feat: intercept chmod system call

sandbox/src/syscall/file.rs

@@ -1499,23 +1499,13 @@ pub async fn handle_socket<T: Guest<Sandbox>>(
     args: &reverie::syscalls::Socket,
     fd_table: &FdTable,
 ) -> Result<Option<i64>, Error> {
-    // Execute the syscall to create the socket
-    let kernel_fd = guest.inject(Syscall::Socket(*args)).await?;
-
-    // If the syscall succeeded (returned a valid FD), virtualize it
-    if kernel_fd >= 0 {
-        // Create passthrough FD entry (sockets don't have paths)
-        let entry = FdEntry::Passthrough {
-            kernel_fd: kernel_fd as i32,
-            flags: 0,
-            path: None,
-        };
-        let virtual_fd = fd_table.allocate(entry);
-        Ok(Some(virtual_fd as i64))
-    } else {
-        // Return the error code as-is
-        Ok(Some(kernel_fd))
+    if let Some(path_addr) = args.path() {
+        if let Some(new_path_addr) = translate_path(guest, path_addr, mount_table).await? {
+            let new_syscall = args.with_path(Some(new_path_addr));
+            return Ok(Some(Syscall::Chmod(new_syscall)));
+        }
     }
+    Ok(None)
 }
 
 /// The `sendto` system call.
@@ -1592,3 +1582,23 @@ pub async fn handle_getpeername<T: Guest<Sandbox>>(
     // FD not in table, let the original syscall through (will likely fail with EBADF)
     Ok(None)
 }
+
+/// The `chmod` system call.
+///
+/// This intercepts `chmod` system calls and translates paths according to the mount table.
+pub async fn handle_chmod<T: Guest<Sandbox>>(
+    guest: &mut T,
+    args: &reverie::syscalls::Chmod,
+    mount_table: &MountTable,
+) -> Result<Option<Syscall>, Error> {
+    if let Some(path_addr) = args.path() {
+        if let Some(new_path_addr) = translate_path(guest, path_addr, mount_table).await? {
+            let new_syscall = reverie::syscalls::Chmod::new()
+                .with_path(Some(new_path_addr))
+                .with_mode(args.mode());
+
+            return Ok(Some(Syscall::Chmod(new_syscall)));
+        }
+    }
+    Ok(None)
+}

sandbox/src/syscall/mod.rs

@@ -111,6 +111,13 @@ pub async fn dispatch_syscall<T: Guest<Sandbox>>(
         Syscall::Read(args) => file::handle_read(guest, syscall, args, fd_table).await,
         Syscall::Write(args) => file::handle_write(guest, syscall, args, fd_table).await,
         Syscall::Close(args) => file::handle_close(guest, syscall, args, fd_table).await,
+        Syscall::Chmod(args) => {
+            if let Some(modified) = file::handle_chmod(guest, args, mount_table).await? {
+                Ok(SyscallResult::Syscall(modified))
+            } else {
+                Ok(SyscallResult::Syscall(syscall))
+            }
+        }
         Syscall::Dup(args) => {
             if let Some(result) = file::handle_dup(guest, args, fd_table).await? {
                 Ok(SyscallResult::Value(result))