chmod:fix safe traversal/access

src/uu/chmod/src/chmod.rs

@@ -522,9 +522,24 @@ impl Chmoder {
                     .safe_chmod_file(&entry_path, dir_fd, &entry_name, meta.mode() & 0o7777)
                     .and(r);
 
-                // Recurse into subdirectories
+                // Recurse into subdirectories using the existing directory fd
                 if meta.is_dir() {
-                    r = self.walk_dir_with_context(&entry_path, false).and(r);
+                    match dir_fd.open_subdir(&entry_name) {
+                        Ok(child_dir_fd) => {
+                            r = self.safe_traverse_dir(&child_dir_fd, &entry_path).and(r);
+                        }
+                        Err(err) => {
+                            let error = if err.kind() == std::io::ErrorKind::PermissionDenied {
+                                ChmodError::PermissionDenied(
+                                    entry_path.to_string_lossy().to_string(),
+                                )
+                                .into()
+                            } else {
+                                err.into()
+                            };
+                            r = r.and(Err(error));
+                        }
+                    }
                 }
             }
         }

tests/by-util/test_chmod.rs

@@ -2,6 +2,7 @@
 //
 // For the full copyright and license information, please view the LICENSE
 // file that was distributed with this source code.
+// spell-checker:ignore (words) dirfd subdirs openat FDCWD
 
 use std::fs::{OpenOptions, Permissions, metadata, set_permissions};
 use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
@@ -1280,6 +1281,46 @@ fn test_chmod_non_utf8_paths() {
     );
 }
 
+#[cfg(all(target_os = "linux", feature = "chmod"))]
+#[test]
+fn test_chmod_recursive_uses_dirfd_for_subdirs() {
+    use std::process::Command;
+    use uutests::get_tests_binary;
+
+    // Skip test if strace is not available
+    if Command::new("strace").arg("-V").output().is_err() {
+        eprintln!("strace not found; skipping test_chmod_recursive_uses_dirfd_for_subdirs");
+        return;
+    }
+
+    let (at, _ucmd) = at_and_ucmd!();
+    at.mkdir("x");
+    at.mkdir("x/y");
+    at.mkdir("x/y/z");
+
+    let log_path = at.plus_as_string("strace.log");
+
+    let status = Command::new("strace")
+        .arg("-e")
+        .arg("openat")
+        .arg("-o")
+        .arg(&log_path)
+        .arg(get_tests_binary!())
+        .args(["chmod", "-R", "+x", "x"])
+        .current_dir(&at.subdir)
+        .status()
+        .expect("failed to run strace");
+    assert!(status.success(), "strace run failed");
+
+    let log = at.read("strace.log");
+
+    // Regression guard: ensure recursion uses dirfd-relative openat instead of AT_FDCWD with a multi-component path
+    assert!(
+        !log.contains("openat(AT_FDCWD, \"x/y"),
+        "chmod recursed using AT_FDCWD with a multi-component path; expected dirfd-relative openat"
+    );
+}
+
 #[test]
 fn test_chmod_colored_output() {
     // Test colored help message