realroot

func Open ¶

func Open(dir string) (*os.Root, error)

Open opens dir (made absolute against the current directory) as an os.Root. It starts at the volume root and opens each component of dir through the directory opened before it, refusing a component that is not a directory (a symlink among them) and checking on the opened descriptor that it is the directory Lstat saw. A directory on the path replaced by a symlink between a caller's check of dir and this open is refused instead of followed, which os.OpenRoot(dir) alone would do.

Opening a directory needs read permission on it, but walking a path needs only search permission. A directory on the path that can be entered but not read (a parent owned by another account with mode 0711, say) cannot be opened, so the walk goes on below it by path until a component can be opened again. Such a path could follow a symlink swapped in for the unreadable directory (by a process that can write the directory holding it), so the directory opened there is checked against its real ancestry, read through ".." on its own descriptor: each parent up to the last directory the walk did open must be the one it checked, the first of them through that directory's descriptor. A swap fails the open instead of being followed. Where that check is not available (Windows) an unreadable directory on the path fails the open.