[WASI] Should we overlook or restrict the access modes for stdin/stdout/stderr?

[lum1n0us]

We've observed that in certain situations, the access modes for STDIN, STDOUT and STDERR do not behave as anticipated. For example, STDOUT may be read-only, while STDIN may be write-only.

It's important that we look into why these unexpected access modes are occurring. However, I'm wondering if we need to take steps to block these incorrect settings in core/iwasm/libraries/libc-wasi

Specifically, when determining file descriptor rights in the function fd_determine_type_rights(), should we assign fixed and unchangeable rights to STDIN, STDOUT and STDERR?

[wenyongh]

I saw the PR #3694 sets the STDIN rights with:

(__WASI_RIGHT_FD_ADVISE | __WASI_RIGHT_FD_FILESTAT_GET | \
  __WASI_RIGHT_FD_READ | __WASI_RIGHT_POLL_FD_READWRITE)

not sure will it disable the write right for STDIN and disable the read right for STDOUT? It seems the similar issues were reported before, but after discussion with @yamt, we decided not to change the code:
#2645 (comment)
#2606

[yamt]

We've observed that in certain situations, the access modes for STDIN, STDOUT and STDERR do not behave as anticipated. For example, STDOUT may be read-only, while STDIN may be write-only.

It's important that we look into why these unexpected access modes are occurring. However, I'm wondering if we need to take steps to block these incorrect settings in core/iwasm/libraries/libc-wasi

yes, please investigate the situation further before making changes to libc-wasi.

[lum1n0us]

The problem originated from integrating WAMR with runwasi, which aims to run a WebAssembly runtime within containerd. I haven't pinpointed the exact issue yet, but there are some unanticipated behaviors occurring within their sandbox environment. Like, fcntl(STDOUT, F_GETFL, 0) returns O_RDONLY. The unusual result will strip off write bits.

Then I made an trial on linux.

$ cat demo.c
int main() {
    int ret;

    ret = fcntl(STDOUT_FILENO, F_GETFL);
    printf("fcntl(stdout, F_GETFL)=%d\n", ret);

    ret = fcntl(STDOUT_FILENO, F_SETFL, O_RDONLY);
    perror("fcntl(stdout, F_SETFL, O_RDONLY)");

    ret = fcntl(STDOUT_FILENO, F_GETFL);
    printf("fcntl(stdout, F_GETFL)=%d\n", ret);

    return EXIT_SUCCESS;
}
$ clang -o demo demo.c
$ demo
fcntl(stdout, F_GETFL)=2
fcntl(stdout, F_SETFL, O_RDONLY): Success
fcntl(stdout, F_GETFL)=2

IIUC, this suggests that the access mode for STDOUT cannot be altered. As a result, it appears that the access mode for STDOUT ought to remain fixed, making any previous removal of write permissions unnecessary.

If everyone is in consensus that the access modes for STDIN, STDOUT, and STDERR are fixed and cannot be altered, then we can begin to discuss the suitable combinations of permissions for these three streams.

[wenyongh]

Agree that the access modes for STDIN, STDOUT and STDERR should be fixed, and suggest adding __WASI_RIGHT_FD_READ | __WASI_RIGHT_FD_WRITE to the rights of them all.