3 files changed, 26 insertions, 3 deletions
diff --git a/internal/fusefrontend/fs.go b/internal/fusefrontend/fs.go
index 002b4e1..c4035fa 100644
--- a/internal/fusefrontend/fs.go
+++ b/internal/fusefrontend/fs.go
@@ -239,13 +239,14 @@ func (fs *FS) Chmod(path string, mode uint32, context *fuse.Context) (code fuse.
 	if fs.isFiltered(path) {
 		return fuse.EPERM
 	}
-	cPath, err := fs.getBackingPath(path)
+	dirfd, cName, err := fs.openBackingPath(path)
 	if err != nil {
 		return fuse.ToStatus(err)
 	}
+	defer dirfd.Close()
 	// os.Chmod goes through the "syscallMode" translation function that messes
-	// up the suid and sgid bits. So use syscall.Chmod directly.
-	err = syscall.Chmod(cPath, mode)
+	// up the suid and sgid bits. So use a syscall directly.
+	err = syscallcompat.Fchmodat(int(dirfd.Fd()), cName, mode, unix.AT_SYMLINK_NOFOLLOW)
 	return fuse.ToStatus(err)
 }
 
diff --git a/internal/syscallcompat/sys_darwin.go b/internal/syscallcompat/sys_darwin.go
index 527598b..367f67d 100644
--- a/internal/syscallcompat/sys_darwin.go
+++ b/internal/syscallcompat/sys_darwin.go
@@ -137,6 +137,23 @@ func Dup3(oldfd int, newfd int, flags int) (err error) {
 	return syscall.Dup2(oldfd, newfd)
 }
 
+// Poor man's Fchmodat.
+func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
+	chdirMutex.Lock()
+	defer chdirMutex.Unlock()
+	cwd, err := syscall.Open(".", syscall.O_RDONLY, 0)
+	if err != nil {
+		return err
+	}
+	defer syscall.Close(cwd)
+	err = syscall.Fchdir(dirfd)
+	if err != nil {
+		return err
+	}
+	defer syscall.Fchdir(cwd)
+	return syscall.Chmod(path, mode)
+}
+
 // Poor man's Fchownat.
 func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 	chdirMutex.Lock()
diff --git a/internal/syscallcompat/sys_linux.go b/internal/syscallcompat/sys_linux.go
index 0e9d6ac..4fe44fd 100644
--- a/internal/syscallcompat/sys_linux.go
+++ b/internal/syscallcompat/sys_linux.go
@@ -80,6 +80,11 @@ func Dup3(oldfd int, newfd int, flags int) (err error) {
 	return syscall.Dup3(oldfd, newfd, flags)
 }
 
+// Fchmodat syscall.
+func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
+	return syscall.Fchmodat(dirfd, path, mode, flags)
+}
+
 // Fchownat syscall.
 func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 	return syscall.Fchownat(dirfd, path, uid, gid, flags)