io/fs: add Sub

Sub provides a convenient way to refer to a subdirectory
automatically in future operations, like Unix's chdir(2).

The CL also includes updates to fstest to check Sub implementations.

As part of updating fstest, I changed the meaning of TestFS's
expected list to introduce a special case: if you list no expected files,
that means the FS must be empty. In general it's OK not to list all
the expected files, but if you list none, that's almost certainly a
mistake - if your FS were broken and empty, you wouldn't find out.
Making no expected files mean "must be empty" makes the mistake
less likely - if your file system ever worked, then your test will keep
it working.

That change found a testing bug: embedtest was making exactly
that mistake.

Fixes #42322.

Change-Id: I63fd4aa866b30061a0e51ca9a1927e576d6ec41e
Reviewed-on: https://go-review.googlesource.com/c/go/+/274856
Trust: Russ Cox <rsc@golang.org>
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>

1 files changed, 7 insertions, 0 deletions

diff --git a/src/os/file.go b/src/os/file.go
index 304b055dbe..416bc0efa6 100644
--- a/src/os/file.go
+++ b/src/os/file.go
@@ -609,6 +609,13 @@ func isWindowsNulName(name string) bool {
 }
 
 // DirFS returns a file system (an fs.FS) for the tree of files rooted at the directory dir.
+//
+// Note that DirFS("/prefix") only guarantees that the Open calls it makes to the
+// operating system will begin with "/prefix": DirFS("/prefix").Open("file") is the
+// same as os.Open("/prefix/file"). So if /prefix/file is a symbolic link pointing outside
+// the /prefix tree, then using DirFS does not stop the access any more than using
+// os.Open does. DirFS is therefore not a general substitute for a chroot-style security
+// mechanism when the directory tree contains arbitrary content.
 func DirFS(dir string) fs.FS {
 	return dirFS(dir)
 }