[Bug 290383] realpath() returns path outside chroot for "lower fs" in -o union mounts

From: <bugzilla-noreply_at_freebsd.org>
Date: Mon, 20 Oct 2025 16:01:54 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=290383

            Bug ID: 290383
           Summary: realpath() returns path outside chroot for "lower fs"
                    in -o union mounts
           Product: Base System
           Version: 15.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: equinox@diac24.net

The realpath() system call returns the full path outside chroot if a "-o union"
(NOT unionfs - that works correctly) mount is used, for any path that is not
"unioned" in the upper file system:


# cat > realpathtest.sh <<EOF
#!/bin/sh
# unpack base.txz to /root/base_txz

chroot /root/base_txz /bin/sh -c "realpath /"
chroot /root/base_txz /bin/sh -c "realpath /usr"

mkdir /tmp/upper
touch /tmp/upper/foobar
mount -t nullfs -o union /tmp/upper /root/base_txz

chroot /root/base_txz /bin/sh -c "realpath /"
chroot /root/base_txz /bin/sh -c "realpath /foobar"
# last one is not in the "upper" union fs:
chroot /root/base_txz /bin/sh -c "realpath /usr"
EOF
# /bin/sh realpathtest.sh 
/
/usr
/
/foobar
/root/base_txz/usr
# uname -a
FreeBSD test 15.0-ALPHA5 FreeBSD 15.0-ALPHA5 GENERIC amd64
#


(This also affects jails.)

-- 
You are receiving this mail because:
You are the assignee for the bug.