0.3.3

proot-next 0.3.3

Guest paths are walked on pinned descriptors

A guest could reach host files outside its view. Each guest path was
canonicalized by checking its components' host counterparts by name, and the
syscall was then made on the host path string built from them, which the
kernel resolved again. A guest thread that renamed an already-walked directory
away and moved a symlink to a host path into its place between the two steps
had the kernel follow that link out of the rootfs and out of every binding: an
independent reproduction read a host file outside the view in 7.8% of its
opens, and created files there.

• The rootfs and every binding are held open as O_PATH descriptors, and a
  lookup walks from them one component at a time with openat2 and
  RESOLVE_NO_SYMLINKS, so a symlink reports itself and is resolved inside
  the guest as before, and a renamed parent on the host cannot redirect the
  walk either.
• Every handler acts on the directory the walk pinned and the final name, in
  the *at form with symlinks not followed at that point; a symlink found
  there was swapped in since, so open, stat and the calls that open the
  object walk again, three times at most, then fail with ELOOP. Calls with
  no *at form act on the object's own descriptor.
• A mount point of the view is busy to unlink, rmdir and rename, as a
  mount point is.
• A missing intermediate component fails a lookup with ENOENT, as the
  kernel's own walk would.

Fixes

• The bench builds its tree under the canonical path of TMPDIR, so a
  TMPDIR reached through a symlink names the same files on every run.
• The test rootfs is checked against its digests, and the rootfs fetch
  retries the registry's errors.