procfs: add safe procfs API and harden proc operations

[cyphar]

A toy example of using this API to do a few operations runc needs to do internally:

int get_self_exe()
{
	/* This follows the trailing magic-link! */
	int fd = pathrs_proc_open(PATHRS_PROC_SELF, "exe", O_PATH);
	if (fd < 0) {
		pathrs_error_t *error = pathrs_errorinfo(fd);
		/* ... print the error ... */
		pathrs_errorinfo_free(error);
		return -1;
	}
	return fd;
}

int write_apparmor_label(char *label)
{
	int fd, err, saved_errno = 0;

	fd = pathrs_proc_open(PATHRS_PROC_SELF, "attr/exec", O_WRONLY|O_NOFOLLOW);
	if (fd < 0) {
		pathrs_error_t *error = pathrs_errorinfo(fd);
		/* ... print the error ... */
		pathrs_errorinfo_free(error);
		return -1;
	}

	err = write(fd, label, strlen(label));
	close(fd);
	return err;
}

char *get_unsafe_path(int fd)
{
	char *fdpath;

	if (asprintf(&fdpath, "fd/%d", fd) < 0)
		return NULL;

	int linkbuf_size = 128;
	char *linkbuf = malloc(size);
	if (!linkbuf)
		goto err;
	for (;;) {
		int len = pathrs_proc_readlink(PATHRS_PROC_THREAD_SELF, fdpath, linkbuf, linkbuf_size);
		if (len < 0) {
			pathrs_error_t *error = pathrs_errorinfo(fd);
			/* ... print the error ... */
			pathrs_errorinfo_free(error);
			goto err;
		}

		if (len <= linkbuf_size)
			break;

		linkbuf_size = len;
		linkbuf = realloc(linkbuf, linkbuf_size);
		if (!linkbuf)
			goto err;
	}

	free(fdpath);
	return name_buf;

err:
	free(fdpath);
	free(name_buf);
	return NULL;
}

Fixes #7
Fixes #15
Signed-off-by: Aleksa Sarai [email protected]

[cyphar]

The new O_PATH resolver has extensive tests, as does ProcfsHandle (based on the filepath-securejoin test suite but more extensive).

We're only really missing tests for the helper Root::... methods. The C API is not included because it isn't called from Rust. In theory we could add test cases using the C API from Rust, but we can look at whether that makes sense once we have tests for everything.