Avoid false negatice permission denied error message (#9046)

[andkit]

The unix implementation of cd fails with a permission error when classical unix permissions deny access to a directory, but additional mechanisms like ACLs actually grant the user access

Fix this by miroring the windows implementation: if we can read_dir() without error => allow the cd to proceed.

Addtionally we also handle the case where it is the other way round: unix permissions grant access but additional security modules (SElinux, apparmor, etc.) deny the current user/context.

fixes #9046

[sholderbach]

That strategy of checking for failure instead sounds more sound to me.

Our cd is already not atomic so the existing TOCTOU bug risk doesn't change from the previous implementation but if we can get the check into a more realistic state all the better.

Can you look into which tests now fail?

[andkit]

Hmm, well, looks like a case of "Damn, not as easy as it appeared at first".

The failing test removes the execute permission from a directory and expects cd to fail. My patch however uses a successful readdir() as indication that a cd should be fine too, but that's not really true either (readdir succeeds, but any actual chdir will fail later, but by that time nushells cd command is long finished).

Doing the operation we actually want (chdir) instead of an approximate opertion is not a good idea either as it messes up the process state (and forking a child just for that seems very inefficient)

I'll have to think about the some more, maybe there is another trick we can try

[sholderbach]

Thanks for looking into this. That indeed sounds a bit unfortunate. As we may want to spawn external processes from different threads at any time, changing the process working directory seems indeed like a bad idea (if not carefully controlled).

For reference fish can get by with open of the directory fd and then fchdir as they act more posixy in that regard https://github.com/fish-shell/fish-shell/blob/326d986186b206139da1fee4b35091d40b2ed224/src/builtins/cd.rs#L90-L125

(Marking the PR as draft)