Merge pull request #4735 from wasmerio/fix-traversal-in-path-create

Add traversal for `Root` inode

lib/wasix/src/syscalls/wasi/path_create_directory.rs

@@ -1,3 +1,5 @@
+use std::{path::PathBuf, str::FromStr};
+
 use super::*;
 use crate::syscalls::*;
 
@@ -57,13 +59,7 @@ pub(crate) fn path_create_directory_internal(
     let env = ctx.data();
     let (memory, state, inodes) = unsafe { env.get_memory_and_wasi_state_and_inodes(&ctx, 0) };
     let working_dir = state.fs.get_fd(fd)?;
-    {
-        let guard = working_dir.inode.read();
-        if let Kind::Root { .. } = guard.deref() {
-            trace!("root has no rights to create a directories");
-            return Err(Errno::Access);
-        }
-    }
+
     if !working_dir.rights.contains(Rights::PATH_CREATE_DIRECTORY) {
         trace!("working directory (fd={fd}) has no rights to create a directory");
         return Err(Errno::Access);
@@ -151,9 +147,17 @@ pub(crate) fn path_create_directory_internal(
                     cur_dir_inode = new_inode;
                 }
             }
-            Kind::Root { .. } => {
-                trace!("the root node can no create a directory");
-                return Err(Errno::Access);
+            Kind::Root { entries } => {
+                match comp.borrow() {
+                    "." | ".." => continue,
+                    _ => (),
+                }
+                if let Some(child) = entries.get(comp) {
+                    cur_dir_inode = child.clone();
+                } else {
+                    trace!("the root node can no create a directory");
+                    return Err(Errno::Access);
+                }
             }
             _ => {
                 trace!("path is not a directory");

tests/integration/cli/resources/python/temp-dir-in-child/child.py

@@ -0,0 +1,4 @@
+import tempfile
+import sys
+
+temp_dir = tempfile.mkdtemp(prefix='pip-a-')

tests/integration/cli/resources/python/temp-dir-in-child/main.py

@@ -0,0 +1,5 @@
+import subprocess
+
+result = subprocess.run(["/bin/python", '/code/child.py'], capture_output=True, text=True)
+
+print(f"{result.returncode}", end="")

tests/integration/cli/src/fixtures.rs

@@ -4,9 +4,13 @@ use std::path::{Path, PathBuf};
 
 use crate::{asset_path, c_asset_path};
 
+pub fn resources() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("resources")
+}
+
 pub fn php() -> (PathBuf, PathBuf, PathBuf) {
     let root = Path::new(env!("CARGO_MANIFEST_DIR"));
-    let resources = root.join("resources").join("php");
+    let resources = resources().join("php");
     (
         root.join("tests").join("wasm").join("php.wasm"),
         resources.clone(),

tests/integration/cli/tests/run.rs

@@ -15,7 +15,7 @@ use reqwest::{blocking::Client, IntoUrl};
 use tempfile::TempDir;
 use wasmer_integration_tests_cli::{
     asset_path,
-    fixtures::{self, php},
+    fixtures::{self, php, resources},
     get_wasmer_path,
 };
 
@@ -47,6 +47,23 @@ static CACHE_RUST_LOG: Lazy<String> = Lazy::new(|| {
     .join(",")
 });
 
+#[test]
+fn run_python_create_temp_dir_in_subprocess() {
+    let resources = resources().join("python").join("temp-dir-in-child");
+
+    let output = Command::new(get_wasmer_path())
+        .arg("run")
+        .arg("python/python")
+        .arg("--mapdir")
+        .arg(format!("/code:{}", resources.display()))
+        .arg("--")
+        .arg("/code/main.py")
+        .output()
+        .unwrap();
+
+    assert_eq!(output.stdout, "0".as_bytes().to_vec());
+}
+
 #[test]
 fn run_php_with_sqlite() {
     let (php_wasm, app_dir, db) = php();