Fix ENOENT when resolving kernel pseudo-paths in ona_open

syscall.c

@@ -319,8 +319,7 @@ static int ona_open(const char *path, int flags, mode_t mode, char *out_abs, siz
 	 * (abspath_outside_confinement).  A relative operator path starts at the
 	 * daemon's cwd == the module root; an absolute one (or a followed absolute
 	 * symlink target) restarts at "/". */
-	char abspath[MAXPATHLEN];
-	abspath[0] = '\0';
+	char abspath[MAXPATHLEN] = {0};
 	if (am_daemon && module_dir && module_dir[0] == '/')
 		strlcpy(abspath, module_dir, sizeof abspath);	/* "/" for a path=/ module */
 	else if (confine_root) {
@@ -434,6 +433,46 @@ static int ona_open(const char *path, int flags, mode_t mode, char *out_abs, siz
 			}
 			target[n] = '\0';
 
+	/* Detect Linux kernel pseudo-paths (pipes, sockets, anon_inodes).
+				* These are not real paths on disk and never contain slashes. */
+			const char *ptail = fd_pin_tail(abspath);
+			int is_fd_dir = (ptail != NULL && *ptail == '\0');
+
+			if (is_fd_dir && strchr(target, '/') == NULL &&
+				(strncmp(target, "pipe:[", 6) == 0 ||
+				strncmp(target, "socket:[", 8) == 0 ||
+				strncmp(target, "anon_inode:", 11) == 0)) {
+
+					if (!is_last) {
+							/* Cannot traverse a pseudo-path like a directory */
+							saved_errno = ENOTDIR;
+							goto out;
+					}
+
+					/* Verify comp is entirely numeric (it must be the FD number) */
+					int is_num = 1;
+					for (int i = 0; comp[i] != '\0'; i++) {
+							if (comp[i] < '0' || comp[i] > '9') {
+									is_num = 0;
+									break;
+							}
+					}
+
+					if (is_num) {
+							int fd_num = atoi(comp);
+	#ifdef F_DUPFD_CLOEXEC
+							retfd = fcntl(fd_num, F_DUPFD_CLOEXEC, 0);
+	#else
+							retfd = dup(fd_num);
+	#endif
+							saved_errno = (retfd >= 0) ? 0 : errno;
+							goto out;
+					}
+
+					/* If it's in an FD dir but fails checks, treat as dead link */
+					saved_errno = ENOENT;
+					goto out;
+			}
 			/* Splice: new `remaining` = <target> + <tail-after-comp>.
 			 * Absolute target restarts the walk from "/". */
 			char tail[MAXPATHLEN];
@@ -3988,3 +4027,4 @@ int do_stat_atfd(int dfd, const char *name, STRUCT_STAT *st)
 	return -1;
 #endif
 }
+

testsuite/pseudo-paths_test.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Process substitution /dev/fd/ pipe pseudo-paths must not crash with ENOENT."""
+
+import os
+import shlex
+import shutil
+import subprocess
+import tempfile
+from pathlib import Path
+
+from rsyncfns import makepath, rmtree, rsync_argv, test_fail, test_skipped
+
+# We require bash specifically because standard POSIX /bin/sh does not 
+# guarantee support for <(...) process substitution syntax.
+bash = shutil.which('bash')
+if bash is None:
+    test_skipped('bash is unavailable, cannot test process substitution')
+
+# Verify the host bash actually supports process substitution (it can be 
+# disabled in certain restricted environments).
+probe = subprocess.run(
+    [bash, '-c', 'cat <(echo "probe")'],
+    capture_output=True
+)
+if probe.returncode != 0:
+    test_skipped('bash process substitution is not supported on this system')
+
+base = Path(tempfile.mkdtemp(prefix='rsync-pseudo-path-'))
+src = base / 'src'
+dest = base / 'dest'
+makepath(src, dest)
+
+(src / 'keep_me.txt').write_text('keep this\n')
+(src / 'exclude_me.txt').write_text('drop this\n')
+
+# rsync_argv() provides the correct binary path, which we must wrap into a 
+# raw string so bash can parse the <(...) syntax rather than Python.
+rsync_base_cmd = shlex.join(rsync_argv('-a'))
+src_path = shlex.quote(str(src) + '/')
+dest_path = shlex.quote(str(dest) + '/')
+
+bash_script = f"{rsync_base_cmd} --exclude-from=<(echo 'exclude_me.txt') {src_path} {dest_path}"
+
+try:
+    proc = subprocess.run(
+        [bash, '-c', bash_script],
+        capture_output=True,
+        text=True,
+        timeout=10,
+    )
+except subprocess.TimeoutExpired:
+    rmtree(base)
+    test_fail('process substitution test timed out')
+
+ctx = f'rc={proc.returncode}, stderr={proc.stderr.strip()!r}'
+
+if proc.returncode != 0:
+    rmtree(base)
+    test_fail(f'rsync crashed reading a pseudo-path pipe ({ctx})')
+
+if not (dest / 'keep_me.txt').is_file():
+    rmtree(base)
+    test_fail(f'rsync failed to transfer the allowed file ({ctx})')
+
+if (dest / 'exclude_me.txt').is_file():
+    rmtree(base)
+    test_fail(f'rsync ignored the process substitution exclude list ({ctx})')
+
+rmtree(base)
+print('rsync successfully read process substitution pseudo-paths')
+raise SystemExit(0)

testsuite/skiplist/macos.txt

@@ -22,6 +22,7 @@ open-noatime
 partial-protected-regular-retry-linux
 preallocate
 protected-regular
+pseudo-paths  # dynamically skips on runners lacking bash process substitution
 readonly-partial-abort-mode-regression  # 
 rrsync-sender-leaf-flip
 rrsync-sender-parent-pin