a file opened for writing could be written and not described - #27
Merged
Merged
Conversation
`kal_fs_file_info` answers through NtQueryInformationFile with
FileBasicInformation, which requires FILE_READ_ATTRIBUTES on the handle.
`FILE_GENERIC_WRITE` does not carry it — winnt.h defines it as
STANDARD_RIGHTS_WRITE | FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES |
FILE_WRITE_EA | FILE_APPEND_DATA | SYNCHRONIZE — so a file opened with
KAL_OPEN_WRITE and nothing else was granted every right except the one needed
to ask it about itself.
Through musl that surfaces as a descriptor refusing its own `fstat` a line
after it was opened:
open(..., O_WRONLY|O_CREAT|O_TRUNC) -> fd=3
fstat(3) -> -1, EACCES
measured on a Windows runner. libarchive does exactly that pair when opening
an archive for output (archive_write_open_filename.c:178 and :189), and
reports `Couldn't stat '<path>'` — a message that names the verb and
interpolates the argument. Four separate investigations went to the argument:
whether the path lay outside the program's preopened directories, whether two
temp-directory helpers disagreed about its 8.3 short form, whether the 8.3
component failed to resolve, and whether the errno for a missing name was
wrong. Each was refuted, and the path had already succeeded by the time the
failure happened.
FILE_READ_ATTRIBUTES is now requested always. It is the minimal right for the
question — metadata and no data — and `kal_fs_info` already asked for it by
itself, so this file knew the requirement in one place and not the other. The
no-flags case keeps its previous meaning explicitly rather than by falling out
of `access == 0`.
The criterion is `tests/write_handle_answers_info.cpp`. It states in its
header that Wine does not enforce the access check and answers rc=0 either
way, because "it passes under Wine" was offered as evidence three times while
this was open, and an environment that cannot produce the failing condition is
not a second opinion about it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
kal_fs_file_infoanswers throughNtQueryInformationFilewithFileBasicInformation, which requiresFILE_READ_ATTRIBUTESon the handle.FILE_GENERIC_WRITEdoes not carry it:So a file opened with
KAL_OPEN_WRITEand nothing else was granted everyright except the one needed to ask it about itself.
How it surfaces
Through musl, as a descriptor refusing its own
fstata line after it wasopened — measured on a Windows runner:
libarchive does exactly that pair when opening an archive for output
(
archive_write_open_filename.c:178and:189) and reportsa message that names the verb and interpolates the argument.
Four refuted hypotheses, all about the argument
Recorded because the sequence is what makes the diagnosis credible, and
because the message is built to send a reader to the wrong half:
layer ordinarily means that. Refuted by printing the preopen list: the
program held
C:outright.refuted by the next run returning an identical path and failure.
with no short component failing identically.
runner answers ENOENT, as Linux and Wine do.
By the time the failure happens the path has already succeeded. Reading
archive_write_open_filename.cended it in two lines.The change
FILE_READ_ATTRIBUTESis requested always. It is the minimal right for thequestion — metadata and no data — and
kal_fs_infoalready asked for it byitself, so this file knew the requirement in one place and not the other. The
no-flags case keeps its previous meaning explicitly rather than by falling out
of
access == 0.The criterion
tests/write_handle_answers_info.cppopens a file write-only and asks it forits own information.
Its header states that Wine does not enforce the access check and answers
rc=0either way. That is written down because "it passes under Wine" wasoffered as evidence three times while this was open, and an environment that
cannot produce the failing condition is not a second opinion about it. The
test therefore reports on Windows and is a guard elsewhere.