os: add Root.Symlink

For #67002

Change-Id: Ia1637b61eae49e97e1d07f058ad2390e74cd3403
Reviewed-on: https://go-review.googlesource.com/c/go/+/660635
Reviewed-by: Alan Donovan <adonovan@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Quim Muntal <quimmuntal@gmail.com>
Auto-Submit: Damien Neil <dneil@google.com>

7 files changed, 330 insertions, 9 deletions

diff --git a/src/os/os_test.go b/src/os/os_test.go
index 3ab8226e44..c6c08d062a 100644
--- a/src/os/os_test.go
+++ b/src/os/os_test.go
@@ -923,43 +923,62 @@ func testHardLink(t *testing.T, root *Root) {
 }
 
 func TestSymlink(t *testing.T) {
+	testMaybeRooted(t, testSymlink)
+}
+func testSymlink(t *testing.T, root *Root) {
 	testenv.MustHaveSymlink(t)
-	t.Chdir(t.TempDir())
+
+	var (
+		create   = Create
+		open     = Open
+		symlink  = Symlink
+		stat     = Stat
+		lstat    = Lstat
+		readlink = Readlink
+	)
+	if root != nil {
+		create = root.Create
+		open = root.Open
+		symlink = root.Symlink
+		stat = root.Stat
+		lstat = root.Lstat
+		readlink = root.Readlink
+	}
 
 	from, to := "symlinktestfrom", "symlinktestto"
-	file, err := Create(to)
+	file, err := create(to)
 	if err != nil {
 		t.Fatalf("Create(%q) failed: %v", to, err)
 	}
 	if err = file.Close(); err != nil {
 		t.Errorf("Close(%q) failed: %v", to, err)
 	}
-	err = Symlink(to, from)
+	err = symlink(to, from)
 	if err != nil {
 		t.Fatalf("Symlink(%q, %q) failed: %v", to, from, err)
 	}
-	tostat, err := Lstat(to)
+	tostat, err := lstat(to)
 	if err != nil {
 		t.Fatalf("Lstat(%q) failed: %v", to, err)
 	}
 	if tostat.Mode()&ModeSymlink != 0 {
 		t.Fatalf("Lstat(%q).Mode()&ModeSymlink = %v, want 0", to, tostat.Mode()&ModeSymlink)
 	}
-	fromstat, err := Stat(from)
+	fromstat, err := stat(from)
 	if err != nil {
 		t.Fatalf("Stat(%q) failed: %v", from, err)
 	}
 	if !SameFile(tostat, fromstat) {
 		t.Errorf("Symlink(%q, %q) did not create symlink", to, from)
 	}
-	fromstat, err = Lstat(from)
+	fromstat, err = lstat(from)
 	if err != nil {
 		t.Fatalf("Lstat(%q) failed: %v", from, err)
 	}
 	if fromstat.Mode()&ModeSymlink == 0 {
 		t.Fatalf("Lstat(%q).Mode()&ModeSymlink = 0, want %v", from, ModeSymlink)
 	}
-	fromstat, err = Stat(from)
+	fromstat, err = stat(from)
 	if err != nil {
 		t.Fatalf("Stat(%q) failed: %v", from, err)
 	}
@@ -969,14 +988,14 @@ func TestSymlink(t *testing.T) {
 	if fromstat.Mode()&ModeSymlink != 0 {
 		t.Fatalf("Stat(%q).Mode()&ModeSymlink = %v, want 0", from, fromstat.Mode()&ModeSymlink)
 	}
-	s, err := Readlink(from)
+	s, err := readlink(from)
 	if err != nil {
 		t.Fatalf("Readlink(%q) failed: %v", from, err)
 	}
 	if s != to {
 		t.Fatalf("Readlink(%q) = %q, want %q", from, s, to)
 	}
-	file, err = Open(from)
+	file, err = open(from)
 	if err != nil {
 		t.Fatalf("Open(%q) failed: %v", from, err)
 	}
diff --git a/src/os/root.go b/src/os/root.go
index 8c82f94866..49d09fe97b 100644
--- a/src/os/root.go
+++ b/src/os/root.go
@@ -218,6 +218,18 @@ func (r *Root) Link(oldname, newname string) error {
 	return rootLink(r, oldname, newname)
 }
 
+// Symlink creates newname as a symbolic link to oldname.
+// See [Symlink] for more details.
+//
+// Symlink does not validate oldname,
+// which may reference a location outside the root.
+//
+// On Windows, a directory link is created if oldname references
+// a directory within the root. Otherwise a file link is created.
+func (r *Root) Symlink(oldname, newname string) error {
+	return rootSymlink(r, oldname, newname)
+}
+
 func (r *Root) logOpen(name string) {
 	if log := testlog.Logger(); log != nil {
 		// This won't be right if r's name has changed since it was opened,
diff --git a/src/os/root_noopenat.go b/src/os/root_noopenat.go
index d53d02394d..47d6ebfa82 100644
--- a/src/os/root_noopenat.go
+++ b/src/os/root_noopenat.go
@@ -198,3 +198,14 @@ func rootLink(r *Root, oldname, newname string) error {
 	}
 	return nil
 }
+
+func rootSymlink(r *Root, oldname, newname string) error {
+	if err := checkPathEscapesLstat(r, newname); err != nil {
+		return &PathError{Op: "symlinkat", Path: newname, Err: err}
+	}
+	err := Symlink(oldname, joinPath(r.root.name, newname))
+	if err != nil {
+		return &LinkError{"symlinkat", oldname, newname, underlyingError(err)}
+	}
+	return nil
+}
diff --git a/src/os/root_test.go b/src/os/root_test.go
index 7b8eae03a1..bf1b755ad1 100644
--- a/src/os/root_test.go
+++ b/src/os/root_test.go
@@ -858,6 +858,29 @@ func testRootMoveTo(t *testing.T, rename bool) {
 	}
 }
 
+func TestRootSymlink(t *testing.T) {
+	testenv.MustHaveSymlink(t)
+	for _, test := range rootTestCases {
+		test.run(t, func(t *testing.T, target string, root *os.Root) {
+			wantError := test.wantError
+			if test.ltarget != "" {
+				// We can't create a symlink over an existing symlink.
+				wantError = true
+			}
+
+			const wantTarget = "linktarget"
+			err := root.Symlink(wantTarget, test.open)
+			if errEndsTest(t, err, wantError, "root.Symlink(%q)", test.open) {
+				return
+			}
+			got, err := os.Readlink(target)
+			if err != nil || got != wantTarget {
+				t.Fatalf("ReadLink(%q) = %q, %v; want %q, nil", target, got, err, wantTarget)
+			}
+		})
+	}
+}
+
 // A rootConsistencyTest is a test case comparing os.Root behavior with
 // the corresponding non-Root function.
 //
@@ -1364,6 +1387,25 @@ func testRootConsistencyMove(t *testing.T, rename bool) {
 	}
 }
 
+func TestRootConsistencySymlink(t *testing.T) {
+	testenv.MustHaveSymlink(t)
+	for _, test := range rootConsistencyTestCases {
+		test.run(t, func(t *testing.T, path string, r *os.Root) (string, error) {
+			const target = "linktarget"
+			var err error
+			var got string
+			if r == nil {
+				err = os.Symlink(target, path)
+				got, _ = os.Readlink(target)
+			} else {
+				err = r.Symlink(target, path)
+				got, _ = r.Readlink(target)
+			}
+			return got, err
+		})
+	}
+}
+
 func TestRootRenameAfterOpen(t *testing.T) {
 	switch runtime.GOOS {
 	case "windows":
diff --git a/src/os/root_unix.go b/src/os/root_unix.go
index f2a88f546a..ed7a406cc7 100644
--- a/src/os/root_unix.go
+++ b/src/os/root_unix.go
@@ -132,6 +132,16 @@ func rootStat(r *Root, name string, lstat bool) (FileInfo, error) {
 	return fi, nil
 }
 
+func rootSymlink(r *Root, oldname, newname string) error {
+	_, err := doInRoot(r, newname, func(parent sysfdType, name string) (struct{}, error) {
+		return struct{}{}, symlinkat(oldname, parent, name)
+	})
+	if err != nil {
+		return &LinkError{"symlinkat", oldname, newname, err}
+	}
+	return nil
+}
+
 // On systems which use fchmodat, fchownat, etc., we have a race condition:
 // When "name" is a symlink, Root.Chmod("name") should act on the target of that link.
 // However, fchmodat doesn't allow us to chmod a file only if it is not a symlink;
@@ -217,6 +227,10 @@ func linkat(oldfd int, oldname string, newfd int, newname string) error {
 	return unix.Linkat(oldfd, oldname, newfd, newname, 0)
 }
 
+func symlinkat(oldname string, newfd int, newname string) error {
+	return unix.Symlinkat(oldname, newfd, newname)
+}
+
 // checkSymlink resolves the symlink name in parent,
 // and returns errSymlink with the link contents.
 //
diff --git a/src/os/root_windows.go b/src/os/root_windows.go
index 0c37acb089..eb82715046 100644
--- a/src/os/root_windows.go
+++ b/src/os/root_windows.go
@@ -233,6 +233,52 @@ func rootStat(r *Root, name string, lstat bool) (FileInfo, error) {
 	return fi, nil
 }
 
+func rootSymlink(r *Root, oldname, newname string) error {
+	if oldname == "" {
+		return syscall.EINVAL
+	}
+
+	// CreateSymbolicLinkW converts volume-relative paths into absolute ones.
+	// Do the same.
+	if filepathlite.VolumeNameLen(oldname) > 0 && !filepathlite.IsAbs(oldname) {
+		p, err := syscall.FullPath(oldname)
+		if err == nil {
+			oldname = p
+		}
+	}
+
+	// If oldname can be resolved to a directory in the root, create a directory link.
+	// Otherwise, create a file link.
+	var flags windows.SymlinkatFlags
+	if filepathlite.VolumeNameLen(oldname) == 0 && !IsPathSeparator(oldname[0]) {
+		// oldname is a path relative to the directory containing newname.
+		// Prepend newname's directory to it to make a path relative to the root.
+		// For example, if oldname=old and newname=a\new, destPath=a\old.
+		destPath := oldname
+		if dir := dirname(newname); dir != "." {
+			destPath = dir + `\` + oldname
+		}
+		fi, err := r.Stat(destPath)
+		if err == nil && fi.IsDir() {
+			flags |= windows.SYMLINKAT_DIRECTORY
+		}
+	}
+
+	// Empirically, CreateSymbolicLinkW appears to set the relative flag iff
+	// the target does not contain a volume name.
+	if filepathlite.VolumeNameLen(oldname) == 0 {
+		flags |= windows.SYMLINKAT_RELATIVE
+	}
+
+	_, err := doInRoot(r, newname, func(parent sysfdType, name string) (struct{}, error) {
+		return struct{}{}, windows.Symlinkat(oldname, parent, name, flags)
+	})
+	if err != nil {
+		return &LinkError{"symlinkat", oldname, newname, err}
+	}
+	return nil
+}
+
 func chmodat(parent syscall.Handle, name string, mode FileMode) error {
 	// Currently, on Windows os.Chmod("symlink") will act on "symlink",
 	// not on any file it points to.
diff --git a/src/os/root_windows_test.go b/src/os/root_windows_test.go
index 62e2097123..8ae6f0c9d3 100644
--- a/src/os/root_windows_test.go
+++ b/src/os/root_windows_test.go
@@ -8,9 +8,13 @@ package os_test
 
 import (
 	"errors"
+	"fmt"
+	"internal/syscall/windows"
 	"os"
 	"path/filepath"
+	"syscall"
 	"testing"
+	"unsafe"
 )
 
 // Verify that Root.Open rejects Windows reserved names.
@@ -51,3 +55,176 @@ func TestRootWindowsCaseInsensitivity(t *testing.T) {
 		t.Fatalf("os.Stat(file) after deletion: %v, want ErrNotFound", err)
 	}
 }
+
+// TestRootSymlinkRelativity tests that symlinks created using Root.Symlink have the
+// same SYMLINK_FLAG_RELATIVE value as ones creates using os.Symlink.
+func TestRootSymlinkRelativity(t *testing.T) {
+	dir := t.TempDir()
+	root, err := os.OpenRoot(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer root.Close()
+
+	for i, test := range []struct {
+		name   string
+		target string
+	}{{
+		name:   "relative",
+		target: `foo`,
+	}, {
+		name:   "absolute",
+		target: `C:\foo`,
+	}, {
+		name:   "current working directory-relative",
+		target: `C:foo`,
+	}, {
+		name:   "root-relative",
+		target: `\foo`,
+	}, {
+		name:   "question prefix",
+		target: `\\?\foo`,
+	}, {
+		name:   "relative with dot dot",
+		target: `a\..\b`, // could be cleaned (but isn't)
+	}} {
+		t.Run(test.name, func(t *testing.T) {
+			name := fmt.Sprintf("symlink_%v", i)
+			if err := os.Symlink(test.target, filepath.Join(dir, name)); err != nil {
+				t.Fatal(err)
+			}
+			if err := root.Symlink(test.target, name+"_at"); err != nil {
+				t.Fatal(err)
+			}
+
+			osRDB, err := readSymlinkReparseData(filepath.Join(dir, name))
+			if err != nil {
+				t.Fatal(err)
+			}
+			rootRDB, err := readSymlinkReparseData(filepath.Join(dir, name+"_at"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if osRDB.Flags != rootRDB.Flags {
+				t.Errorf("symlink target %q: Symlink flags = %x, Root.Symlink flags = %x", test.target, osRDB.Flags, rootRDB.Flags)
+			}
+
+			// Compare the link target.
+			// os.Symlink converts current working directory-relative links
+			// such as c:foo into absolute links.
+			osTarget, err := os.Readlink(filepath.Join(dir, name))
+			if err != nil {
+				t.Fatal(err)
+			}
+			rootTarget, err := os.Readlink(filepath.Join(dir, name+"_at"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if osTarget != rootTarget {
+				t.Errorf("symlink created with target %q: Symlink target = %q, Root.Symlink target = %q", test.target, osTarget, rootTarget)
+			}
+		})
+	}
+}
+
+func readSymlinkReparseData(name string) (*windows.SymbolicLinkReparseBuffer, error) {
+	nameu16, err := syscall.UTF16FromString(name)
+	if err != nil {
+		return nil, err
+	}
+	h, err := syscall.CreateFile(&nameu16[0], syscall.GENERIC_READ, 0, nil, syscall.OPEN_EXISTING,
+		syscall.FILE_FLAG_OPEN_REPARSE_POINT|syscall.FILE_FLAG_BACKUP_SEMANTICS, 0)
+	if err != nil {
+		return nil, err
+	}
+	defer syscall.CloseHandle(h)
+
+	var rdbbuf [syscall.MAXIMUM_REPARSE_DATA_BUFFER_SIZE]byte
+	var bytesReturned uint32
+	err = syscall.DeviceIoControl(h, syscall.FSCTL_GET_REPARSE_POINT, nil, 0, &rdbbuf[0], uint32(len(rdbbuf)), &bytesReturned, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	rdb := (*windows.REPARSE_DATA_BUFFER)(unsafe.Pointer(&rdbbuf[0]))
+	if rdb.ReparseTag != syscall.IO_REPARSE_TAG_SYMLINK {
+		return nil, fmt.Errorf("%q: not a symlink", name)
+	}
+
+	bufoff := unsafe.Offsetof(rdb.DUMMYUNIONNAME)
+	symlinkBuf := (*windows.SymbolicLinkReparseBuffer)(unsafe.Pointer(&rdbbuf[bufoff]))
+
+	return symlinkBuf, nil
+}
+
+// TestRootSymlinkToDirectory tests that Root.Symlink creates directory links
+// when the target is a directory contained within the root.
+func TestRootSymlinkToDirectory(t *testing.T) {
+	dir := t.TempDir()
+	root, err := os.OpenRoot(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer root.Close()
+
+	if err := os.Mkdir(filepath.Join(dir, "dir"), 0777); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "file"), nil, 0666); err != nil {
+		t.Fatal(err)
+	}
+
+	dir2 := t.TempDir()
+
+	for i, test := range []struct {
+		name    string
+		target  string
+		wantDir bool
+	}{{
+		name:    "directory outside root",
+		target:  dir2,
+		wantDir: false,
+	}, {
+		name:    "directory inside root",
+		target:  "dir",
+		wantDir: true,
+	}, {
+		name:    "file inside root",
+		target:  "file",
+		wantDir: false,
+	}, {
+		name:    "nonexistent inside root",
+		target:  "nonexistent",
+		wantDir: false,
+	}} {
+		t.Run(test.name, func(t *testing.T) {
+			name := fmt.Sprintf("symlink_%v", i)
+			if err := root.Symlink(test.target, name); err != nil {
+				t.Fatal(err)
+			}
+
+			// Lstat strips the directory mode bit from reparse points,
+			// so we need to use GetFileInformationByHandle directly to
+			// determine if this is a directory link.
+			nameu16, err := syscall.UTF16PtrFromString(filepath.Join(dir, name))
+			if err != nil {
+				t.Fatal(err)
+			}
+			h, err := syscall.CreateFile(nameu16, 0, 0, nil, syscall.OPEN_EXISTING,
+				syscall.FILE_FLAG_OPEN_REPARSE_POINT|syscall.FILE_FLAG_BACKUP_SEMANTICS, 0)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer syscall.CloseHandle(h)
+			var fi syscall.ByHandleFileInformation
+			if err := syscall.GetFileInformationByHandle(h, &fi); err != nil {
+				t.Fatal(err)
+			}
+			gotDir := fi.FileAttributes&syscall.FILE_ATTRIBUTE_DIRECTORY != 0
+
+			if got, want := gotDir, test.wantDir; got != want {
+				t.Errorf("link target %q: isDir = %v, want %v", test.target, got, want)
+			}
+		})
+	}
+}