pathrs: support errors.Is(unix.EXDEV) checks for ErrPossible*

Our ErrPossible* errors are conceptually equivalent to EXDEV so we
should support checking against them the same way (this also lets users
check this way too).

Signed-off-by: Aleksa Sarai <[email protected]>

Author: cyphar

pathrs-lite/internal/errors.go renamed to pathrs-lite/internal/errors_linux.go

@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: MPL-2.0
 
+//go:build linux
+
 // Copyright (C) 2024-2025 Aleksa Sarai <[email protected]>
 // Copyright (C) 2024-2025 SUSE LLC
 //
@@ -12,15 +14,24 @@ package internal
 
 import (
 	"errors"
+
+	"golang.org/x/sys/unix"
 )
 
+type xdevErrorish struct {
+	description string
+}
+
+func (err xdevErrorish) Error() string        { return err.description }
+func (err xdevErrorish) Is(target error) bool { return target == unix.EXDEV }
+
 var (
 	// ErrPossibleAttack indicates that some attack was detected.
-	ErrPossibleAttack = errors.New("possible attack detected")
+	ErrPossibleAttack error = xdevErrorish{"possible attack detected"}
 
 	// ErrPossibleBreakout indicates that during an operation we ended up in a
 	// state that could be a breakout but we detected it.
-	ErrPossibleBreakout = errors.New("possible breakout detected")
+	ErrPossibleBreakout error = xdevErrorish{"possible breakout detected"}
 
 	// ErrInvalidDirectory indicates an unlinked directory.
 	ErrInvalidDirectory = errors.New("wandered into deleted directory")

pathrs-lite/internal/errors_linux_test.go

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build linux
+
+// Copyright (C) 2024-2025 Aleksa Sarai <[email protected]>
+// Copyright (C) 2024-2025 SUSE LLC
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+package internal
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/sys/unix"
+)
+
+func TestErrorXdev(t *testing.T) {
+	for _, test := range []struct {
+		name string
+		err  error
+	}{
+		{"ErrPossibleAttack", ErrPossibleAttack},
+		{"ErrPossibleBreakout", ErrPossibleBreakout},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			assert.ErrorIs(t, test.err, test.err, "errors.Is(err, err) should succeed")     //nolint:useless-assert,testifylint // we need to check this
+			assert.ErrorIs(t, test.err, unix.EXDEV, "errors.Is(err, EXDEV) should succeed") //nolint:useless-assert,testifylint // we need to check this
+		})
+
+		t.Run(test.name+"-Wrapped", func(t *testing.T) {
+			err := fmt.Errorf("wrapped error: %w", test.err)
+			assert.ErrorIs(t, err, test.err, "errors.Is(err, err) should succeed")     //nolint:useless-assert,testifylint // we need to check this
+			assert.ErrorIs(t, err, unix.EXDEV, "errors.Is(err, EXDEV) should succeed") //nolint:useless-assert,testifylint // we need to check this
+		})
+	}
+}