path/filepath: EvalSymlinks fails to follow symlink when root entry is a symlink

[mildred]

What version of Go are you using (go version)?

$ go version
go version go1.13.6 linux/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/mildred/.cache/go-build"
GOENV="/home/mildred/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/mildred/Projects/go"
GOPRIVATE=""
GOPROXY="direct"
GOROOT="/usr/lib/golang"
GOSUMDB="off"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/golang/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/mildred/Projects/terraform/test-bug-1/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build280616979=/tmp/go-build -gno-record-gcc-switches"

What did you do?

I found a bug in terraform: hashicorp/terraform#25367 and tracked it down to the go runtime

Reproducer:

package main

import (
  "path/filepath"
  "fmt"
  "syscall"
  "os"
)

func main(){
  os.Mkdir("origin", 0777)
  os.Mkdir("origin/var", 0777)
  os.Mkdir("origin/var/home", 0777)
  os.Mkdir("origin/var/home/foo", 0777)
  os.Symlink("var/home", "origin/home")
  os.Symlink("/home/foo", "origin/home/bar")
  os.Chdir("origin")
  syscall.Chroot(".")
  os.Chdir("home")
  fmt.Println(filepath.EvalSymlinks("bar"))
}

Reproduce by compiling this example and running it:

go build -o test-bug .
sudo ./test-bug
sudo strace -e trace=newfstatat,readlinkat ./test-bug

(you need to be root for chroot to work, it works well in a fedora-toolbox container with a user namespace root)

What did you expect to see?

filepath.EvalSymlinks should follow symlink home -> var/home in origin

What did you see instead?

filepath.EvalSymlinks fails to follow the symlink and errors out with lstat var: no such file or directory

[mildred]

Unfortunately, I might not be able to provide a pull request with that patch as I don't have a google account at hand to sign the CLA (and I won't create one). Please feel free to do whatever you want with the patch I provide, I do not retain any copyright on it.

[ianlancetaylor]

It's fine to not sign the CLA, of course, but in that case please do not send the patch as a GitHub comment. That just complicates the copyright status of the change. Thanks.

[networkimprov]

EvalSymlinks should almost never be used; see #40180. If Terraform isn't aware of this, could you inform them?

[mildred]

In any case, I'm ok to sign the CLA using any other means than using a google account. I also provided a PR with the patch, but I did that before knowing I had to sign the CLA.