Resolve /dev/shm host paths in one place

[henrybear327]

macOS has no /dev/shm, so elfuse backs POSIX shared memory with a per-UID host directory, /tmp/elfuse-shm-<uid>/<name>, via the validated resolver proc_dev_shm_resolve (flat leaf only; "..", embedded '/', and empty names rejected).

Only three syscalls performed that redirect by hand: open, stat, and unlinkat. Every other path syscall fell through path_translate_at, which prepends the sysroot instead, so the same guest path resolved two different ways:

    /dev/shm/foo
      open  -> /tmp/elfuse-shm-1000/foo   (backing dir, created)
      chmod -> <sysroot>/dev/shm/foo      (nothing here -> ENOENT)

LTP's library startup (lib/tst_test.c setup_ipc) is failing to run all tests due to the following:

• An open(O_CREAT|O_EXCL) on a /dev/shm path followed by SAFE_CHMOD of the same path
• The open landed in the backing dir and succeeded
• The chmod resolved the sysroot path, hit ENOENT, and aborted the process in common setup, so all 24 conformance tests failed before any test body ran.

The fix is to do the redirect once, in path_translate_at, through the same resolver and a new shm_redirect flag, so chmod, chown, truncate, utimensat, rename, link, symlink, mknod, readlink, mkdir, statfs, and the xattr family all inherit the backing path from one choke point.

The backing path is absolute and POSIX ignores dirfd for absolute paths, so path_tx_dirfd() selects AT_FDCWD and the hand-rolled unlinkat rewrite folds away.

---

Summary by cubic

Centralized /dev/shm path resolution so all path syscalls and exec use the same per-UID backing directory on macOS. Enforced never-follow and tmpfs reporting so shm symlinks cannot escape to the host; fixes LTP setup_ipc open(O_CREAT) → chmod failure.

• Bug Fixes
  • Redirect /dev/shm/ in path_translate_at via the validated resolver and set is_dev_shm; use path_translation_dirfd for absolute redirects; remove the unlinkat special-case.
  • Enforce never-follow on shm paths: path_translation_at_flags adds AT_SYMLINK_NOFOLLOW on *at and xattr; lstat for stat and statfs leaf checks; exec image/interpreter opened with O_NOFOLLOW; truncate/chdir reach the leaf via a nofollow fd (O_NONBLOCK for FIFOs); clear AT_SYMLINK_FOLLOW on linkat; report /dev/shm and leaves as tmpfs (synthetic statfs, TMPFS_MAGIC).
  • Tighten name gate: allow flat names containing ".."; reject exact "..", '/', and empty with EACCES; return ENAMETOOLONG on overflow; use lstat in proc stat; refuse a /dev/shm interpreter during bootstrap.
  • Add test-dev-shm-paths: covers open→chmod, metadata ops, chdir/getcwd, rename/link/unlink, tmpfs statfs for root/leaves and FIFOs, symlink containment, exec of symlink refused and real binary runs, and name-shape/oversize gates; enabled in tests/manifest.txt.

^{Written for commit a89a59c. Summary will update on new commits.}

[jserv]

Centralizing the /dev/shm redirect in path_translate_at is the right call, but the shared primitive now reaches follow-capable callers that were never taught to force nofollow. Inline notes below. Test gap: tests/test-dev-shm-paths.c exercises the symlink-not-followed case only for the metadata ops, not for statfs/chdir/execve on a symlink leaf.

[jserv]

Thank @henrybear327 for contributing!