std.posix.faccessatZ: return error.UnsupportedFlags on android (seccomp sandbox would SIGSYS), or if we know linux version is too old

Author: rohlem

lib/std/posix.zig

@@ -5055,33 +5055,52 @@ pub fn faccessatZ(dirfd: fd_t, path: [*:0]const u8, mode: u32, flags: u32) Acces
         return faccessat(dirfd, mem.sliceTo(path, 0), mode, flags);
     }
 
-    const need_flags = (flags != 0); //the older, simpler syscall should stay supported, so we only need to use faccessat2 if we need flags
-    const faccessat_result = switch (system) {
-        linux => if (need_flags)
-            linux.faccessat2(dirfd, path, mode, flags)
-        else
-            linux.faccessat(dirfd, path, mode),
-        else => system.faccessat(dirfd, path, mode, flags),
+    const linux_is_guaranteed_at_least_5_8 = builtin.target.os.isAtLeast(.linux, .{ .major = 5, .minor = 8, .patch = 0 });
+    const try_with_flags_first = try_with_flags_first: switch (system) {
+        linux => { //regular .faccessat syscall doesn't support flags argument
+            if (builtin.abi.isAndroid()) break :try_with_flags_first false; //standard android programs run in a seccomp sandbox that seems to trigger signal 31 (SIGSYS) for faccessat2
+            if (linux_is_guaranteed_at_least_5_8 != true) break :try_with_flags_first false; //faccessat2 was introduced in Linux 5.8
+            break :try_with_flags_first (flags != 0); //the older, simpler syscall should stay supported, so we only need to use faccessat2 if we need flags
+        },
+        else => true,
     };
-    switch (errno(faccessat_result)) {
-        .SUCCESS => return,
-        .ACCES => return error.AccessDenied,
-        .PERM => return error.PermissionDenied,
-        .ROFS => return error.ReadOnlyFileSystem,
-        .LOOP => return error.SymLinkLoop,
-        .TXTBSY => return error.FileBusy,
-        .NOTDIR => return error.FileNotFound,
-        .NOENT => return error.FileNotFound,
-        .NAMETOOLONG => return error.NameTooLong,
-        .INVAL => unreachable,
-        .FAULT => unreachable,
-        .IO => return error.InputOutput,
-        .NOMEM => return error.SystemResources,
-        .ILSEQ => |err| if (native_os == .wasi)
-            return error.InvalidUtf8
-        else
-            return unexpectedErrno(err),
-        else => |err| return unexpectedErrno(err),
+    try_with_flags_now: switch (try_with_flags_first) {
+        else => |try_with_flags_now| {
+            if (!try_with_flags_now) {
+                if (flags != 0) return error.UnsupportedFlags;
+            }
+            const faccessat_result = switch (system) {
+                linux => if (need_flags)
+                    linux.faccessat2(dirfd, path, mode, flags)
+                else
+                    linux.faccessat(dirfd, path, mode),
+                else => system.faccessat(dirfd, path, mode, flags),
+            };
+            switch (errno(faccessat_result)) {
+                .SUCCESS => return,
+                .ACCES => return error.AccessDenied,
+                .PERM => return error.PermissionDenied,
+                .ROFS => return error.ReadOnlyFileSystem,
+                .LOOP => return error.SymLinkLoop,
+                .TXTBSY => return error.FileBusy,
+                .NOTDIR => return error.FileNotFound,
+                .NOENT => return error.FileNotFound,
+                .NAMETOOLONG => return error.NameTooLong,
+                .INVAL => unreachable,
+                .FAULT => unreachable,
+                .IO => return error.InputOutput,
+                .NOMEM => return error.SystemResources,
+                .ILSEQ => |err| if (native_os == .wasi)
+                    return error.InvalidUtf8
+                else
+                    return unexpectedErrno(err),
+                .NOSYS => |err| if (system == linux and try_with_flags_now)
+                    continue :try_with_flags_now false //retry with older .faccessat (without support for flags)
+                else
+                    return unexpectedErrno(err),
+                else => |err| return unexpectedErrno(err),
+            }
+        },
     }
 }