); assert(count > 0 && count < NAME_MAX + 1); } } static void create_listing_entries(int directory_fd, size_t count, bool wide) { for (size_t index = 0; index < count; index++) { char name[NAME_MAX + 1]; make_listing_entry_name(name, index, wide); int descriptor = openat(directory_fd, name, O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC, S_IRUSR | S_IWUSR); assert(descriptor >= 0); assert(close(descriptor) == 0); } } static void remove_listing_entries(int directory_fd, size_t count, bool wide) { for (size_t index = 0; index < count; index++) { char name[NAME_MAX + 1]; make_listing_entry_name(name, index, wide); assert(unlinkat(directory_fd, name, 0) == 0); } } static bool text_list_has(const yaza_text_list *list, const char *name) { if (list == NULL || name == NULL) return false; for (size_t index = 0; index < list->length; index++) if (strcmp(list->items[index], name) == 0) return true; return false; } static int64_t text_list_number(const yaza_text_list *list, size_t index) { assert(list != NULL && index < list->length); errno = 0; char *end = NULL; long long value = strtoll(list->items[index], &end, 10); assert(errno == 0 && end != list->items[index] && *end == '\0'); return (int64_t)value; } static void *replace_regular_file_with_symlink(void *opaque) { fsroot_race_context *context = (fsroot_race_context *)opaque; atomic_store_explicit(&context->started, true, memory_order_release); for (size_t iteration = 0; iteration < 10000; iteration++) { if (unlink(context->temporary_path) != 0 && errno != ENOENT) { atomic_store_explicit(&context->failed, true, memory_order_release); break; } if (symlink(context->outside_path, context->temporary_path) != 0 || rename(context->temporary_path, context->item_path) != 0) { atomic_store_explicit(&context->failed, true, memory_order_release); break; } if (unlink(context->temporary_path) != 0 && errno != ENOENT) { atomic_store_explicit(&context->failed, true, memory_order_release); break; } int descriptor = open(context->temporary_path, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, S_IRUSR | S_IWUSR); if (descriptor < 0) { atomic_store_explicit(&context->failed, true, memory_order_release); break; } const char contents[] = "INSIDE"; size_t offset = 0; while (offset < sizeof(contents) - 1) { ssize_t count = write(descriptor, contents + offset, sizeof(contents) - 1 - offset); if (count < 0 && errno == EINTR) continue; if (count <= 0) { atomic_store_explicit(&context->failed, true, memory_order_release); break; } offset += (size_t)count; } if (close(descriptor) != 0 || rename(context->temporary_path, context->item_path) != 0) { atomic_store_explicit(&context->failed, true, memory_order_release); break; } if ((iteration & 31U) == 0) sched_yield(); } atomic_store_explicit(&context->finished, true, memory_order_release); return NULL; } static void assert_bytes(yaza_result result, const unsigned char *expected, size_t expected_length) { assert(result.is_ok && result.payload.kind == YAZA_OPTION_BYTES); yaza_bytes actual = result.payload.value.bytes; assert(actual.length == expected_length); assert(expected_length == 0 || memcmp(actual.data, expected, expected_length) == 0); } int main(void) { yaza_memory_arena_init(&yaza_program_memory_arena, YAZA_PROGRAM_MEMORY_LIMIT); yaza_program_memory_initialized = true; yaza_memory_arena_enter(&yaza_program_memory_arena); char temporary_root[] = "/tmp/yaza-fsroot-XXXXXX"; char *base = mkdtemp(temporary_root); assert(base != NULL); char root_path[PATH_MAX], outside_path[PATH_MAX], nested_path[PATH_MAX]; char created_path[PATH_MAX], created_nested_path[PATH_MAX], created_file_path[PATH_MAX]; char many_path[PATH_MAX], wide_path[PATH_MAX], empty_path[PATH_MAX]; char binary_path[PATH_MAX], symlink_file_path[PATH_MAX], symlink_dir_path[PATH_MAX]; char race_directory[PATH_MAX], race_item[PATH_MAX], race_temporary[PATH_MAX]; char outside_secret[PATH_MAX], outside_escaped[PATH_MAX], root_link[PATH_MAX]; make_path(root_path, sizeof(root_path), base, "root"); make_path(outside_path, sizeof(outside_path), base, "outside"); make_path(nested_path, sizeof(nested_path), root_path, "nested"); make_path(created_path, sizeof(created_path), root_path, "created"); make_path(created_nested_path, sizeof(created_nested_path), created_path, "private"); make_path(created_file_path, sizeof(created_file_path), created_nested_path, "probe.dat"); make_path(many_path, sizeof(many_path), root_path, "many"); make_path(wide_path, sizeof(wide_path), root_path, "wide"); make_path(empty_path, sizeof(empty_path), root_path, "empty"); make_path(binary_path, sizeof(binary_path), nested_path, "binary.dat"); make_path(symlink_file_path, sizeof(symlink_file_path), root_path, "link-file"); make_path(symlink_dir_path, sizeof(symlink_dir_path), root_path, "link-dir"); make_path(race_directory, sizeof(race_directory), root_path, "race"); make_path(race_item, sizeof(race_item), race_directory, "item"); make_path(race_temporary, sizeof(race_temporary), race_directory, "next"); make_path(outside_secret, sizeof(outside_secret), outside_path, "secret"); make_path(outside_escaped, sizeof(outside_escaped), outside_path, "escaped"); make_path(root_link, sizeof(root_link), base, "root-link"); assert(mkdir(root_path, 0700) == 0); assert(mkdir(outside_path, 0700) == 0); assert(mkdir(nested_path, 0700) == 0); assert(mkdir(race_directory, 0700) == 0); const unsigned char binary_value[] = {0x00, 0x80, 0xff, 0x41}; write_test_file(binary_path, binary_value, sizeof(binary_value)); write_test_file(outside_secret, (const unsigned char *)"OUTSIDE", 7); write_test_file(race_item, (const unsigned char *)"INSIDE", 6); assert(symlink(outside_secret, symlink_file_path) == 0); assert(symlink(outside_path, symlink_dir_path) == 0); assert(symlink(root_path, root_link) == 0); yaza_result root_open = yaza_fs_root_open(root_path); assert(root_open.is_ok && root_open.payload.kind == YAZA_OPTION_NUMBER); int64_t root_handle = (int64_t)root_open.payload.value.number; assert(!yaza_fs_root_open(root_link).is_ok); char oversized_path[YAZA_FS_RELATIVE_PATH_LIMIT + 2]; memset(oversized_path, 'a', sizeof(oversized_path) - 1); oversized_path[sizeof(oversized_path) - 1] = '\0'; assert(!yaza_fs_root_open(oversized_path).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, oversized_path, 1).is_ok); yaza_result created = yaza_fs_root_create_directory(root_handle, "created/private"); assert(created.is_ok && created.payload.kind == YAZA_OPTION_BOOLEAN && created.payload.value.boolean); yaza_result created_again = yaza_fs_root_create_directory(root_handle, "created/private"); assert(created_again.is_ok && created_again.payload.kind == YAZA_OPTION_BOOLEAN && created_again.payload.value.boolean); struct stat created_details; assert(lstat(created_path, &created_details) == 0 && S_ISDIR(created_details.st_mode)); assert((created_details.st_mode & 077) == 0); assert(lstat(created_nested_path, &created_details) == 0 && S_ISDIR(created_details.st_mode)); assert((created_details.st_mode & 077) == 0); assert(!yaza_fs_root_create_directory(root_handle, "../escaped").is_ok); assert(!yaza_fs_root_create_directory(root_handle, "/tmp/escaped").is_ok); assert(!yaza_fs_root_create_directory(root_handle, "created/../escaped").is_ok); assert(!yaza_fs_root_create_directory(root_handle, "created//invalid").is_ok); assert(!yaza_fs_root_create_directory(root_handle, "created/").is_ok); assert(!yaza_fs_root_create_directory(root_handle, "nested/binary.dat/child").is_ok); assert(!yaza_fs_root_create_directory(root_handle, "link-file").is_ok); assert(!yaza_fs_root_create_directory(root_handle, "link-dir").is_ok); assert(!yaza_fs_root_create_directory(root_handle, "link-dir/escaped").is_ok); struct stat outside_escaped_details; assert(lstat(outside_escaped, &outside_escaped_details) != 0 && errno == ENOENT); assert(!yaza_fs_root_create_directory(root_handle, oversized_path).is_ok); assert(!yaza_fs_root_create_directory(root_handle, "no-create/../escaped").is_ok); char control_directory_path[] = {'b', 'a', 'd', '/', 1, '\0'}; char backslash_directory_path[] = "bad\\component"; const char invalid_utf8_directory_path[] = {'b', 'a', 'd', '/', (char)0xff, '\0'}; assert(!yaza_fs_root_create_directory(root_handle, control_directory_path).is_ok); assert(!yaza_fs_root_create_directory(root_handle, backslash_directory_path).is_ok); assert(!yaza_fs_root_create_directory(root_handle, invalid_utf8_directory_path).is_ok); char too_many_components[YAZA_FS_COMPONENT_LIMIT * 2 + 16]; size_t too_many_length = (size_t)snprintf(too_many_components, sizeof(too_many_components), "limit-test"); for (size_t component = 1; component < YAZA_FS_COMPONENT_LIMIT + 1; component++) { too_many_components[too_many_length++] = '/'; too_many_components[too_many_length++] = 'x'; } too_many_components[too_many_length] = '\0'; assert(!yaza_fs_root_create_directory(root_handle, too_many_components).is_ok); char no_create_path[PATH_MAX], limit_test_path[PATH_MAX]; make_path(no_create_path, sizeof(no_create_path), root_path, "no-create"); make_path(limit_test_path, sizeof(limit_test_path), root_path, "limit-test"); struct stat absent_details; assert(lstat(no_create_path, &absent_details) != 0 && errno == ENOENT); assert(lstat(limit_test_path, &absent_details) != 0 && errno == ENOENT); const char directory_replacement[] = "rooted directory write"; yaza_result created_file = yaza_fs_root_replace_bytes( root_handle, "created/private/probe.dat", (yaza_bytes){(unsigned char *)directory_replacement, sizeof(directory_replacement) - 1}); assert(created_file.is_ok && created_file.payload.kind == YAZA_OPTION_BOOLEAN && created_file.payload.value.boolean); assert_bytes(yaza_fs_root_read_bytes(root_handle, "created/private/probe.dat", 64), (const unsigned char *)directory_replacement, sizeof(directory_replacement) - 1); yaza_result root_listing = yaza_fs_root_list_directory(root_handle, ""); assert(root_listing.is_ok && root_listing.payload.kind == YAZA_OPTION_TEXT_LIST); yaza_text_list *root_entries = root_listing.payload.value.text_list; assert(text_list_has(root_entries, "created")); assert(text_list_has(root_entries, "link-dir")); assert(text_list_has(root_entries, "link-file")); assert(text_list_has(root_entries, "nested")); for (size_t index = 1; index < root_entries->length; index++) assert(strcmp(root_entries->items[index - 1], root_entries->items[index]) <= 0); yaza_result root_metadata = yaza_fs_root_metadata(root_handle, ""); assert(root_metadata.is_ok && root_metadata.payload.kind == YAZA_OPTION_TEXT_LIST); yaza_text_list *root_fields = root_metadata.payload.value.text_list; assert(root_fields->length == 5 && strcmp(root_fields->items[0], "directory") == 0); assert(text_list_number(root_fields, 1) == 0); assert((text_list_number(root_fields, 2) & (S_IRWXG | S_IRWXO)) == 0); assert(text_list_number(root_fields, 4) >= 0 && text_list_number(root_fields, 4) < 1000000000); yaza_result file_metadata = yaza_fs_root_metadata(root_handle, "created/private/probe.dat"); assert(file_metadata.is_ok && file_metadata.payload.kind == YAZA_OPTION_TEXT_LIST); yaza_text_list *file_fields = file_metadata.payload.value.text_list; assert(file_fields->length == 5 && strcmp(file_fields->items[0], "file") == 0); assert(text_list_number(file_fields, 1) == (int64_t)(sizeof(directory_replacement) - 1)); assert((text_list_number(file_fields, 2) & (S_IRWXG | S_IRWXO)) == 0); assert(text_list_number(file_fields, 4) >= 0 && text_list_number(file_fields, 4) < 1000000000); yaza_result nested_metadata = yaza_fs_root_metadata(root_handle, "created/private"); assert(nested_metadata.is_ok && nested_metadata.payload.kind == YAZA_OPTION_TEXT_LIST); assert(strcmp(nested_metadata.payload.value.text_list->items[0], "directory") == 0); assert(!yaza_fs_root_metadata(root_handle, "../outside").is_ok); assert(!yaza_fs_root_metadata(root_handle, "link-file").is_ok); assert(!yaza_fs_root_metadata(root_handle, "link-dir").is_ok); assert(!yaza_fs_root_metadata(root_handle, "nested/binary.dat/child").is_ok); int root_directory_fd = open(root_path, O_RDONLY | O_DIRECTORY | O_CLOEXEC); assert(root_directory_fd >= 0); const char invalid_utf8_name[] = {'i', 'n', 'v', 'a', 'l', 'i', 'd', (char)0xff, '\0'}; int invalid_utf8_fd = openat(root_directory_fd, invalid_utf8_name, O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC, S_IRUSR | S_IWUSR); if (invalid_utf8_fd >= 0) { assert(close(invalid_utf8_fd) == 0); assert(!yaza_fs_root_list_directory(root_handle, "").is_ok); assert(unlinkat(root_directory_fd, invalid_utf8_name, 0) == 0); } else { /* Some filesystems reject non-UTF-8 names before the runtime can see them. */ assert(errno == EILSEQ || errno == EINVAL); } assert(close(root_directory_fd) == 0); yaza_result nested_listing = yaza_fs_root_list_directory(root_handle, "created/private"); assert(nested_listing.is_ok && nested_listing.payload.kind == YAZA_OPTION_TEXT_LIST); assert(nested_listing.payload.value.text_list->length == 1); assert(text_list_has(nested_listing.payload.value.text_list, "probe.dat")); yaza_result empty_created = yaza_fs_root_create_directory(root_handle, "empty"); assert(empty_created.is_ok && empty_created.payload.value.boolean); yaza_result empty_listing = yaza_fs_root_list_directory(root_handle, "empty"); assert(empty_listing.is_ok && empty_listing.payload.kind == YAZA_OPTION_TEXT_LIST); assert(empty_listing.payload.value.text_list->length == 0); assert(!yaza_fs_root_list_directory(root_handle, "../outside").is_ok); assert(!yaza_fs_root_list_directory(root_handle, "link-dir").is_ok); assert(!yaza_fs_root_list_directory(root_handle, "nested/binary.dat").is_ok); assert(!yaza_fs_root_list_directory(root_handle, "missing").is_ok); assert(mkdir(many_path, 0700) == 0); int many_fd = open(many_path, O_RDONLY | O_DIRECTORY | O_CLOEXEC); assert(many_fd >= 0); create_listing_entries(many_fd, YAZA_FS_DIRECTORY_ENTRY_LIMIT + 1, false); assert(!yaza_fs_root_list_directory(root_handle, "many").is_ok); remove_listing_entries(many_fd, YAZA_FS_DIRECTORY_ENTRY_LIMIT + 1, false); assert(close(many_fd) == 0); assert(rmdir(many_path) == 0); assert(mkdir(wide_path, 0700) == 0); int wide_fd = open(wide_path, O_RDONLY | O_DIRECTORY | O_CLOEXEC); assert(wide_fd >= 0); create_listing_entries(wide_fd, 2120, true); assert(!yaza_fs_root_list_directory(root_handle, "wide").is_ok); remove_listing_entries(wide_fd, 2120, true); assert(close(wide_fd) == 0); assert(rmdir(wide_path) == 0); assert_bytes(yaza_fs_root_read_bytes(root_handle, "nested/binary.dat", 4), binary_value, sizeof(binary_value)); assert(!yaza_fs_root_read_bytes(root_handle, "nested/binary.dat", 3).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, "nested/binary.dat", -1).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, "nested/binary.dat", (int64_t)YAZA_MAX_BYTES + 1).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, "../outside/secret", 32).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, "/etc/passwd", 32).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, "nested/../nested/binary.dat", 32).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, "nested//binary.dat", 32).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, "nested/", 32).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, "nested\\binary.dat", 32).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, ".", 32).is_ok); const char invalid_utf8_path[] = {'n', 'e', 's', 't', 'e', 'd', '/', (char)0xff, '\0'}; assert(!yaza_fs_root_read_bytes(root_handle, invalid_utf8_path, 32).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, symlink_file_path + strlen(root_path) + 1, 32).is_ok); assert(!yaza_fs_root_read_bytes(root_handle, "link-dir/secret", 32).is_ok); const char replacement[] = "new safe contents"; yaza_result replaced = yaza_fs_root_replace_bytes( root_handle, "link-file", (yaza_bytes){(unsigned char *)replacement, sizeof(replacement) - 1}); assert(replaced.is_ok && replaced.payload.kind == YAZA_OPTION_BOOLEAN && replaced.payload.value.boolean); assert_bytes(yaza_fs_root_read_bytes(root_handle, "link-file", sizeof(replacement)), (const unsigned char *)replacement, sizeof(replacement) - 1); struct stat link_details; assert(lstat(symlink_file_path, &link_details) == 0 && S_ISREG(link_details.st_mode)); int outside_fd = open(outside_secret, O_RDONLY | O_CLOEXEC); assert(outside_fd >= 0); char outside_contents[8] = {0}; assert(read(outside_fd, outside_contents, 7) == 7 && memcmp(outside_contents, "OUTSIDE", 7) == 0); assert(close(outside_fd) == 0); assert(!yaza_fs_root_replace_bytes(root_handle, "../escaped", (yaza_bytes){(unsigned char *)replacement, 3}).is_ok); assert(!yaza_fs_root_replace_bytes(root_handle, "nested/binary.dat", (yaza_bytes){(unsigned char *)binary_value, (size_t)YAZA_MAX_BYTES + 1}).is_ok); fsroot_race_context race = {0}; snprintf(race.item_path, sizeof(race.item_path), "%s", race_item); snprintf(race.temporary_path, sizeof(race.temporary_path), "%s", race_temporary); snprintf(race.outside_path, sizeof(race.outside_path), "%s", outside_secret); atomic_init(&race.started, false); atomic_init(&race.finished, false); atomic_init(&race.failed, false); pthread_t racer; assert(pthread_create(&racer, NULL, replace_regular_file_with_symlink, &race) == 0); while (!atomic_load_explicit(&race.started, memory_order_acquire)) sched_yield(); size_t race_reads = 0; do { yaza_result result = yaza_fs_root_read_bytes(root_handle, "race/item", 32); if (result.is_ok) { const unsigned char expected[] = "INSIDE"; assert(result.payload.kind == YAZA_OPTION_BYTES); assert(result.payload.value.bytes.length == sizeof(expected) - 1); assert(memcmp(result.payload.value.bytes.data, expected, sizeof(expected) - 1) == 0); } race_reads++; } while (!atomic_load_explicit(&race.finished, memory_order_acquire) || race_reads < 1000); assert(pthread_join(racer, NULL) == 0); assert(!atomic_load_explicit(&race.failed, memory_order_acquire)); assert(race_reads >= 1000); assert(yaza_fs_root_close(root_handle).is_ok); assert(!yaza_fs_root_close(root_handle).is_ok); assert(!yaza_fs_root_create_directory(root_handle, "after-close").is_ok); assert(!yaza_fs_root_list_directory(root_handle, "").is_ok); assert(!yaza_fs_root_read_bytes(root_handle, "nested/binary.dat", 4).is_ok); yaza_result reopened = yaza_fs_root_open(root_path); assert(reopened.is_ok && reopened.payload.kind == YAZA_OPTION_NUMBER); int64_t fresh_handle = (int64_t)reopened.payload.value.number; assert(fresh_handle != root_handle); assert(!yaza_fs_root_read_bytes(root_handle, "nested/binary.dat", 4).is_ok); assert(yaza_fs_root_close(fresh_handle).is_ok); yaza_result unclosed = yaza_fs_root_open(root_path); assert(unclosed.is_ok && unclosed.payload.kind == YAZA_OPTION_NUMBER); int64_t unclosed_handle = (int64_t)unclosed.payload.value.number; yaza_fs_roots_shutdown(); assert(!yaza_fs_root_close(unclosed_handle).is_ok); assert(unlink(root_link) == 0); assert(unlink(symlink_file_path) == 0); assert(unlink(symlink_dir_path) == 0); assert(unlink(binary_path) == 0); assert(unlink(created_file_path) == 0); assert(rmdir(created_nested_path) == 0); assert(rmdir(empty_path) == 0); assert(rmdir(created_path) == 0); assert(unlink(race_item) == 0); if (unlink(race_temporary) != 0) assert(errno == ENOENT); assert(rmdir(race_directory) == 0); assert(rmdir(nested_path) == 0); assert(rmdir(root_path) == 0); assert(unlink(outside_secret) == 0); assert(rmdir(outside_path) == 0); assert(rmdir(base) == 0); yaza_memory_shutdown(); puts("Secure rooted filesystem capability checks passed."); return 0; }