feat: Expand safe directory traversal to all Unix platforms and fix related type conversions. #9792

abendrothj · 2025-12-23T11:11:57Z

feat: enable safe traversal on all Unix platforms

Expands the safe_traversal module support from target_os = "linux" to unix, enabling security improvements (specifically preventing TOCTOU races) on macOS and BSDs.

Changes:

Feature Guards: Replaced #[cfg(target_os = "linux")] with #[cfg(unix)] in uucore, du, chmod, and rm.
Refactoring: Renamed src/uu/rm/src/platform/linux.rs to unix.rs to reflect the broader platform support.
Type Safety: Added necessary type casts in safe_traversal.rs and du.rs to handle platform-specific differences in libc types (e.g., mode_t).

Verification:
Verified with cargo test on macOS.

Closes #9747

…elated type conversions.

github-actions · 2025-12-23T12:48:03Z

GNU testsuite comparison:

Skipping an intermittent issue tests/misc/tee (passes in this run but fails in the 'main' branch)

sylvestre

plenty of jobs are failing, please fix them

- Use 'as u64' casts with clippy::unnecessary_cast suppression for st_nlink and st_ino to handle platform-specific type differences - Add TOCTOU (time-of-check time-of-use) to cspell dictionary Fixes compilation errors on FreeBSD, OpenBSD, and Android where libc types differ from Linux/macOS (st_nlink is u16, st_ino is u32). The cast is unnecessary on some platforms but required on others, hence the clippy suppression.

Resolved merge conflict in src/uu/du/src/du.rs by keeping the unix cfg guard (not target_os = "linux") to align with the PR's goal of expanding safe_traversal to all Unix platforms.

sylvestre · 2025-12-27T15:21:02Z

Still a few job failures

github-actions · 2025-12-27T15:31:09Z

GNU testsuite comparison:

GNU test failed: tests/cp/cp-mv-enotsup-xattr. tests/cp/cp-mv-enotsup-xattr is passing on 'main'. Maybe you have to rebase?
Note: The gnu test tests/csplit/csplit-io-err was skipped on 'main' but is now failing.

This commit addresses compilation errors and test failures on macOS and BSD platforms introduced by the safe_traversal expansion to Unix platforms. **SELinux Platform Guards (8 files):** The SELinux module in uucore is Linux-only, gated behind `#[cfg(all(target_os = "linux", feature = "selinux"))]`. However, code was only checking `#[cfg(feature = "selinux")]`, causing compilation failures on macOS/BSDs where uucore::selinux doesn't exist. Fixed by updating all SELinux feature checks from: `#[cfg(feature = "selinux")]` to: `#[cfg(all(feature = "selinux", target_os = "linux"))]` Modified files: - src/uu/cp/src/cp.rs (2 locations) - src/uu/id/src/id.rs (4 locations) - src/uu/install/src/install.rs (17 locations) - src/uu/mkdir/src/mkdir.rs (1 location) - src/uu/mkfifo/src/mkfifo.rs (1 location) - src/uu/mknod/src/mknod.rs (1 location) - src/uu/stat/src/stat.rs (2 locations) **Type Conversion Fix:** On macOS, `libc::mode_t` is `u16` while `metadata.permissions().mode()` returns `u32`, causing a type mismatch in rm's safe_traversal code. Fixed in src/uu/rm/src/platform/unix.rs:320 by adding explicit cast: `initial_mode as libc::mode_t` **Test Fix:** Updated test_chmod_recursive to expect consistent error messages across all Unix platforms. With safe_traversal now enabled universally on Unix, the detailed error format "cannot access 'z': Permission denied" is used on all platforms, not just Linux. Modified: tests/by-util/test_chmod.rs **Verification:** - ✅ All unit tests pass (chmod, du, rm, cp, id, stat, mkdir, mkfifo, mknod, install, uucore) - ✅ All functional tests pass - ✅ cargo build --features feat_os_macos - ✅ cargo build --features feat_os_unix - ✅ cargo clippy (macOS & Unix features) - ✅ cargo fmt --all -- --check - ✅ chmod integration tests (40/40 passed)

github-actions · 2025-12-28T10:07:37Z

GNU testsuite comparison:

GNU test failed: tests/sort/sort-stale-thread-mem. tests/sort/sort-stale-thread-mem is passing on 'main'. Maybe you have to rebase?

Fixes multiple platform-specific type issues in safe_traversal.rs: 1. **Clippy unnecessary_cast warnings** - Add #[allow(clippy::unnecessary_cast)] to dev(), mode(), and rdev() methods. These casts are unnecessary on Linux where types are already u64/u32, but required on macOS/BSD where: - st_dev is i32 (needs cast to u64) - st_mode is u16 (needs cast to u32) - st_rdev is i32 (needs cast to u64) 2. **Android type mismatch** - Cast st_mode to libc::mode_t in file_type() method. On Android, st_mode is u32 but libc::mode_t is u16, causing compilation failure when passing to FileType::from_mode(). These fixes match the existing pattern already used for st_ino and st_nlink. Resolves: - Style/lint (ubuntu-latest, all, true) - clippy errors - Style and Lint (unix) - OpenBSD clippy errors - Test builds (Android x86/x86_64) - type mismatch errors

…unnecessary)

github-actions · 2025-12-28T11:47:16Z

GNU testsuite comparison:

Congrats! The gnu test tests/tail/assert is no longer failing!

github-actions · 2025-12-28T12:22:05Z

GNU testsuite comparison:

Congrats! The gnu test tests/tail/assert is no longer failing!

…modules & disable safe dir for Redox (assumedly will be handled in another PR but can implement Redox specific version if requested)

…sive_impl and safe_traversal modules

github-actions · 2025-12-28T13:26:12Z

GNU testsuite comparison:

Congrats! The gnu test tests/tail/assert is no longer failing!

- Fix type mismatches in rm's unix.rs by casting libc constants to u16 to match st_mode - Add Redox stubs for safe_traversal to prevent build errors on Redox - Make locale format tests robust: only enforce strict checks on platforms with locale support (Linux, macOS, BSDs) These changes ensure safe directory traversal and related utilities build and test cleanly across all Unix targets, including Redox, and CI passes regardless of locale support.

…safe_remove_dir_recursive_impl

…pe for Android platform

…rations

github-actions · 2025-12-28T14:55:54Z

GNU testsuite comparison:

Congrats! The gnu test tests/tail/assert is no longer failing!

…lity (final huzzah)

github-actions · 2025-12-28T15:25:51Z

GNU testsuite comparison:

Congrats! The gnu test tests/tail/assert is no longer failing!

github-actions · 2025-12-28T16:32:52Z

GNU testsuite comparison:

Congrats! The gnu test tests/tail/assert is no longer failing!

…bility Fixes compilation errors on Redox by properly gating code that depends on nix crate types (FileStat) which are not available on Redox. Changes: - Add direct libc import for Redox (nix::libc not available) - Gate Metadata struct, impl, and MetadataExt trait (use FileStat) - Gate metadata_at() and metadata() methods (return Metadata) - Revert unrelated locale test changes from commit 5704355 The Redox platform lacks support for nix::sys::stat::FileStat, causing build failures. These items now follow the existing pattern of returning "safe_traversal is not supported on Redox" errors via gated stub methods.

github-actions · 2025-12-29T10:44:00Z

GNU testsuite comparison:

Note: The gnu test tests/id/smack was skipped on 'main' but is now failing.
Note: The gnu test tests/mkdir/smack-no-root was skipped on 'main' but is now failing.
Note: The gnu test tests/mkdir/smack-root was skipped on 'main' but is now failing.

github-actions · 2025-12-29T11:11:25Z

GNU testsuite comparison:

Note: The gnu test tests/basenc/bounded-memory is now being skipped but was previously passing.

…e Redox

abendrothj · 2025-12-30T12:34:20Z

@sylvestre Would you like the Mac OS test to be updated in the same PR, or save it for another? Also I've gated Redox, under the assumption that redox and non-posix OS implementations would be handled in another PR as well. Let me know!

sylvestre · 2025-12-30T12:37:25Z

@sylvestre Would you like the Mac OS test to be updated in the same PR, or save it for another? Also I've gated Redox, under the assumption that redox and non-posix OS implementations would be handled in another PR as well. Let me know!

another pr is fine
but for redox, it is a lot of duplication of #[cfg(not(target_os = "redox"))] in the safe_traversal. rs file
it should be simplified (or split in different files)

abendrothj · 2025-12-30T12:49:28Z

That should be better, I removed the scattered #[cfg(...redox...)] guards. Since the module is already excluded on Redox in features.rs, the internal guards were redundant.

github-actions · 2025-12-30T13:53:19Z

GNU testsuite comparison:

Skipping an intermittent issue tests/timeout/timeout (passes in this run but fails in the 'main' branch)
Note: The gnu test tests/env/env-signal-handler is now being skipped but was previously passing.

github-actions · 2025-12-31T10:07:48Z

GNU testsuite comparison:

Skipping an intermittent issue tests/timeout/timeout (passes in this run but fails in the 'main' branch)

…ions

github-actions · 2025-12-31T11:04:05Z

GNU testsuite comparison:

GNU test failed: tests/shuf/shuf-reservoir. tests/shuf/shuf-reservoir is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/sort/sort-stale-thread-mem. tests/sort/sort-stale-thread-mem is passing on 'main'. Maybe you have to rebase?
Skip an intermittent issue tests/tail/overlay-headers (fails in this run but passes in the 'main' branch)

Make safe-traversal feature conditional for chmod and du crates, enabling compilation on Redox OS which lacks support for the fstatat syscalls required by uucore's safe_traversal module. Changes: - Move safe-traversal to platform-specific dependencies for non-Redox Unix - Add guards to exclude DirFd usage on Redox - Provide Redox-specific implementation for chmod's walk_dir_with_context using standard filesystem operations - Add guard to du's new_from_dirfd to match its DirFd import guard Both utilities now fall back to standard fs operations on Redox.

github-actions · 2025-12-31T12:42:18Z

GNU testsuite comparison:

Congrats! The gnu test tests/tty/tty-eof is no longer failing!

github-actions · 2025-12-31T13:01:12Z

GNU testsuite comparison:

Congrats! The gnu test tests/tty/tty-eof is no longer failing!

abendrothj · 2025-12-31T19:42:33Z

@sylvestre That should do it. Let me know if there's anything else needed for this pr to be merged

sylvestre · 2026-01-03T10:53:17Z

@sylvestre That should do it. Let me know if there's anything else needed for this pr to be merged

still a bunch of jobs are failing :)

feat: Expand safe directory traversal to all Unix platforms and fix r…

c9d6f81

…elated type conversions.

sylvestre requested changes Dec 23, 2025

View reviewed changes

abendrothj added 2 commits December 27, 2025 07:04

Merge branch 'main' of https://github.com/uutils/coreutils into main

f1c7082

Resolved merge conflict in src/uu/du/src/du.rs by keeping the unix cfg guard (not target_os = "linux") to align with the PR's goal of expanding safe_traversal to all Unix platforms.

abendrothj requested a review from sylvestre December 27, 2025 15:11

abendrothj and others added 3 commits December 28, 2025 01:10

Merge branch 'main' into main

1c06851

Merge branch 'main' into main

cfbf666

abendrothj force-pushed the main branch from 00fe208 to 9445537 Compare December 28, 2025 11:25

abendrothj and others added 2 commits December 28, 2025 03:28

Merge branch 'main' into main

959d39d

fix: That should be all the casts ignored by clippy (were showing as …

d8348c5

…unnecessary)

fix: Suppress unnecessary cast warnings in cp and du modules

4f65a77

abendrothj and others added 3 commits December 28, 2025 04:39

fix: Ensure proper type handling for mode_t in rm and safe_traversal …

3cb2071

…modules & disable safe dir for Redox (assumedly will be handled in another PR but can implement Redox specific version if requested)

Merge branch 'main' into main

29a04c0

fix: Improve code formatting for readability in safe_remove_dir_recur…

e326036

…sive_impl and safe_traversal modules

abendrothj added 4 commits December 28, 2025 05:35

fix: Use type inference for mode checks in prompt_file_with_stat and …

c8cc10c

…safe_remove_dir_recursive_impl

fix(android): handle symlink and directory checks with appropriate ty…

05d675b

…pe for Android platform

fix(redox): improve error handling for unsupported safe traversal ope…

0f48443

…rations

fix(unix): simplify symlink and directory checks for improved readabi…

e6a9637

…lity (final huzzah)

fix(uucore): gate unix-specific safe_traversal methods for redox

e4f13ef

abendrothj and others added 2 commits December 29, 2025 02:22

Merge branch 'main' into main

d946a9d

fix(redox): move libc import under the correct conditional compilation

9f41965

abendrothj force-pushed the main branch from fd39886 to 9f41965 Compare December 29, 2025 11:38

sylvestre and others added 3 commits December 29, 2025 13:03

Merge branch 'main' into main

b0803a5

Merge branch 'main' into main

262b53b

Refactor conditional compilation for Unix-specific features to exclud…

78cbd9a

…e Redox

Remove Redox-specific exclusion code from safe_traversal module

ea5ad61

abendrothj and others added 2 commits December 30, 2025 06:44

Exclude Redox from safe_traversal feature for Unix compatibility

df5f26a

Merge branch 'main' into main

3e0c411

abendrothj added 2 commits December 31, 2025 02:35

rm: add Redox-specific stub implementations for safe traversal

2102a85

rm: add spell-checker directive for fstatat in Redox stub implementat…

370107e

…ions

cargo: fix formatting of uucore dependencies in Cargo.toml

5cc0c65

abendrothj added 2 commits December 31, 2025 12:08

Merge branch 'main' into main

1fc7d18

Merge branch 'main' into main

44950a2

Uh oh!

feat: Expand safe directory traversal to all Unix platforms and fix related type conversions. #9792

Are you sure you want to change the base?

feat: Expand safe directory traversal to all Unix platforms and fix related type conversions. #9792

Uh oh!

Conversation

abendrothj commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

sylvestre left a comment

Choose a reason for hiding this comment

Uh oh!

sylvestre commented Dec 27, 2025

Uh oh!

github-actions bot commented Dec 27, 2025

Uh oh!

github-actions bot commented Dec 28, 2025

Uh oh!

github-actions bot commented Dec 28, 2025

Uh oh!

github-actions bot commented Dec 28, 2025

Uh oh!

github-actions bot commented Dec 28, 2025

Uh oh!

github-actions bot commented Dec 28, 2025

Uh oh!

github-actions bot commented Dec 28, 2025

Uh oh!

github-actions bot commented Dec 28, 2025

Uh oh!

github-actions bot commented Dec 29, 2025

Uh oh!

github-actions bot commented Dec 29, 2025

Uh oh!

abendrothj commented Dec 30, 2025

Uh oh!

sylvestre commented Dec 30, 2025

Uh oh!

abendrothj commented Dec 30, 2025

Uh oh!

github-actions bot commented Dec 30, 2025

Uh oh!

github-actions bot commented Dec 31, 2025

Uh oh!

github-actions bot commented Dec 31, 2025

Uh oh!

github-actions bot commented Dec 31, 2025

Uh oh!

github-actions bot commented Dec 31, 2025

Uh oh!

abendrothj commented Dec 31, 2025

Uh oh!

sylvestre commented Jan 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

abendrothj commented Dec 23, 2025 •

edited

Loading