How exactly should wasi:filesystem open-flags and descriptor-flags interact with native open modes/flags? #936

Activity

1. badeend commented on Jul 2, 2026

   

   badeend

   on Jul 2, 2026

   Member

   More actions

   My take: the observed effective flags of a fd should always be equal to (or a subset of) the flags requested at time of opening the fd. The guest shouldn't be able to magically gain additional read/write permissions.

   ---

   my local man page for the open syscalls says that one of O_{RDONLY,WRONLY,RDWR} must be specified

   Traditionally, that was indeed the case. Though one could argue that the relatively new-ish O_PATH option supported on Linux & FreeBSD is the spiritual equivalent of opening a file without read nor write permissions. I recall that Linux ignores the O_{RDONLY,WRONLY,RDWR} flags when O_PATH is provided, but I can not find that documented on their man page.

   WASI's open-at doesn't currently have the same restriction

   IIUC based on wasmtime's implementation; if none of the read or write flags are requested by the guest, the file is still opened with O_RDONLY (because as you pointed out the OS requires one of these flags), but read_via_stream fails with NotPermitted.
2. ricochet

   added

   P-filesystemProposal: wasi-filesystemProposal: wasi-filesystem

   on Aug 20, 2026
3. bbyalcinkaya commented on Sep 28, 2026

   

   bbyalcinkaya

   on Sep 28, 2026

   More actions

   A cross-engine data point, I tested the above program with jco, the alternative p2 runtime listed here, and it behaves differently from Wasmtime. jco returns empty flags:

   [main.rs:12:5] f.get_flags() = Ok(
       DescriptorFlags(
           0x0,
       ),
   )
   

   I also tried an explicit write through such a descriptor:

   fn main() {
       let dirs = wasi::filesystem::preopens::get_directories();
       let (dir, _) = &dirs[0];
       let f = dir
           .open_at(
               wasi::filesystem::types::PathFlags::empty(),
               "tmp/hi.txt",
               wasi::filesystem::types::OpenFlags::CREATE,
               wasi::filesystem::types::DescriptorFlags::empty(),
           )
           .expect("open-at failed");
   
       f.write(b"this write should have been rejected\n", 0)
           .expect("write failed");
   }

   Wasmtime writes to the file successfully (if it already exists, updates the file). jco rejects the write:

   [Error: EBADF: bad file descriptor, write] {
     errno: -9,
     code: 'EBADF',
     syscall: 'write'
   }
   

   So the two p2 implementations disagree here. Wasmtime grants a writable descriptor for a CREATE open with no requested descriptor-flags, while jco does not.