From d22d6b3c69f95ed0034af04851807e7125811b87 Mon Sep 17 00:00:00 2001
From: Jakob Unterwurzacher
Date: Sat, 7 Feb 2026 21:19:14 +0100
Subject: darwin: syscallcompat: Openat: use O_SYMLINK

Also add tests that opening a symlink (using unix.O_PATH | unix.O_NOFOLLOW)
works.

https://github.com/rfjakob/gocryptfs/issues/993
---
 internal/syscallcompat/sys_common.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'internal/syscallcompat/sys_common.go')

diff --git a/internal/syscallcompat/sys_common.go b/internal/syscallcompat/sys_common.go
index 70ee633..3cb9ffa 100644
--- a/internal/syscallcompat/sys_common.go
+++ b/internal/syscallcompat/sys_common.go
@@ -54,10 +54,10 @@ func Openat(dirfd int, path string, flags int, mode uint32) (fd int, err error)
 			flags |= syscall.O_EXCL
 		}
 	} else {
-		// If O_CREAT is not used, we should use O_NOFOLLOW
-		if flags&syscall.O_NOFOLLOW == 0 {
-			tlog.Warn.Printf("Openat: O_NOFOLLOW missing: flags = %#x", flags)
-			flags |= syscall.O_NOFOLLOW
+		// If O_CREAT is not used, we should use O_NOFOLLOW or O_SYMLINK
+		if flags&(unix.O_NOFOLLOW|OpenatFlagNofollowSymlink) == 0 {
+			tlog.Warn.Printf("Openat: O_NOFOLLOW/O_SYMLINK missing: flags = %#x", flags)
+			flags |= unix.O_NOFOLLOW
 		}
 	}
 
-- 
cgit v1.2.3


From ab4c0446d3db0665fc2e9a05c0319541d21811eb Mon Sep 17 00:00:00 2001
From: Jakob Unterwurzacher
Date: Tue, 10 Feb 2026 21:02:03 +0100
Subject: reverse: return ENOTTR when xattr name is not decryptable

---
 internal/fusefrontend_reverse/node_xattr.go | 2 +-
 internal/syscallcompat/sys_common.go        | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

(limited to 'internal/syscallcompat/sys_common.go')

diff --git a/internal/fusefrontend_reverse/node_xattr.go b/internal/fusefrontend_reverse/node_xattr.go
index f22764a..b940339 100644
--- a/internal/fusefrontend_reverse/node_xattr.go
+++ b/internal/fusefrontend_reverse/node_xattr.go
@@ -40,7 +40,7 @@ func (n *Node) Getxattr(ctx context.Context, attr string, dest []byte) (uint32,
 	} else {
 		pAttr, err := rn.decryptXattrName(attr)
 		if err != nil {
-			return 0, syscall.EINVAL
+			return 0, noSuchAttributeError
 		}
 		pData, errno := n.getXAttr(pAttr)
 		if errno != 0 {
diff --git a/internal/syscallcompat/sys_common.go b/internal/syscallcompat/sys_common.go
index 3cb9ffa..dfe5f22 100644
--- a/internal/syscallcompat/sys_common.go
+++ b/internal/syscallcompat/sys_common.go
@@ -2,6 +2,7 @@ package syscallcompat
 
 import (
 	"bytes"
+	"fmt"
 	"syscall"
 
 	"golang.org/x/sys/unix"
@@ -128,6 +129,7 @@ func Fgetxattr(fd int, attr string) (val []byte, err error) {
 // Lgetxattr is a wrapper around unix.Lgetxattr that handles the buffer sizing.
 func Lgetxattr(path string, attr string) (val []byte, err error) {
 	fn := func(buf []byte) (int, error) {
+		fmt.Printf("Lgetxattr(%q, %q, buf %d)\n", path, attr, len(buf))
 		return unix.Lgetxattr(path, attr, buf)
 	}
 	return getxattrSmartBuf(fn)
-- 
cgit v1.2.3


From 61685370b1aaffde25e5427a08509d33d71746fe Mon Sep 17 00:00:00 2001
From: Jakob Unterwurzacher
Date: Tue, 10 Feb 2026 21:25:58 +0100
Subject: syscallcompat: delete accidentially-commited debug output

Fixes: ab4c0446d3db0665fc2e9a05c0319541d21811eb
---
 internal/syscallcompat/sys_common.go | 2 --
 1 file changed, 2 deletions(-)

(limited to 'internal/syscallcompat/sys_common.go')

diff --git a/internal/syscallcompat/sys_common.go b/internal/syscallcompat/sys_common.go
index dfe5f22..3cb9ffa 100644
--- a/internal/syscallcompat/sys_common.go
+++ b/internal/syscallcompat/sys_common.go
@@ -2,7 +2,6 @@ package syscallcompat
 
 import (
 	"bytes"
-	"fmt"
 	"syscall"
 
 	"golang.org/x/sys/unix"
@@ -129,7 +128,6 @@ func Fgetxattr(fd int, attr string) (val []byte, err error) {
 // Lgetxattr is a wrapper around unix.Lgetxattr that handles the buffer sizing.
 func Lgetxattr(path string, attr string) (val []byte, err error) {
 	fn := func(buf []byte) (int, error) {
-		fmt.Printf("Lgetxattr(%q, %q, buf %d)\n", path, attr, len(buf))
 		return unix.Lgetxattr(path, attr, buf)
 	}
 	return getxattrSmartBuf(fn)
-- 
cgit v1.2.3