coreutils: accept /dev/fd/ execfn prefixes

AT_EXECFN is /dev/fd/N if binary was called by fexecve(3), not /proc/self/fd/N

Author: oech3

src/common/validation.rs

@@ -3,7 +3,7 @@
 // For the full copyright and license information, please view the LICENSE
 // file that was distributed with this source code.
 
-// spell-checker:ignore memfd_create prefixcat rsplit testcat
+// spell-checker:ignore execveat fexecve memfd_create prefixcat rsplit testcat
 
 use std::ffi::{OsStr, OsString};
 use std::io::{Write, stderr};
@@ -102,10 +102,12 @@ pub fn binary_path(args: &mut impl Iterator<Item = OsString>) -> PathBuf {
     let exec_path = Path::new(OsStr::from_bytes(execfn_bytes));
     let argv0 = args.next().unwrap();
     let mut shebang_buf = [0u8; 2];
-    // exec_path is wrong when called from shebang or memfd_create (/proc/self/fd/*)
+    // exec_path is wrong when called from a shebang, or via fexecve/execveat:
+    // the kernel reports /dev/fd/* and memfd_create/glibc's fallback /proc/self/fd/*
     // argv0 is not full-path when called from PATH
     if execfn_bytes.rsplit(|&b| b == b'/').next() == argv0.as_bytes().rsplit(|&b| b == b'/').next()
         || execfn_bytes.starts_with(b"/proc/")
+        || execfn_bytes.starts_with(b"/dev/fd/")
         || (File::open(Path::new(exec_path))
             .and_then(|mut f| f.read_exact(&mut shebang_buf))
             .is_ok()

tests/test_util_name.rs

@@ -43,6 +43,36 @@ fn binary_name_protection() {
         .stdout_contains("coreutils");
 }
 
+// missing /proc/self/fd on Android?
+#[test]
+#[cfg(all(feature = "true", target_os = "linux", target_env = "gnu"))]
+fn binary_name_execfn_fallback() {
+    use std::os::{fd::AsRawFd, unix::process::CommandExt};
+    use std::process::Command;
+    let ts = TestScenario::new("true");
+    let fd = rustix::fs::memfd_create("a", rustix::fs::MemfdFlags::empty()).unwrap();
+    let mut file = std::fs::File::from(fd);
+    let mut source = std::fs::File::open(&ts.bin_path).unwrap();
+    std::io::copy(&mut source, &mut file).unwrap();
+    let raw_fd = file.as_raw_fd();
+
+    // memfd has AT_EXECFN as below. Fallback to argv[0]
+    let res1 = Command::new(format!("/proc/self/fd/{raw_fd}"))
+        .arg0("true")
+        .output()
+        .unwrap()
+        .status
+        .success();
+    // fexecve uses /dev/fd which is symlink to /proc/self/fd/N
+    let res2 = Command::new(format!("/dev/fd/{raw_fd}"))
+        .arg0("true")
+        .output()
+        .unwrap()
+        .status
+        .success();
+    assert!(res1 && res2);
+}
+
 #[test]
 fn test_coreutils_help_ignore_args() {
     let scenario = TestScenario::new("help_ignoring_args");