From 2ad6b0e0d25d4a5b19ba6e257f55086f67b8d261 Mon Sep 17 00:00:00 2001 From: Jia Tan Date: Fri, 11 Aug 2023 23:34:50 +0800 Subject: [PATCH 1/2] Docs: Remove unneeded command in WASI-tutorial.md The `cat /tmp/somewhere.txt` command in the example using --dir=$PWD is not needed. The error message should be after the first command anyway since it should be the one creating the message. It looks like a copy/paste error since the previous example showed the same `cat` command a successful copy. --- docs/WASI-tutorial.md | 1 - 1 file changed, 1 deletion(-) diff --git a/docs/WASI-tutorial.md b/docs/WASI-tutorial.md index 40d4bbae7380..428722d23007 100644 --- a/docs/WASI-tutorial.md +++ b/docs/WASI-tutorial.md @@ -217,7 +217,6 @@ directory to the WebAssembly program. So providing a full path doesn't work: ``` $ wasmtime --dir=$PWD --dir=/tmp demo.wasm test.txt /tmp/somewhere.txt -$ cat /tmp/somewhere.txt error opening input test.txt: Capabilities insufficient ``` From cda80c61f86cc8e71549788c4688533ef3f40d53 Mon Sep 17 00:00:00 2001 From: Jia Tan Date: Fri, 11 Aug 2023 23:40:12 +0800 Subject: [PATCH 2/2] Docs: Update error messages in WASI-tutorial.md. The error messages appear to have changed since this document was originally written. --- docs/WASI-tutorial.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/WASI-tutorial.md b/docs/WASI-tutorial.md index 428722d23007..b6c10767eb80 100644 --- a/docs/WASI-tutorial.md +++ b/docs/WASI-tutorial.md @@ -182,7 +182,7 @@ Ok, this program needs some command-line arguments. So let's give it some: ``` $ echo hello world > test.txt $ wasmtime demo.wasm test.txt /tmp/somewhere.txt -error opening input test.txt: failed to find a pre-opened file descriptor through which "test.txt" could be opened +error opening input test.txt: No such file or directory ``` Aha, now we're seeing the sandboxing in action. This program is attempting to @@ -217,7 +217,7 @@ directory to the WebAssembly program. So providing a full path doesn't work: ``` $ wasmtime --dir=$PWD --dir=/tmp demo.wasm test.txt /tmp/somewhere.txt -error opening input test.txt: Capabilities insufficient +error opening input test.txt: No such file or directory ``` So, we always have to use `.` to refer to the current directory. @@ -227,11 +227,11 @@ out of the sandbox? Let's see: ``` $ wasmtime --dir=. --dir=/tmp demo.wasm test.txt /tmp/../etc/passwd -error opening output /tmp/../etc/passwd: Capabilities insufficient +error opening output /tmp/../etc/passwd: Operation not permitted ``` The sandbox says no. And note that this is the capabilities system saying no -here ("Capabilities insufficient"), rather than Unix access controls +here ("Operation not permitted"), rather than Unix access controls ("Permission denied"). Even if the user running `wasmtime` had write access to `/etc/passwd`, WASI programs don't have the capability to access files outside of the directories they've been granted. This is true when resolving symbolic