Fix sandbox escape via absolute paths in *at syscalls

[moogchi]

Summary

Fixes sandbox escape via absolute paths in *at syscalls (fixes #1077).

Background

symlinkat, openat, unlinkat, and readlinkat all pass the raw guest path directly to the host kernel when a real dirfd is provided. Per POSIX, the host kernel ignores dirfd entirely when the path is absolute — allowing a malicious guest to escape the cage sandbox with a single syscall:

symlinkat("payload", any_valid_fd, "/etc/cron.d/backdoor");

Fix

Reject absolute paths in the dirfd branch of all four syscalls with EACCES before passing to the host kernel:

if raw_path.to_bytes().starts_with(b"/") {
    return syscall_error(Errno::EACCES, "symlinkat", "absolute path bypasses dirfd sandbox");
}

Affected syscalls

• symlinkat_syscall
• openat_syscall
• unlinkat_syscall
• readlinkat_syscall

[github-actions]

End-to-End Test Report

Test Preview

Unified Test Report

grate harness

Metric	Value
Total	11
Success	11
Failures	0
Compile Failures	0
Runtime Failures	0
Timeout Failures	0
Missing Pair Failures	0

Cases

Test	Status	Error Type	Output
concurrent-request/geteuid_grate.c	Success		STDOUT: [Grate|geteuid] Registering geteuid handler for cage 2 in grate 1 with fn ptr addr: 2 [Cage | geteuid] PASS: 1000000 calls returned 10 [Grate|geteuid] PASS STDERR:
interposing-calls/interpose-exec_grate.c	Success		STDOUT: [Grate|interpose-exec] Registering exec handler for cage 2 in grate 1 with fn ptr addr: 2 [Grate|interpose-exec] Handling function ptr: 2 from cage: 1 [Grate|interpose-exec] In exec_grate 1 handler for cage: 1 [Grate|interpose-exec] Handling function ptr: 2 from cage: 1 [Grate|interpose-exec] In exec_grate 1 handler for cage: 1 Exec successful, argv[1]: --execd [Grate|interpose-exec] PASS STDERR:
interposing-calls/interpose-exit_grate.c	Success		STDOUT: [Grate|interpose-exit] Registering exit handler for cage 2 in grate 1 with fn ptr addr: 2 Exiting... [Grate|interpose-exit] PASS STDERR:
interposing-calls/interpose-fork_grate.c	Success		STDOUT: [Grate|interpose-fork] Registering fork handler for cage 2 in grate 1 with fn ptr addr: 2 [Grate|interpose-fork] Handling function ptr: 2 from cage: 1 [Grate|interpose-fork] In fork_grate 1 handler for cage: 1 [Grate|interpose-fork] PASS STDERR:
interposing-calls/interpose-mmap_grate.c	Success		STDOUT: [Grate|interpose-mmap] Registering mmap handler for cage 2 in grate 1 with fn ptr addr: 2 [Grate|interpose-mmap] Handling function ptr: 2 from cage: 1 [Grate|interpose-mmap] In mmap_grate 1 handler for cage: 1 [Grate|interpose-mmap] Handling function ptr: 2 from cage: 1 [Grate|interpose-mmap] In mmap_grate 1 handler for cage: 1 [Grate|interpose-mmap] Handling function ptr: 2 from cage: 1 [Grate|interpose-mmap] In mmap_grate 1 handler for cage: 1 [Grate|interpose-mmap] Handling function ptr: 2 from cage: 1 [Grate|interpose-mmap] In mmap_grate 1 handler for cage: 1 [Grate|interpose-mmap] Handling function ptr: 2 from cage: 1 [Grate|interpose-mmap] In mmap_grate 1 handler for cage: 1 mmap test: PASS [Grate|interpose-mmap] PASS STDERR:
interposing-calls/interpose-register_grate.c	Success		STDOUT: [Grate|interpose-register] Registering register_handler for cage 2 in grate 1 with fn ptr addr: 3 [cage] registering 107. grateid: 2 cageid: 3 [Grate|interpose-register] Handling function ptr: 3 from cage: 1 [Grate|interpose-register] In register_grate 1 handler for cage: 1 [Grate|geteuid] Registering geteuid handler for cage 1 in grate 1 with fn ptr addr: 2 [Grate|interpose-register] Handling function ptr: 2 from cage: 1 [Grate|interpose-register] In register_grate 1 handler for cage: 1 [Grate|interpose-register] PASS STDERR:
multi-register_grate.c	Success		STDOUT: [Grate|multi-register_grate] Registering geteuid handler for cage 2 in grate 1 with fn ptr addr: 2 [Grate|multi-register_grate] Registering getuid handler for cage 2 in grate 1 with fn ptr addr: 3 [Grate|multi-register_grate] Handling function ptr: 2 from cage: 1 [Grate|multi-register_grate] In multi-register_grate 1 handler for cage: 1 [Grate|multi-register_grate] Handling function ptr: 3 from cage: 1 [Grate|multi-register_grate] In multi-register_grate 1 handler for cage: 1 [Cage | multi-register] PASS: geteuid=10, getuid=20 [Grate|multi-register] PASS STDERR:
race-test_grate.c	Success		STDOUT: pass STDERR:
simple-tests/cpdata_grate.c	Success		STDOUT: [Grate|open] intercepts open call: thiscage=1, arg1cage=2 [Grate|open] copied pathname: random [cage] fd=10 STDERR:
simple-tests/diff-cage-args_grate.c	Success		STDOUT: [Grate|diff-cage-args] Handling function ptr: 2 from cage: 1 [Grate|diff-cage-args] In open_grate 1 handler for cage: 1 Hello world. FD=-1 [Grate|diff-cage-args] Handling function ptr: 3 from cage: 1 Goodbye world! ret=4321 buf=helloworld [Grate|diff-cage-args] PASS STDERR:
simple-tests/geteuid_grate.c	Success		STDOUT: [Grate|geteuid] Registering geteuid handler for cage 2 in grate 1 with fn ptr addr: 2 [Grate|geteuid] Handling function ptr: 2 from cage: 1 [Grate|geteuid] In geteuid_grate 1 handler for cage: 1 [Cage | geteuid] PASS: geteuid ret = 10 [Grate|geteuid] PASS STDERR:

wasm harness

Test Report

Deterministic Tests

Summary

Metric	Count
Total Test Cases	205
Number of Successes	205
Number of Failures	0
Number of Compilation Failure Native	0
Number of Runtime Failure Native	0
Number of Segmentation Fault Native	0
Number of Timeout During Native	0
Number of Lind Wasm Compile Failure	0
Number of Lind Wasm Runtime Failure	0
Number of Lind Wasm Segmentation Failure	0
Number of Timeout During Lind Wasm run	0
Number of Unknown Failure	0
Number of C Compiler and Wasm Output mismatch	0
Number of Fail Test: Native Succeeded (Should Fail)	0
Number of Fail Test: Wasm Succeeded (Should Fail)	0
Number of Fail Test: Both Native and Wasm Succeeded (Should Fail)	0
Number of Fail Test: Native Compilation Failure (Should Succeed)	0
Number of Fail Test: Wasm Compilation Failure (Should Succeed)	0

Test Results by Category

Test Case	Status	Error Type	Native Time	Wasm Time	Output
File Tests
chartests.c	Success	None	0.041517s	0.162467s	Success
chdir_getcwd.c	Success	None	0.041988s	0.130041s	Success
chmod.c	Success	None	0.044910s	0.136044s	Success
clock_gettime_highlevel.c	Success	None	0.097702s	0.283587s	Success
clock_gettime_simple.c	Success	None	0.038018s	0.117229s	Success
cloexec.c	Success	None	0.069013s	0.196968s	Success
close.c	Success	None	0.052186s	0.154697s	Success
creat_access.c	Success	None	0.043007s	0.127760s	Success
doubleclose.c	Success	None	0.038004s	0.111995s	Success
dup.c	Success	None	0.038282s	0.127341s	Success
dup2.c	Success	None	0.043426s	0.147886s	Success
dup3.c	Success	None	0.042406s	0.131160s	Success
dupwrite.c	Success	None	0.061813s	0.141081s	Success
etc_conf.c	Success	None	0.039550s	0.141587s	Success
fchdir.c	Success	None	0.045097s	0.270525s	Success
fchmod.c	Success	None	0.045434s	0.137350s	Success
fcntl.c	Success	None	0.043491s	0.131938s	Success
fdatasync.c	Success	None	0.114437s	0.124203s	Success
filetest.c	Success	None	0.042749s	0.122791s	Success
filetest1000.c	Success	None	0.050662s	0.142040s	Success
flock.c	Success	None	0.083459s	0.157513s	Success
fstat.c	Success	None	0.049998s	0.134803s	Success
fstatfs.c	Success	None	0.039745s	0.230820s	Success
fsync.c	Success	None	0.043512s	0.144950s	Success
ftruncate.c	Success	None	0.047569s	0.246847s	Success
getcwd.c	Success	None	0.041454s	0.121829s	Success
getrandom.c	Success	None	0.158300s	0.126694s	Success
ioctl.c	Success	None	0.185989s	0.162773s	Success
link.c	Success	None	0.045620s	0.174858s	Success
locale_test.c	Success	None	0.064454s	0.517248s	Success
lseek.c	Success	None	0.047074s	0.229364s	Success
lstat.c	Success	None	0.045246s	0.148819s	Success
mkdir_rmdir.c	Success	None	0.102282s	0.126972s	Success
mkfifo_test.c	Success	None	0.048163s	0.167836s	Success
mknod.c	Success	None	0.050905s	0.187406s	Success
nocancel_io.c	Success	None	0.045511s	0.151604s	Success
open.c	Success	None	0.041368s	0.186401s	Success
openat.c	Success	None	0.039942s	0.121207s	Success
path_conversion_safety.c	Success	None	0.046686s	0.178525s	Success
pread_pwrite.c	Success	None	0.044444s	0.139013s	Success
preadv_pwritev.c	Success	None	0.044999s	0.139588s	Success
printf.c	Success	None	0.037020s	0.200701s	Success
prlimit64.c	Success	None	0.038905s	0.136355s	Success
read.c	Success	None	0.044880s	0.133717s	Success
readbytes.c	Success	None	0.041463s	0.119049s	Success
readdir_basic.c	Success	None	0.046504s	0.146819s	Success
readlink.c	Success	None	0.105101s	0.127045s	Success
readlinkat.c	Success	None	0.044258s	0.242450s	Success
readv_writev_test.c	Success	None	0.044106s	0.137345s	Success
rename.c	Success	None	0.045126s	0.125768s	Success
sc-writev.c	Success	None	0.043251s	0.127942s	Success
stat.c	Success	None	0.044287s	0.134298s	Success
statfs.c	Success	None	0.039266s	0.120262s	Success
symlink.c	Success	None	0.108689s	0.161229s	Success
sync_file_range.c	Success	None	0.041716s	0.126899s	Success
timespec_time_t_compat.c	Success	None	0.041770s	0.119424s	Success
truncate.c	Success	None	0.045114s	0.144808s	Success
unlink.c	Success	None	0.046111s	0.171172s	Success
unlinkat.c	Success	None	0.045387s	0.188956s	Success
write.c	Success	None	0.039261s	0.116102s	Success
writeloop.c	Success	None	0.045963s	0.127180s	Success
writepartial.c	Success	None	0.043984s	0.120848s	Success
writev.c	Success	None	0.044180s	0.310043s	Success
Math Tests
math_link_smoke.c	Success	None	0.047620s	0.123447s	Success
math_tests.c	Success	None	0.049659s	0.146633s	Success
Memory Tests
brk.c	Success	None	0.043358s	0.125604s	Success
fork_large_memory.c	Success	None	0.069757s	0.352761s	Success
malloc.c	Success	None	0.041153s	0.115972s	Success
malloc_large.c	Success	None	0.040432s	0.125181s	Success
memcpy.c	Success	None	0.041324s	0.394556s	Success
memory_error_test.c	Success	None	0.051771s	0.155949s	Success
mmap.c	Success	None	0.039164s	0.121584s	Success
mmap_aligned.c	Success	None	0.041129s	0.133065s	Success
mmap_complicated.c	Success	None	0.049064s	0.137703s	Success
mmap_file.c	Success	None	0.044885s	0.131565s	Success
mmap_shared.c	Success	None	0.044035s	0.135733s	Success
mmaptest.c	Success	None	0.041300s	0.125894s	Success
mprotect.c	Success	None	0.040307s	0.240527s	Success
mprotect_boundary.c	Success	None	0.040238s	0.136768s	Success
mprotect_end_region.c	Success	None	0.040661s	0.129848s	Success
mprotect_middle_region.c	Success	None	0.039303s	0.175940s	Success
mprotect_multiple_times.c	Success	None	0.039085s	0.129232s	Success
mprotect_same_value.c	Success	None	0.039838s	0.125054s	Success
mprotect_spanning_regions.c	Success	None	0.040382s	0.138465s	Success
sbrk.c	Success	None	0.041093s	0.119709s	Success
segfault.c	Success	None	0.045507s	0.145303s	Success
shm.c	Success	None	0.043549s	0.338789s	Success
shmtest.c	Success	None	0.041076s	0.128573s	Success
thread_malloc_sequential.c	Success	None	0.045962s	0.163588s	Success
vtable.c	Success	None	0.049188s	0.171440s	Success
Networking Tests
accept4.c	Success	None	0.047656s	0.144991s	Success
dns_resolve_test.c	Success	None	0.044475s	0.131989s	Success
dnstest.c	Success	None	0.045225s	0.137094s	Success
epoll_edge_triggered.c	Success	None	0.200886s	0.448403s	Success
epollcreate1.c	Success	None	0.045039s	0.137914s	Success
error_handling_net.c	Success	None	0.050909s	0.393762s	Success
getaddrinfo_test.c	Success	None	0.047049s	0.270334s	Success
getaddrinfo_unspec.c	Success	None	0.117064s	0.177351s	Success
gethostname.c	Success	None	0.039591s	0.116015s	Success
getifaddrs.c	Success	None	0.044918s	0.129725s	Success
getsockname.c	Success	None	0.048345s	0.130807s	Success
getsockopt.c	Success	None	0.046674s	0.175691s	Success
ipv6_basic.c	Success	None	0.047483s	0.174408s	Success
makepipe.c	Success	None	0.039117s	0.112663s	Success
nonblocking_eagain.c	Success	None	0.047968s	0.186510s	Success
pipe.c	Success	None	0.046898s	0.143549s	Success
pipe2.c	Success	None	0.045696s	0.130668s	Success
pipeinput.c	Success	None	0.048107s	0.146339s	Success
pipeinput2.c	Success	None	0.046439s	0.148733s	Success
pipeonestring.c	Success	None	0.047608s	0.147621s	Success
pipepong.c	Success	None	0.046304s	0.151681s	Success
pipewrite.c	Success	None	0.042358s	0.133786s	Success
poll.c	Success	None	0.044551s	0.125467s	Success
recvfrom-sendto.c	Success	None	0.046338s	0.143507s	Success
sendmsg_recvmsg_test.c	Success	None	0.046022s	0.142781s	Success
serverclient.c	Success	None	0.046211s	0.303090s	Success
shutdown.c	Success	None	0.045727s	0.133125s	Success
shutdown_fork.c	Success	None	0.046119s	0.138857s	Success
simple-select.c	Success	None	0.046197s	0.151527s	Success
simple_epoll.c	Success	None	0.048189s	0.139291s	Success
socket.c	Success	None	0.043874s	0.124526s	Success
socket_cloexec.c	Success	None	0.043464s	0.122685s	Success
socket_options_advanced.c	Success	None	0.049091s	0.192537s	Success
socketepoll.c	Success	None	0.043878s	0.127381s	Success
socketpair.c	Success	None	0.043697s	0.135490s	Success
socketselect.c	Success	None	0.045331s	0.134636s	Success
udp_send_recv.c	Success	None	0.149253s	0.291507s	Success
uds-getsockname.c	Success	None	0.044208s	0.128463s	Success
uds-nb-select.c	Success	None	2.050868s	2.190242s	Success
uds-serverclient.c	Success	None	0.057038s	0.162521s	Success
uds-socketselect.c	Success	None	0.045731s	0.132554s	Success
writev_socket.c	Success	None	0.047058s	0.168406s	Success
Process Tests
barrier_test.c	Success	None	0.043325s	0.131236s	Success
chain_thread.c	Success	None	1.045141s	1.135829s	Success
ctor_syscall_test.c	Success	None	0.038146s	0.117422s	Success
cxa_atexit_test.c	Success	None	0.041303s	0.118383s	Success
execve_shebang.c	Success	None	0.046259s	0.131458s	Success
exit.c	Success	None	0.041884s	0.115748s	Success
exit_failure.c	Success	None	0.043740s	0.260267s	Success
exit_group_thread.c	Success	None	0.063399s	0.135650s	Success
flockfile_test.c	Success	None	0.045520s	0.147735s	Success
fork2malloc.c	Success	None	0.044574s	0.129303s	Success
fork_select.c	Success	None	0.043763s	0.138822s	Success
fork_simple.c	Success	None	0.044884s	0.126888s	Success
fork_syscall.c	Success	None	0.047632s	0.255505s	Success
fork_tls_ctype.c	Success	None	0.046216s	0.151351s	Success
forkandopen.c	Success	None	0.044162s	0.142812s	Success
forkdup.c	Success	None	0.046106s	0.139984s	Success
forkexecuid.c	Success	None	0.044343s	0.196006s	Success
forkexecv-arg.c	Success	None	0.045401s	0.182325s	Success
forkexecv.c	Success	None	0.042919s	0.172511s	Success
forkfiles.c	Success	None	0.045075s	0.139357s	Success
forkmalloc.c	Success	None	0.051051s	0.125208s	Success
forknodup.c	Success	None	0.045756s	0.145688s	Success
function-ptr.c	Success	None	0.040164s	0.118967s	Success
getegid_syscall.c	Success	None	0.044812s	0.216729s	Success
getgid_syscall.c	Success	None	0.044425s	0.220344s	Success
getpid.c	Success	None	0.039540s	0.113462s	Success
getpid_syscall.c	Success	None	0.046081s	0.237272s	Success
getppid.c	Success	None	0.043862s	0.130750s	Success
getppid_syscall.c	Success	None	0.046204s	0.209731s	Success
getuid.c	Success	None	0.044185s	0.122318s	Success
getuid_syscall.c	Success	None	0.043589s	0.163923s	Success
hello-arg.c	Success	None	0.037368s	0.120782s	Success
hello.c	Success	None	0.037453s	0.113538s	Success
longjmp.c	Success	None	0.038503s	0.124586s	Success
mutex.c	Success	None	2.046385s	2.143745s	Success
printf_deadlock_smoke.c	Success	None	0.050342s	0.166582s	Success
printf_thread_test.c	Success	None	0.046421s	0.138558s	Success
sem_forks.c	Success	None	0.126271s	0.143808s	Success
setsid.c	Success	None	0.039678s	0.114509s	Success
template.c	Success	None	0.210434s	0.206676s	Success
test_exec_nofork.c	Success	None	0.043373s	0.175320s	Success
test_unlink_open_file.c	Success	None	0.040397s	0.116755s	Success
thread-guard.c	Success	None	0.042458s	0.133874s	Success
thread-test.c	Success	None	0.040753s	0.123069s	Success
thread.c	Success	None	0.041624s	0.121089s	Success
thread_cageid_race.c	Success	None	0.041796s	0.148287s	Success
tls_test.c	Success	None	0.043257s	0.133200s	Success
uname.c	Success	None	0.039136s	0.115234s	Success
wait.c	Success	None	2.042392s	2.130943s	Success
waitpid_anychild.c	Success	None	0.044700s	0.127761s	Success
waitpid_syscall.c	Success	None	1.044069s	1.158292s	Success
waitpid_wnohang.c	Success	None	0.045827s	0.129001s	Success
Signal Tests
alarm.c	Success	None	7.044055s	7.154291s	Success
eintr_fork_signal.c	Success	None	1.045317s	1.144209s	Success
kill.c	Success	None	1.044749s	1.151203s	Success
setitimer.c	Success	None	7.045045s	7.152670s	Success
sigalrm.c	Success	None	2.043524s	2.140644s	Success
sigaltstack.c	Success	None	0.046049s	0.138003s	Success
sigchld.c	Success	None	1.045529s	1.131887s	Success
signal-fork.c	Success	None	4.044706s	4.145254s	Success
signal-simple.c	Success	None	0.044038s	0.123088s	Success
signal_SIGCHLD.c	Success	None	0.043016s	0.133813s	Success
signal_fork.c	Success	None	0.043057s	0.141892s	Success
signal_int_ignored.c	Success	None	2.044764s	2.135436s	Success
signal_kill_cleanup.c	Success	None	1.042240s	1.130789s	Success
signal_procmask.c	Success	None	0.041003s	0.174203s	Success
signal_read_interrupt.c	Success	None	0.546534s	0.735269s	Success
signal_recursive.c	Success	None	0.041201s	0.131038s	Success
signal_sa_mask.c	Success	None	0.040259s	0.122568s	Success
signal_select_interrupt.c	Success	None	0.547108s	0.646596s	Success
signal_write_interrupt.c	Success	None	1.045147s	1.142227s	Success
sigpipe.c	Success	None	1.045565s	1.147189s	Success
sigprocmask.c	Success	None	1.044369s	1.139086s	Success

Fail Tests

Summary

Metric	Count
Total Test Cases	4
Number of Successes	4
Number of Failures	0
Number of Compilation Failure Native	0
Number of Runtime Failure Native	0
Number of Segmentation Fault Native	0
Number of Timeout During Native	0
Number of Lind Wasm Compile Failure	0
Number of Lind Wasm Runtime Failure	0
Number of Lind Wasm Segmentation Failure	0
Number of Timeout During Lind Wasm run	0
Number of Unknown Failure	0
Number of C Compiler and Wasm Output mismatch	0
Number of Fail Test: Native Succeeded (Should Fail)	0
Number of Fail Test: Wasm Succeeded (Should Fail)	0
Number of Fail Test: Both Native and Wasm Succeeded (Should Fail)	0
Number of Fail Test: Native Compilation Failure (Should Succeed)	0
Number of Fail Test: Wasm Compilation Failure (Should Succeed)	0

Test Results by Category

Test Case	Status	Error Type	Native Time	Wasm Time	Output
Dylink Tests
dlerror.c	Success	None	0.038580s	0.115849s	Success
Memory Tests
mmap-negative1.c	Success	None	0.203481s	0.135645s	Success
mmap-negative2.c	Success	None	0.092909s	0.130843s	Success
Signal Tests
signal_resethand.c	Success	None	1.046147s	1.137190s	Success