install: create leading directories in write-only directories by abendrothj · Pull Request #14779 · uutils/coreutils

abendrothj · 2026-09-21T09:45:47Z

install -D could not create leading directories inside a directory that is writable and searchable but not readable, where GNU 9.12 can:

$ mkdir wx && chmod 300 wx && echo hi > f
$ install -D f wx/sub/f
install: cannot create directory 'wx/sub': Permission denied

create_dir_all_safe anchored its walk with an O_RDONLY | O_DIRECTORY open of the deepest existing ancestor, which needs read permission; mkdirat only needs write and execute. It now uses DirFd::open_anchor, which falls back to a search-only descriptor (O_PATH on Linux/Android, O_SEARCH on Apple targets, FreeBSD, NetBSD, illumos and Solaris) on EACCES. The NoFollow opens in the descent are unchanged. Platforms with neither flag, including OpenBSD, still fail with EACCES here.

Based on #15120; until it merges, the diff here shows its commit too.

Fixes #14778

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

github-actions · 2026-09-21T10:38:25Z

GNU testsuite comparison:

Skipping an intermittent issue tests/date/resolution (passes in this run but fails in the 'main' branch)

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

abendrothj · 2026-09-22T02:45:24Z

About the red Tests (unix) job: that runner is OpenBSD 7.9, which has neither O_PATH nor O_SEARCH, so there's no way to anchor *at calls on a directory we can't read and this approach can't work there. safe_traversal now exports SEARCH_ONLY_SUPPORTED and the new test skips when it's false.

To be explicit about the gap: install -D into a write-only directory still fails on OpenBSD, exactly as it did before this PR. The fix applies on Linux, macOS, FreeBSD, NetBSD and the Solaris family. I could add a path-based fallback for the rest, but that trades the fd-anchored traversal for plain path resolution and I'd rather not do that silently — tell me if you want it.

Copilot

Copilot review overview

🟡 Changes recommended

Critical cross-platform compilation and test-gating issues remain unresolved.

Review effort: Lite
Findings: 2

Open (2)

Use a supported O_SEARCH flag API on all target platforms · New
Exclude unsupported targets from the safe_traversal test · New

codspeed · 2026-10-01T02:45:52Z

Merging this PR will regress 6 benchmarks

⚡ 11 improved benchmarks
❌ 6 regressed benchmarks
✅ 382 untouched benchmarks
⏩ 54 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	`BASE`	`HEAD`	Efficiency
❌	Simulation	`false_consecutive_calls`	294.7 ns	350.2 ns	-15.86%
❌	Simulation	`five_38_bit_primes`	1.5 s	1.7 s	-10.81%
❌	Simulation	`tsort_complex_dag[50000]`	87.6 ms	97.1 ms	-9.79%
❌	Simulation	`tsort_tree_dag[(10, 3)]`	36.5 ms	39.4 ms	-7.33%
❌	Simulation	`tsort_wide_dag[100000]`	157.6 ms	167 ms	-5.65%
❌	Simulation	`tsort_linear_chain[1000000]`	1.9 s	2 s	-4.75%
⚡	Simulation	`three_39_bit_primes`	901.6 ms	544.5 ms	+65.57%
⚡	Simulation	`cut_fields_custom_delim`	65.9 ms	51.9 ms	+27%
⚡	Simulation	`cut_fields_tab`	57.4 ms	45.5 ms	+26.24%
⚡	Simulation	`cut_bytes`	18.1 ms	15.5 ms	+16.69%
⚡	Simulation	`join_french_locale`	26.7 ms	24 ms	+11.1%
⚡	Simulation	`join_full_match`	26.7 ms	24 ms	+11.07%
⚡	Simulation	`cut_characters`	25.4 ms	22.9 ms	+10.88%
⚡	Simulation	`join_partial_overlap`	22.1 ms	20.4 ms	+8.36%
⚡	Simulation	`join_unicode_locale`	2.6 ms	2.4 ms	+6.67%
⚡	Simulation	`join_custom_separator`	25.9 ms	24.4 ms	+6.08%
⚡	Simulation	`rm_recursive_tree`	14.4 ms	13.7 ms	+5.28%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing abendrothj:fix/install-write-only-leading-dirs (0e67229) with main (8edf725)²}

54 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
No successful run was found on main (8460811) during the generation of this report, so 8edf725 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

Copilot

Copilot review overview

🟡 Changes recommended

A critical unit test fails on OpenBSD and the Linux fallback documentation needs correction.

Review effort: Lite
Findings: 2

Open (2)

Skip test when SEARCH_ONLY is unsupported · New
Use a supported O_SEARCH flag API on all target platforms

Resolved since last review (1)

Exclude unsupported targets from the safe_traversal test

Previously missed (1)

In code that hasn't changed since last review

Correct inaccurate O_PATH and O_NOFOLLOW explanation

src/uucore/src/lib/features/safe_traversal.rs:216

The Linux explanation here is inaccurate: O_PATH does not ignore O_NOFOLLOW; with O_PATH|O_NOFOLLOW it refers to the symlink itself (and combining O_DIRECTORY can reject it), rather than resolving it. The fallback intentionally omits O_NOFOLLOW to preserve Follow semantics, so document that choice directly instead of attributing it to an ignored flag.

This issue also appears on line 230 of the same file.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

sylvestre · 2026-10-05T21:18:30Z

+/// directories where GNU succeeds. `O_PATH` (Linux) and `O_SEARCH` (POSIX
+/// 2008) both yield a descriptor that anchors `*at` calls without reading.
+/// Such a descriptor cannot list directory entries.
+#[cfg(any(target_os = "linux", target_os = "android"))]


the target list three times is a lot, could we do the two positive cases and #[cfg(not(any(unix_with_search)))] via a small cfg alias?

Done in 991db22, which is now its own PR (#15120): uucore's build script defines has_o_path and has_o_search, and the constants and unit tests are gated on those. The install integration test still spells out the target list once, because uucore's build-script cfgs don't reach the root test crate; comments on both sides point at each other.

sylvestre · 2026-10-05T21:18:41Z

+/// Where it cannot, creating an entry inside a write-only directory fails with
+/// `EACCES` instead of succeeding the way `mkdir` does (OpenBSD, for example,
+/// has neither `O_PATH` nor `O_SEARCH`).
+pub const SEARCH_ONLY_SUPPORTED: bool = SEARCH_ONLY.is_some();


a pub const just so a test can skip? could the test be cfg'd on the same targets instead

Gone. SEARCH_ONLY and open_search_only are private now, and the tests are cfg'd on has_o_path/has_o_search instead (991db22).

sylvestre · 2026-10-05T21:19:05Z

+            .map_err(|_| denied)
+    }
+
    /// Open a subdirectory relative to this directory


the real errno is dropped here, we will report EACCES for an ENOENT or ELOOP

Fixed in 991db22: the search-only retry returns its own error, so an ENOENT or ELOOP from the retry is reported as such instead of the first open's EACCES. A unit test calls the retry directly for ENOENT, ELOOP and ENOTDIR.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Open a directory readable, and on EACCES retry with O_PATH or O_SEARCH, which anchor *at calls without read access. The targets with either flag are named by the has_o_path and has_o_search cfg aliases. If the retry fails, its own error is returned.

install -D opened the deepest existing ancestor read-only, so it failed with EACCES when that directory had write and execute but not read permission, while GNU install succeeds. Open it with DirFd::open_anchor.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot AI lite review requested due to automatic review settings September 21, 2026 09:45

Copilot AI reviewed Sep 21, 2026

Copilot AI review requested due to automatic review settings September 22, 2026 01:04

abendrothj force-pushed the fix/install-write-only-leading-dirs branch from 8d87373 to e53e63f Compare September 22, 2026 01:04

Copilot AI reviewed Sep 22, 2026

abendrothj force-pushed the fix/install-write-only-leading-dirs branch from e53e63f to 18a794d Compare September 22, 2026 01:40

Copilot AI review requested due to automatic review settings September 22, 2026 01:40

Copilot AI reviewed Sep 22, 2026

abendrothj force-pushed the fix/install-write-only-leading-dirs branch from 18a794d to 3e557aa Compare October 1, 2026 01:15

Copilot AI lite review requested due to automatic review settings October 1, 2026 01:15

Copilot started reviewing on behalf of abendrothj October 1, 2026 01:23 View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

Comment thread src/uucore/src/lib/features/safe_traversal.rs

Comment thread tests/by-util/test_install.rs Outdated

Copilot AI lite review requested due to automatic review settings October 1, 2026 06:52

Copilot started reviewing on behalf of abendrothj October 1, 2026 06:53 View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

Comment thread src/uucore/src/lib/features/safe_traversal.rs

Copilot AI lite review requested due to automatic review settings October 1, 2026 07:04

Copilot AI reviewed Oct 1, 2026

sylvestre reviewed Oct 5, 2026

View reviewed changes

abendrothj force-pushed the fix/install-write-only-leading-dirs branch from 57c03da to edb49be Compare October 6, 2026 07:15

Copilot AI lite review requested due to automatic review settings October 6, 2026 07:15

Copilot AI reviewed Oct 6, 2026

abendrothj mentioned this pull request Oct 6, 2026

uucore: add DirFd::open_anchor for write-only directories #15120

Open

abendrothj added 2 commits October 7, 2026 01:05

install: create leading directories in write-only directories

0e67229

install -D opened the deepest existing ancestor read-only, so it failed with EACCES when that directory had write and execute but not read permission, while GNU install succeeds. Open it with DirFd::open_anchor.

abendrothj force-pushed the fix/install-write-only-leading-dirs branch from edb49be to 0e67229 Compare October 8, 2026 04:09

Copilot AI lite review requested due to automatic review settings October 8, 2026 04:09

Copilot AI reviewed Oct 8, 2026

Conversation

abendrothj commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

abendrothj commented Sep 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

codspeed Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will regress 6 benchmarks

Performance Changes

Footnotes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

sylvestre Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

abendrothj Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

abendrothj Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

sylvestre Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

abendrothj Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

abendrothj commented Sep 21, 2026 •

edited

Loading

github-actions Bot commented Sep 21, 2026 •

edited

Loading

codspeed Bot commented Oct 1, 2026 •

edited

Loading