3 files changed, 79 insertions, 1 deletions
diff --git a/tests/reverse/config_custom_test.go b/tests/reverse/config_custom_test.go
new file mode 100644
index 0000000..a7883af
--- /dev/null
+++ b/tests/reverse/config_custom_test.go
@@ -0,0 +1,62 @@
+package reverse_test
+
+import (
+	"os"
+	"os/exec"
+	"testing"
+
+	"github.com/rfjakob/gocryptfs/v2/tests/test_helpers"
+)
+
+// TestConfigCustomInsideCipherdir verifies that a custom config file (-config)
+// located inside CIPHERDIR is hidden from the encrypted reverse view instead of
+// leaking there in encrypted form.
+//
+// Regression test for https://github.com/rfjakob/gocryptfs/issues/1009
+func TestConfigCustomInsideCipherdir(t *testing.T) {
+	backingDir, err := os.MkdirTemp(test_helpers.TmpDir, t.Name()+".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A regular file that must stay visible in the encrypted view.
+	if err := os.WriteFile(backingDir+"/secret.txt", []byte("hello"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	// The custom config file lives *inside* the backing dir.
+	cfg := backingDir + "/my-custom.conf"
+
+	// Init reverse fs with the config at the custom location.
+	initArgs := []string{"-q", "-init", "-reverse", "-extpass", "echo test", "-scryptn=10", "-config", cfg}
+	if plaintextnames {
+		initArgs = append(initArgs, "-plaintextnames")
+	} else if deterministic_names {
+		initArgs = append(initArgs, "-deterministic-names")
+	}
+	initArgs = append(initArgs, backingDir)
+	cmd := exec.Command(test_helpers.GocryptfsBinary, initArgs...)
+	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
+	if err := cmd.Run(); err != nil {
+		t.Fatalf("init failed: %v", err)
+	}
+
+	mnt := backingDir + ".mnt"
+	sock := mnt + ".sock"
+	test_helpers.MountOrFatal(t, backingDir, mnt, "-reverse", "-extpass", "echo test",
+		"-config", cfg, "-ctlsock", sock)
+	defer test_helpers.UnmountPanic(mnt)
+
+	// The custom config file must NOT show up (encrypted) in the view.
+	cCfg := ctlsockEncryptPath(t, sock, "my-custom.conf")
+	if test_helpers.VerifyExistence(t, mnt+"/"+cCfg) {
+		t.Errorf("custom config %q is exposed in the encrypted view (as %q), but should be hidden", cfg, cCfg)
+	}
+	// With a custom config file, no virtual gocryptfs.conf is presented.
+	if test_helpers.VerifyExistence(t, mnt+"/gocryptfs.conf") {
+		t.Errorf("gocryptfs.conf should not be present in the view when -config is used")
+	}
+	// Regular files must remain visible.
+	cSecret := ctlsockEncryptPath(t, sock, "secret.txt")
+	if !test_helpers.VerifyExistence(t, mnt+"/"+cSecret) {
+		t.Errorf("regular file secret.txt (as %q) is missing from the encrypted view", cSecret)
+	}
+}
diff --git a/tests/reverse/linux-tarball-test.bash b/tests/reverse/linux-tarball-test.bash
index 4054c29..27afa23 100755
--- a/tests/reverse/linux-tarball-test.bash
+++ b/tests/reverse/linux-tarball-test.bash
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -eu
 
diff --git a/tests/reverse/xattr_test.go b/tests/reverse/xattr_test.go
index 406d055..b6a7b34 100644
--- a/tests/reverse/xattr_test.go
+++ b/tests/reverse/xattr_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/pkg/xattr"
+	"golang.org/x/sys/unix"
 )
 
 func xattrSupported(path string) bool {
@@ -65,3 +66,18 @@ func TestXattrList(t *testing.T) {
 		}
 	}
 }
+
+// Shouldn't get EINVAL when querying the mountpoint.
+func TestXattrGetMountpoint(t *testing.T) {
+	_, err := xattr.LGet(dirB, "user.foo453465324")
+	if err == nil {
+		return
+	}
+	e2 := err.(*xattr.Error)
+	if e2.Unwrap() == unix.EINVAL {
+		t.Errorf("LGet: %v", err)
+	}
+	// Let's see what LList says
+	_, err = xattr.LList(dirB)
+	t.Logf("LList: err=%v", err)
+}