fts: refactor to use fd-relative operations internally

Replace all _open() calls with _openat() in __fts_open(), fts_read(),
and fts_children().  Replace statfs() with _fstatfs().

Add fts_dirfd to struct _ftsent, set to the file descriptor of the
parent directory. Callers can use openat(ent->fts_dirfd, ent->fts_name,
...) to access files safely without relying on fts_accpath, which
enables programs in capability mode to open the files described by
_ftsent.

This is a preparatory change for fts_openat() which will allow callers
to provide a pre-opened directory fd, enabling fts(3) traversal inside
Capsicum capability mode.

Mirror all fts_open() changes to fts_open_b().

As a result of expanding _ftsend, publish new ELF symbol versions for
fts_openat and related functions.

Sponsored by:	Google LLC (GSoC 2026)
Reviewed by:	asomers
Pull Request:	https://github.com/freebsd/freebsd-src/pull/2303

include/fts.h

@@ -92,6 +92,8 @@ struct _ftsent {
 	char *fts_path;			/* root path */
 	int fts_errno;			/* errno for this node */
 	int fts_symfd;			/* fd for symlink */
+	int fts_dirfd;                  /* fd for parent directory */
+	int __fts_reserved[3];          /* reserved for future use */
 	__size_t fts_pathlen;		/* strlen(fts_path) */
 	__size_t fts_namelen;		/* strlen(fts_name) */
 

lib/libc/gen/Makefile.inc

@@ -63,6 +63,7 @@ SRCS+= \
 	fts.c \
 	fts-compat.c \
 	fts-compat11.c \
+	fts-compat15.c \
 	ftw.c \
 	ftw-compat11.c \
 	getbootfile.c \

lib/libc/gen/Symbol.map

@@ -402,14 +402,6 @@ FBSD_1.5 {
 	devname;
 	devname_r;
 	dirname;
-	fts_children;
-	fts_close;
-	fts_get_clientptr;
-	fts_get_stream;
-	fts_open;
-	fts_read;
-	fts_set;
-	fts_set_clientptr;
 	ftw;
 	getentropy;
 	getmntinfo;
@@ -459,7 +451,6 @@ FBSD_1.8 {
 	execvpe;
 	fdscandir;
 	fdscandir_b;
-	fts_open_b;
 	glob_b;
 	initgroups;
 	inotify_add_watch;
@@ -476,6 +467,15 @@ FBSD_1.8 {
 
 FBSD_1.9 {
 	freadlink;
+	fts_children;
+	fts_close;
+	fts_get_clientptr;
+	fts_get_stream;
+	fts_open;
+	fts_open_b;
+	fts_read;
+	fts_set;
+	fts_set_clientptr;
 	posix_spawn_file_actions_addchdir;
 	posix_spawn_file_actions_addfchdir;
 	posix_spawnattr_getexecfd_np;

lib/libc/gen/fts-compat15.h

@@ -0,0 +1,97 @@
+/*-
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Copyright (c) 1989, 1993
+ *      The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef _FTS_COMPAT15_H_
+#define _FTS_COMPAT15_H_
+
+typedef struct {
+	struct _ftsent15 *fts_cur;	/* current node */
+	struct _ftsent15 *fts_child;	/* linked list of children */
+	struct _ftsent15 **fts_array;	/* sort array */
+	dev_t		 fts_dev;	/* starting device # */
+	char		*fts_path;	/* path for this descent */
+	int		 fts_rfd;	/* fd for root */
+	__size_t	 fts_pathlen;	/* sizeof(path) */
+	__size_t	 fts_nitems;	/* elements in the sort array */
+	union {
+		int	(*fts_compar)	/* compare function */
+		    (const struct _ftsent15 * const *,
+		    const struct _ftsent15 * const *);
+#ifdef __BLOCKS__
+		int	(^fts_compar_b)
+		    (const struct _ftsent15 * const *,
+		    const struct _ftsent15 * const *);
+#else
+		void	*fts_compar_b;
+#endif
+	};
+	int		 fts_options;	/* fts_open options, global flags */
+	void		*fts_clientptr;	/* thunk for sort function */
+} FTS15;
+
+typedef struct _ftsent15 {
+	struct _ftsent15 *fts_cycle;	/* cycle node */
+	struct _ftsent15 *fts_parent;	/* parent directory */
+	struct _ftsent15 *fts_link;	/* next file in directory */
+	long long	 fts_number;	/* local numeric value */
+	void		*fts_pointer;	/* local address value */
+	char		*fts_accpath;	/* access path */
+	char		*fts_path;	/* root path */
+	int		 fts_errno;	/* errno for this node */
+	int		 fts_symfd;	/* fd for symlink */
+	__size_t	 fts_pathlen;	/* strlen(fts_path) */
+	__size_t	 fts_namelen;	/* strlen(fts_name) */
+	__ino_t		 fts_ino;	/* inode */
+	__dev_t		 fts_dev;	/* device */
+	__nlink_t	 fts_nlink;	/* link count */
+	long		 fts_level;	/* depth (-1 to N) */
+	int		 fts_info;	/* user status for FTSENT structure */
+	unsigned	 fts_flags;	/* private flags for FTSENT structure */
+	int		 fts_instr;	/* fts_set() instructions */
+	struct stat	*fts_statp;	/* stat(2) information */
+	char		*fts_name;	/* file name */
+	FTS15		*fts_fts;	/* back pointer to main FTS */
+} FTSENT15;
+
+FTSENT15	*freebsd15_fts_children(FTS15 *, int);
+int		 freebsd15_fts_close(FTS15 *);
+void		*freebsd15_fts_get_clientptr(FTS15 *);
+#define		 freebsd15_fts_get_clientptr(fts) ((fts)->fts_clientptr)
+FTS15		*freebsd15_fts_get_stream(FTSENT15 *);
+#define		 freebsd15_fts_get_stream(ftsent) ((ftsent)->fts_fts)
+FTS15		*freebsd15_fts_open(char * const *, int,
+		    int (*)(const FTSENT15 * const *,
+		    const FTSENT15 * const *));
+FTSENT15	*freebsd15_fts_read(FTS15 *);
+int		 freebsd15_fts_set(FTS15 *, FTSENT15 *, int);
+void		 freebsd15_fts_set_clientptr(FTS15 *, void *);
+
+#endif /* !_FTS_COMPAT15_H_ */

lib/libc/gen/fts.3

@@ -25,7 +25,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd May 29, 2026
+.Dd July 7, 2026
 .Dt FTS 3
 .Os
 .Sh NAME
@@ -349,6 +349,22 @@ field are undefined.
 A pointer to
 .Xr stat 2
 information for the file.
+.It Fa fts_dirfd
+A file descriptor open on the parent directory of this entry.
+It may be used with
+.Xr openat 2
+and
+.Fa fts_name
+to access the file without relying on path-based operations,
+which is required in
+.Xr capsicum 4
+capability mode.
+The descriptor is valid only until the next call to
+.Fn fts_read
+and must not be closed by the caller.
+For root-level entries,
+.Fa fts_dirfd
+is \-1.
 .El
 .Pp
 A single buffer is used for all of the paths of all of the files in the

lib/libc/gen/fts.c

@@ -67,6 +67,7 @@ static FTSENT	*fts_build(FTS *, int);
 static void	 fts_lfree(FTSENT *);
 static void	 fts_load(FTS *, FTSENT *);
 static size_t	 fts_maxarglen(char * const *);
+static FTS	*__fts_open(FTS *, char * const *, int);
 static void	 fts_padjust(FTS *, FTSENT *);
 static int	 fts_palloc(FTS *, size_t);
 static FTSENT	*fts_sort(FTS *, FTSENT *, size_t);
@@ -129,7 +130,7 @@ static const char *ufslike_filesystems[] = {
 		default: 0)
 
 static FTS *
-__fts_open(FTS *sp, char * const *argv)
+__fts_open(FTS *sp, char * const *argv, int rootfd)
 {
 	FTSENT *p, *root;
 	FTSENT *parent, *tmp;
@@ -209,12 +210,13 @@ __fts_open(FTS *sp, char * const *argv)
 	 * that we can get back here; this could be avoided for some paths,
 	 * but almost certainly not worth the effort.  Slashes, symbolic links,
 	 * and ".." are all fairly nasty problems.  Note, if we can't get the
-	 * descriptor we run anyway, just more slowly.
+	 * descriptor we run anyway, just more slowly.  We use _openat rather
+	 * than _dup because rootfd may be AT_FDCWD, not a real descriptor.
 	 */
 	if (!ISSET(FTS_NOCHDIR) &&
-	    (sp->fts_rfd = _open(".", O_RDONLY | O_CLOEXEC, 0)) < 0)
+	    (sp->fts_rfd = _openat(rootfd, ".", O_RDONLY |
+	    O_CLOEXEC, 0)) < 0)
 		SET(FTS_NOCHDIR);
-
 	return (sp);
 
 mem3:	fts_lfree(root);
@@ -250,7 +252,7 @@ fts_open(char * const *argv, int options,
 	sp->fts_compar = compar;
 	sp->fts_options = options;
 
-	return (__fts_open(sp, argv));
+	return (__fts_open(sp, argv, AT_FDCWD));
 }
 
 #ifdef __BLOCKS__
@@ -304,7 +306,7 @@ fts_open_b(char * const *argv, int options, fts_block compar)
 	sp->fts_compar_b = compar;
 	sp->fts_options = options | FTS_COMPAR_B;
 
-	if ((sp = __fts_open(sp, argv)) == NULL) {
+	if ((sp = __fts_open(sp, argv, AT_FDCWD)) == NULL) {
 #ifdef __BLOCKS__
 		Block_release(compar);
 #else
@@ -356,6 +358,8 @@ fts_close(FTS *sp)
 			p = p->fts_link != NULL ? p->fts_link : p->fts_parent;
 			free(freep);
 		}
+		if (p->fts_dirfd >= 0)
+			(void)_close(p->fts_dirfd);
 		free(p);
 	}
 
@@ -439,8 +443,9 @@ fts_read(FTS *sp)
 	    (p->fts_info == FTS_SL || p->fts_info == FTS_SLNONE)) {
 		p->fts_info = fts_stat(sp, p, 1, -1);
 		if (p->fts_info == FTS_D && !ISSET(FTS_NOCHDIR)) {
-			if ((p->fts_symfd = _open(".", O_RDONLY | O_CLOEXEC,
-			    0)) < 0) {
+			if ((p->fts_symfd = p->fts_dirfd >= 0 ?
+			    _dup(p->fts_dirfd) :
+			    _open(".", O_RDONLY | O_CLOEXEC, 0)) < 0) {
 				p->fts_errno = errno;
 				p->fts_info = FTS_ERR;
 			} else
@@ -484,7 +489,8 @@ fts_read(FTS *sp)
 		 * FTS_STOP or the fts_info field of the node.
 		 */
 		if (sp->fts_child != NULL) {
-			if (fts_safe_changedir(sp, p, -1, p->fts_accpath)) {
+			if (fts_safe_changedir(sp, p,
+			    p->fts_dirfd, p->fts_name)) {
 				p->fts_errno = errno;
 				p->fts_flags |= FTS_DONTCHDIR;
 				for (p = sp->fts_child; p != NULL;
@@ -532,6 +538,8 @@ next:	tmp = p;
 			p->fts_info = fts_stat(sp, p, 1, -1);
 			if (p->fts_info == FTS_D && !ISSET(FTS_NOCHDIR)) {
 				if ((p->fts_symfd =
+				    p->fts_dirfd >= 0 ?
+				    _dup(p->fts_dirfd) :
 				    _open(".", O_RDONLY | O_CLOEXEC, 0)) < 0) {
 					p->fts_errno = errno;
 					p->fts_info = FTS_ERR;
@@ -558,6 +566,8 @@ name:		t = sp->fts_path + NAPPEND(p->fts_parent);
 		 * can distinguish between error and EOF.
 		 */
 		free(tmp);
+		if (p->fts_dirfd >= 0)
+			(void)_close(p->fts_dirfd);
 		free(p);
 		errno = 0;
 		return (sp->fts_cur = NULL);
@@ -671,7 +681,9 @@ fts_children(FTS *sp, int instr)
 	    ISSET(FTS_NOCHDIR))
 		return (sp->fts_child = fts_build(sp, instr));
 
-	if ((fd = _open(".", O_RDONLY | O_CLOEXEC, 0)) < 0)
+	if ((fd = sp->fts_cur->fts_dirfd >= 0 ?
+	    _dup(sp->fts_cur->fts_dirfd) :
+	    _open(".", O_RDONLY | O_CLOEXEC, 0)) < 0)
 		return (NULL);
 	sp->fts_child = fts_build(sp, instr);
 	serrno = (sp->fts_child == NULL) ? errno : 0;
@@ -907,6 +919,7 @@ mem1:				saved_errno = errno;
 		}
 
 		p->fts_level = level;
+		p->fts_dirfd = _dup(_dirfd(dirp));
 		p->fts_parent = sp->fts_cur;
 		p->fts_pathlen = len + dnamlen;
 
@@ -1185,6 +1198,7 @@ fts_alloc(FTS *sp, char *name, size_t namelen)
 		return (NULL);
 
 	p->fts_symfd = -1;
+	p->fts_dirfd = -1;
 	p->fts_path = sp->fts_path;
 	p->fts_name = (char *)(p + 1);
 	p->fts_namelen = namelen;
@@ -1205,6 +1219,8 @@ fts_lfree(FTSENT *head)
 	/* Free a linked list of structures. */
 	while ((p = head)) {
 		head = head->fts_link;
+		if (p->fts_dirfd >= 0)
+			(void)_close(p->fts_dirfd);
 		free(p);
 	}
 }
@@ -1322,7 +1338,9 @@ fts_ufslinks(FTS *sp, const FTSENT *ent)
 	 * avoidance.
 	 */
 	if (priv->ftsp_dev != ent->fts_dev) {
-		if (statfs(ent->fts_path, &priv->ftsp_statfs) != -1) {
+		if ((ent->fts_dirfd >= 0 ?
+		    _fstatfs(ent->fts_dirfd, &priv->ftsp_statfs) :
+                    statfs(ent->fts_path, &priv->ftsp_statfs)) != -1) {
 			priv->ftsp_dev = ent->fts_dev;
 			priv->ftsp_linksreliable = 0;
 			for (cpp = ufslike_filesystems; *cpp; cpp++) {
@@ -1338,3 +1356,12 @@ fts_ufslinks(FTS *sp, const FTSENT *ent)
 	}
 	return (priv->ftsp_linksreliable);
 }
+__sym_default(fts_open, fts_open, FBSD_1.9);
+__sym_default(fts_close, fts_close, FBSD_1.9);
+__sym_default(fts_read, fts_read, FBSD_1.9);
+__sym_default(fts_set, fts_set, FBSD_1.9);
+__sym_default(fts_children, fts_children, FBSD_1.9);
+__sym_default(fts_get_clientptr, fts_get_clientptr, FBSD_1.9);
+__sym_default(fts_get_stream, fts_get_stream, FBSD_1.9);
+__sym_default(fts_set_clientptr, fts_set_clientptr, FBSD_1.9);
+__sym_default(fts_open_b, fts_open_b, FBSD_1.9);