Kernel FS: close guest→host sandbox escapes in the path resolver (#478)

* Kernel FS: default-deny unmapped guest paths (fixes absolute-path host escape) ResolveGuestPath returned any unrecognized guest path verbatim as the host path. Because absolute paths ("/etc/passwd", "C:\Windows\...") are already fully qualified, they skipped the relative-path app0 fallback and were handed straight to FileStream/File.Delete/etc., giving a malicious game arbitrary host-file read/write/delete outside the sandbox. Return string.Empty (deny) on fallthrough instead. Most callers already treat a nonexistent host path as NOT_FOUND; open/truncate/rename get an explicit empty-path guard so a denied path can't reach FileStream and throw an ArgumentException their catch blocks don't cover. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Kernel FS: contain built-in mounts (fixes Windows drive-letter injection) The built-in mount branches (app0/temp0/download0/hostapp/devlog) combined the mount-relative guest path onto the host root without re-checking containment. NormalizeMountRelativePath clamps ./.. but splits only on separators, so a drive-qualified token like "C:" survives as a segment and Path.Combine then discards the mount root, yielding a raw host path such as "C:\Windows\..." (arbitrary host read/write). Route every built-in branch through a new CombineWithinMount helper that re-resolves with Path.GetFullPath and verifies the result stays under the mount root -- the same guard TryResolveRegisteredGuestMount already applied. Denied paths return string.Empty, which callers treat as unresolved. AprStreamingContractTests passed a raw Path.GetTempFileName() as the guest path, relying on the now-removed absolute-path passthrough; updated it to address the file through a registered mount. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Kernel FS: reject reparse points inside mounts (fixes symlink escape) Lexical containment (Path.GetFullPath + StartsWith) proves the textual path stays under the mount root but does not follow symlinks/junctions. A malicious game dump could plant a reparse point inside app0/temp0/etc. pointing outside it, so a contained-looking path resolved onto the host filesystem. Walk each existing component from the mount root to the candidate and refuse any reparse point, in both the built-in and registered-mount resolution paths. Mirrors AvPlayer's existing defense. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Kernel FS: fail closed when path containment cannot be verified The reparse-point and drive-letter containment guards call Path.GetFullPath and File.GetAttributes on untrusted guest paths. Both throw on crafted over-long or invalid-char input, and ResolveGuestPath runs outside the file syscalls' try blocks, so such a path was a guest-triggerable crash rather than a denial. Wrap the GetFullPath calls in CombineWithinMount and the registered-mount path, and widen the GetAttributes catch, to treat any access/format failure as an escape (deny) instead of propagating. Also tighten the ".." fallback check so a legitimate file named "..foo" is not falsely rejected, and hoist the repeated Path.GetFullPath(mountRoot) into a local. Adds a regression test asserting the resolver returns without throwing for an over-long and a NUL-embedded path under a mount. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Kernel FS: assert malformed paths resolve to empty, not just no-throw The fail-closed regression test asserted only Assert.NotNull, which a non-nullable string return can never violate via its value (only a throw, which aborts the test earlier anyway). Tighten to Assert.Equal(string.Empty) so it also locks in fail-CLOSED: a regression where a malformed path resolved to a non-empty host path would now be caught. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Kernel FS: route new AMPR batch tests through a registered mount Merging main brought in three AprStreamingContractTests that pass raw Path.GetTempFileName()/temp host paths as guest paths. The default-deny resolver from this branch rejects absolute host paths, so MissingMidBatch failed at index 0 instead of the intended index 1. Address the present file through a registered mount (as ResolveStatAndReadFile already does) so entries 0 and 2 resolve and the batch fails at the genuinely-missing entry. The two all-missing tests were unaffected but share the fix's intent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Kernel FS: make a matched-mount denial terminal; fix Unix-only test asserts A registered mount that claims a path by prefix but denies it (failed containment or a reparse point inside the mount) now short-circuits in ResolveGuestPath instead of falling through to the built-in mount branches. The fall-through let an overlapping prefix (a registered "/app0" vs the built-in SHARPEMU_APP0_DIR branch, which resolves against a cached root) re-resolve a denied path and turn the denial back into a resolution -- the reparse-point escape reappeared on Linux CI through exactly this path. Also fix two tests that asserted Windows-specific behavior unconditionally: a "C:\..." path is not absolute on Unix (it resolves contained under the mount there), and that case is now pinned to Windows only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: slick-daddy <slick-daddy@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-31 15:09:42 +08:00 · 2026-07-21 00:58:34 +03:00
parent 224a36eba7
commit e01092aa38
4 changed files with 438 additions and 27 deletions
@@ -267,6 +267,11 @@ public static partial class KernelMemoryCompatExports
        }

        var hostPath = ResolveGuestPath(guestPath);
+        if (string.IsNullOrEmpty(hostPath))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
        try
        {
            using var stream = new FileStream(hostPath, FileMode.Open, FileAccess.Write, FileShare.ReadWrite);
@@ -310,6 +315,11 @@ public static partial class KernelMemoryCompatExports

        var fromHost = ResolveGuestPath(fromGuest);
        var toHost = ResolveGuestPath(toGuest);
+        if (string.IsNullOrEmpty(fromHost) || string.IsNullOrEmpty(toHost))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
        try
        {
            if (Directory.Exists(fromHost))
@@ -1448,6 +1448,13 @@ public static partial class KernelMemoryCompatExports
        var hostPath = ResolveGuestPath(guestPath);
        var access = ResolveOpenAccess(flags);
        var mode = ResolveOpenMode(flags, access);
+        // A denied path (empty host path) must not reach FileStream, which would
+        // throw an ArgumentException the catch below does not cover.
+        if (string.IsNullOrEmpty(hostPath))
+        {
+            LogOpenTrace($"_open denied path='{guestPath}' flags=0x{flags:X8}");
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
        try
        {
            if (Bink2MovieBridge.ShouldSkipGuestMovie(hostPath))
@@ -4778,21 +4785,32 @@ public static partial class KernelMemoryCompatExports
            return guestPath;
        }

-        if (TryResolveRegisteredGuestMount(guestPath, out var mountedPath))
+        if (TryResolveRegisteredGuestMount(guestPath, out var mountedPath, out var mountPrefixMatched))
        {
            return mountedPath;
        }

+        // A registered mount claimed this path by prefix but denied it (failed
+        // containment or a reparse point inside the mount). That denial is
+        // authoritative: do NOT fall through to the built-in branches below,
+        // which could re-resolve an overlapping prefix (e.g. a registered
+        // "/app0" vs the built-in SHARPEMU_APP0_DIR branch) against a different
+        // root and turn the denial back into a resolution.
+        if (mountPrefixMatched)
+        {
+            return string.Empty;
+        }
+
        if (guestPath.StartsWith("/devlog/app/", StringComparison.OrdinalIgnoreCase))
        {
            var relative = NormalizeMountRelativePath(guestPath["/devlog/app/".Length..]);
-            return Path.Combine(ResolveDevlogAppRoot(), relative);
+            return CombineWithinMount(ResolveDevlogAppRoot(), relative);
        }

        if (guestPath.StartsWith("devlog/app/", StringComparison.OrdinalIgnoreCase))
        {
            var relative = NormalizeMountRelativePath(guestPath["devlog/app/".Length..]);
-            return Path.Combine(ResolveDevlogAppRoot(), relative);
+            return CombineWithinMount(ResolveDevlogAppRoot(), relative);
        }

        if (string.Equals(guestPath, "/devlog/app", StringComparison.OrdinalIgnoreCase) ||
@@ -4804,7 +4822,7 @@ public static partial class KernelMemoryCompatExports
        if (guestPath.StartsWith("/temp0/", StringComparison.OrdinalIgnoreCase))
        {
            var relative = NormalizeMountRelativePath(guestPath["/temp0/".Length..]);
-            return Path.Combine(ResolveTemp0Root(), relative);
+            return CombineWithinMount(ResolveTemp0Root(), relative);
        }

        if (string.Equals(guestPath, "/temp0", StringComparison.OrdinalIgnoreCase))
@@ -4815,13 +4833,13 @@ public static partial class KernelMemoryCompatExports
        if (guestPath.StartsWith("/download0/", StringComparison.OrdinalIgnoreCase))
        {
            var relative = NormalizeMountRelativePath(guestPath["/download0/".Length..]);
-            return Path.Combine(ResolveDownload0Root(), relative);
+            return CombineWithinMount(ResolveDownload0Root(), relative);
        }

        if (guestPath.StartsWith("download0/", StringComparison.OrdinalIgnoreCase))
        {
            var relative = NormalizeMountRelativePath(guestPath["download0/".Length..]);
-            return Path.Combine(ResolveDownload0Root(), relative);
+            return CombineWithinMount(ResolveDownload0Root(), relative);
        }

        if (string.Equals(guestPath, "/download0", StringComparison.OrdinalIgnoreCase) ||
@@ -4833,13 +4851,13 @@ public static partial class KernelMemoryCompatExports
        if (guestPath.StartsWith("/hostapp/", StringComparison.OrdinalIgnoreCase))
        {
            var relative = NormalizeMountRelativePath(guestPath["/hostapp/".Length..]);
-            return Path.Combine(ResolveHostappRoot(), relative);
+            return CombineWithinMount(ResolveHostappRoot(), relative);
        }

        if (guestPath.StartsWith("hostapp/", StringComparison.OrdinalIgnoreCase))
        {
            var relative = NormalizeMountRelativePath(guestPath["hostapp/".Length..]);
-            return Path.Combine(ResolveHostappRoot(), relative);
+            return CombineWithinMount(ResolveHostappRoot(), relative);
        }

        if (string.Equals(guestPath, "/hostapp", StringComparison.OrdinalIgnoreCase) ||
@@ -4862,7 +4880,7 @@ public static partial class KernelMemoryCompatExports
                guestPath.StartsWith("$\\", StringComparison.Ordinal))
            {
                var relative = NormalizeMountRelativePath(guestPath[2..]);
-                return Path.Combine(app0Root, relative);
+                return CombineWithinMount(app0Root, relative);
            }

            if (string.Equals(guestPath, "/app0", StringComparison.OrdinalIgnoreCase) ||
@@ -4874,13 +4892,13 @@ public static partial class KernelMemoryCompatExports
            if (guestPath.StartsWith("/app0/", StringComparison.OrdinalIgnoreCase))
            {
                var relative = NormalizeMountRelativePath(guestPath["/app0/".Length..]);
-                return Path.Combine(app0Root, relative);
+                return CombineWithinMount(app0Root, relative);
            }

            if (guestPath.StartsWith("app0/", StringComparison.OrdinalIgnoreCase))
            {
                var relative = NormalizeMountRelativePath(guestPath["app0/".Length..]);
-                return Path.Combine(app0Root, relative);
+                return CombineWithinMount(app0Root, relative);
            }

            if (!Path.IsPathFullyQualified(guestPath) &&
@@ -4888,16 +4906,26 @@ public static partial class KernelMemoryCompatExports
                !guestPath.StartsWith("\\", StringComparison.Ordinal))
            {
                var relative = NormalizeMountRelativePath(guestPath);
-                return Path.Combine(app0Root, relative);
+                return CombineWithinMount(app0Root, relative);
            }
        }

-        return guestPath;
+        // Default-deny: a guest path that matched no mount prefix must NOT be
+        // handed back verbatim as a host path. Returning it raw let any absolute
+        // guest path address the host filesystem directly ("/etc/passwd",
+        // "C:\\Windows\\...") because it is already fully qualified and skips the
+        // relative-path app0 fallback above. Callers treat an empty host path as
+        // "resolves to nothing" and fail the syscall with NOT_FOUND.
+        return string.Empty;
    }

-    private static bool TryResolveRegisteredGuestMount(string guestPath, out string hostPath)
+    private static bool TryResolveRegisteredGuestMount(
+        string guestPath,
+        out string hostPath,
+        out bool mountPrefixMatched)
    {
        hostPath = string.Empty;
+        mountPrefixMatched = false;
        var normalizedGuestPath = NormalizeGuestStatCachePath(guestPath);
        if (normalizedGuestPath is null)
        {
@@ -4925,10 +4953,30 @@ public static partial class KernelMemoryCompatExports
            return false;
        }

+        // A registered mount owns this prefix. Whatever the outcome below
+        // (containment or reparse denial), the caller must NOT fall through to a
+        // built-in branch for the same prefix, or a denied path could be
+        // re-resolved against a different root.
+        mountPrefixMatched = true;
+
        var relativePath = normalizedGuestPath[matchedMountPoint.Length..].TrimStart('/');
-        var candidate = Path.GetFullPath(Path.Combine(
-            matchedHostRoot,
-            NormalizeMountRelativePath(relativePath)));
+        string candidate;
+        try
+        {
+            candidate = Path.GetFullPath(Path.Combine(
+                matchedHostRoot,
+                NormalizeMountRelativePath(relativePath)));
+        }
+        catch (Exception ex) when (
+            ex is IOException or ArgumentException or NotSupportedException)
+        {
+            // The relative part comes from an untrusted guest path; a crafted
+            // over-long or invalid path can make GetFullPath throw. Fail closed
+            // rather than propagate out of ResolveGuestPath (which callers invoke
+            // outside their try blocks).
+            return false;
+        }
+
        var rootWithSeparator = Path.TrimEndingDirectorySeparator(matchedHostRoot) + Path.DirectorySeparatorChar;
        // Host-semantics comparison: an ignore-case check on a case-sensitive
        // host would let a relative path escape into a sibling directory that
@@ -4940,6 +4988,14 @@ public static partial class KernelMemoryCompatExports
            return false;
        }

+        // Textual containment does not follow symlinks/junctions; refuse a
+        // reparse point planted inside the mount that would redirect onto the
+        // host filesystem. See EscapesMountViaReparsePoint.
+        if (EscapesMountViaReparsePoint(Path.GetFullPath(matchedHostRoot), candidate))
+        {
+            return false;
+        }
+
        hostPath = candidate;
        return true;
    }
@@ -4998,6 +5054,116 @@ public static partial class KernelMemoryCompatExports
        return string.Join(Path.DirectorySeparatorChar, resolved);
    }

+    // Combines a mount-relative guest path onto a built-in mount root and
+    // re-verifies the result stays under that root. NormalizeMountRelativePath
+    // strips "." / ".." but splits only on separators, so a drive-qualified
+    // token like "C:" survives as a segment; Path.Combine then DISCARDS the
+    // mount root because its second argument is drive-rooted, yielding a raw
+    // host path such as "C:\Windows\...". Re-resolving with Path.GetFullPath and
+    // checking containment (the same guard TryResolveRegisteredGuestMount uses)
+    // rejects that escape. Returns string.Empty on denial, which callers treat
+    // as an unresolved path.
+    private static string CombineWithinMount(string mountRoot, string relative)
+    {
+        string fullRoot;
+        string candidate;
+        try
+        {
+            fullRoot = Path.GetFullPath(mountRoot);
+            candidate = Path.GetFullPath(Path.Combine(fullRoot, relative));
+        }
+        catch (Exception ex) when (
+            ex is IOException or ArgumentException or NotSupportedException)
+        {
+            // The relative part comes from an untrusted guest path; a crafted
+            // over-long or invalid path can make GetFullPath throw. Fail closed
+            // rather than propagate out of ResolveGuestPath (which callers invoke
+            // outside their try blocks).
+            return string.Empty;
+        }
+
+        var rootWithSeparator =
+            Path.TrimEndingDirectorySeparator(fullRoot) + Path.DirectorySeparatorChar;
+        if (!string.Equals(candidate, fullRoot, HostFsPathComparison) &&
+            !candidate.StartsWith(rootWithSeparator, HostFsPathComparison))
+        {
+            return string.Empty;
+        }
+
+        if (EscapesMountViaReparsePoint(fullRoot, candidate))
+        {
+            return string.Empty;
+        }
+
+        return candidate;
+    }
+
+    // Lexical containment (Path.GetFullPath + StartsWith) proves the TEXTUAL
+    // path stays under the mount root, but it does not follow symlinks or
+    // Windows junctions. A malicious game dump can plant a reparse point inside
+    // an otherwise-contained mount (e.g. "/app0/link" -> "/") so that
+    // "/app0/link/etc/passwd" passes the textual check yet resolves onto the
+    // host filesystem. Walk each already-existing component from the mount root
+    // down to the candidate and refuse if any is a reparse point. Components
+    // that do not yet exist (e.g. an O_CREAT target and its parents) carry no
+    // link to follow and are simply skipped. Mirrors the reparse rejection in
+    // AvPlayerExports.TryResolveSandboxedFile.
+    private static bool EscapesMountViaReparsePoint(string mountRoot, string candidate)
+    {
+        var rootTrimmed = Path.TrimEndingDirectorySeparator(mountRoot);
+        if (string.Equals(candidate, rootTrimmed, HostFsPathComparison))
+        {
+            return false;
+        }
+
+        var relative = Path.GetRelativePath(rootTrimmed, candidate);
+        // A leading ".." segment means the candidate is not under the root. Match
+        // the segment precisely: bare ".." or a "../" prefix, NOT a legitimate
+        // file merely named "..foo". This branch is a defensive fallback (lexical
+        // containment already passed before it runs), so it fails closed.
+        if (relative == "." || relative == ".." || Path.IsPathRooted(relative) ||
+            relative.StartsWith(".." + Path.DirectorySeparatorChar, StringComparison.Ordinal) ||
+            relative.StartsWith(".." + Path.AltDirectorySeparatorChar, StringComparison.Ordinal))
+        {
+            // Not actually under the root (should have been caught lexically);
+            // treat as an escape rather than walk outside it.
+            return true;
+        }
+
+        var current = rootTrimmed;
+        foreach (var segment in relative.Split(
+                     Path.DirectorySeparatorChar,
+                     StringSplitOptions.RemoveEmptyEntries))
+        {
+            current = Path.Combine(current, segment);
+            try
+            {
+                if ((File.GetAttributes(current) & FileAttributes.ReparsePoint) != 0)
+                {
+                    return true;
+                }
+            }
+            catch (Exception ex) when (ex is FileNotFoundException or DirectoryNotFoundException)
+            {
+                // Component does not exist yet (create path); nothing to follow.
+                break;
+            }
+            catch (Exception ex) when (
+                ex is IOException or UnauthorizedAccessException or ArgumentException or NotSupportedException)
+            {
+                // The path comes from an untrusted dump, so a crafted over-long,
+                // invalid-char, or unreadable intermediate component can make
+                // GetAttributes throw. Fail closed: if containment cannot be
+                // verified, treat it as an escape rather than let the exception
+                // crash the syscall (ResolveGuestPath runs outside the callers'
+                // try blocks).
+                return true;
+            }
+        }
+
+        return false;
+    }
+
    private static string ResolveDevlogAppRoot()
    {
        var configuredRoot = Environment.GetEnvironmentVariable("SHARPEMU_DEVLOG_APP_DIR");