Function getTaskPathOperation

pkg/sentry/syscalls/linux/path.go:39–83

(t *kernel.Task, dirfd int32, path fspath.Path, emptyPathCheck shouldAllowEmptyPathType, shouldFollowFinalSymlink shouldFollowFinalSymlink)

}

func getTaskPathOperation(t *kernel.Task, dirfd int32, path fspath.Path, emptyPathCheck shouldAllowEmptyPathType, shouldFollowFinalSymlink shouldFollowFinalSymlink) (taskPathOperation, error) {
	root := t.FSContext().RootDirectory()
	start := root
	haveStartRef := false
	if !path.Absolute {
		if !path.HasComponents() && !emptyPathCheck.allow() {
			root.DecRef(t)
			return taskPathOperation{}, linuxerr.ENOENT
		}
		if dirfd == linux.AT_FDCWD {
			start = t.FSContext().WorkingDirectory()
			haveStartRef = true
		} else {
			dirfile := t.GetFile(dirfd)
			if dirfile == nil {
				root.DecRef(t)
				return taskPathOperation{}, linuxerr.EBADF
			}
			defer dirfile.DecRef(t)

			// AT_EMPTY_PATH is allowed only if t's creds are identical to the creds under which the FD was
			// opened, or if t has CAP_DAC_READ_SEARCH in those creds' userns.
			// Similar to how Linux handles LOOKUP_LINKAT_EMPTY in path_init() in fs/namei.c.
			if emptyPathCheck == allowEmptyPathWithCredsCheck {
				if dirfile.Credentials() != t.Credentials() && !t.HasCapabilityIn(linux.CAP_DAC_READ_SEARCH, dirfile.Credentials().UserNamespace) {
					root.DecRef(t)
					return taskPathOperation{}, linuxerr.ENOENT
				}
			}

			start = dirfile.VirtualDentry()
			start.IncRef()
			haveStartRef = true
		}
	}
	return taskPathOperation{
		pop: vfs.PathOperation{
			Root:               root,
			Start:              start,
			Path:               path,
			FollowFinalSymlink: bool(shouldFollowFinalSymlink),
		},
		haveStartRef: haveStartRef,
	}, nil
}

func (tpop *taskPathOperation) Release(t *kernel.Task) {
	tpop.pop.Root.DecRef(t)