Add user and workdir elfuse launch flags - #286
Draft
henrybear327 wants to merge 1 commit into
Draft
Conversation
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
jserv
requested changes
Aug 12, 2026
jserv
left a comment
jserv
left a comment
Contributor
There was a problem hiding this comment.
Rebase latest main branch and resolve conflicts.
henrybear327
force-pushed
the
oci/add_user_workdir_flag
branch
from
August 12, 2026 14:35
9911813 to
cd98b4e
Compare
Collaborator
Author
Done, and addressed all pending comments. |
henrybear327
marked this pull request as draft
August 12, 2026 18:09
henrybear327
force-pushed
the
oci/add_user_workdir_flag
branch
from
August 12, 2026 18:50
cd98b4e to
20a5e74
Compare
An OCI image front end needs to set the guest identity and working directory without patching the runtime; both flags map onto launch_args_t fields and `elfuse-oci run` drives exactly this interface. The --user identity is staged before bring-up (proc_set_initial_ids) so the auxv AT_UID/AT_GID snapshot taken by build_linux_stack matches what getuid()/getgid() later report. The staged value is consumed by exactly one proc_identity_init, and the elfuse_launch fail path drops an unconsumed value (proc_clear_initial_ids): a bring-up failure before prepare's proc_init would otherwise leave it armed for the next launch in the same host process. --workdir rejects non-absolute paths up front instead of silently resolving them against the host cwd, and is applied by elfuse_launch after the casefold probe so the translation sees the sysroot's real case behavior. The resolved host path must sit inside the sysroot prefix: proc_resolve_sysroot_path falls back to the host spelling when the sysroot has no entry at the path, which is the overlay contract for guest syscalls but would start the guest in a same-named host directory here, so the launch refuses it. --fakeroot and a non-root --user are refused together. Fakeroot means the guest starts as uid/gid 0, and the setuid permission check grants every id switch on that basis; a non-root --user would leave that grant in place while the guest reported an unprivileged uid, so the guest could raise itself back to root at will. The refusal lives in elfuse_launch beside the Rosetta GDB check, so every launcher inherits the privilege rule, and it exits through the shared fail unwind so a FUSE-materialized temp ELF is unlinked even when bring-up never starts. tests/test-launch-flags.sh covers the refusal, the parse rules, and the --workdir sysroot containment; tests/test-identity-override-host.c pins the staging consume-once and clear semantics as regression guards (the cross-launch leak needs two bring-ups in one host process, which no current binary performs). docs/usage.md documents both flags, the containment rule, and the two-sided root requirement behind the fakeroot refusal.
henrybear327
force-pushed
the
oci/add_user_workdir_flag
branch
from
August 13, 2026 12:14
20a5e74 to
238f4de
Compare
henrybear327
marked this pull request as ready for review
August 13, 2026 12:14
henrybear327
marked this pull request as draft
August 13, 2026 12:27
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
henrybear327
marked this pull request as ready for review
August 13, 2026 20:12
henrybear327
marked this pull request as draft
August 13, 2026 20:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This branch is stacked on top of #285. Thus, before #285 is merged, we will see 4 commits from it
Summary by cubic
Adds
--user UID[:GID]and--workdir DIRto select the guest identity and initial cwd, enforced inelfuse_launchso all launchers (e.g.,elfuse-oci run) get consistent, safe behavior.--useris numeric-only; a bare UID sets GID=UID. It stages ids before bring‑up so auxv AT_UID/AT_GID matchgetuid/getgid.--fakerootwith a non‑root--useris refused (use--user 0:0if needed).--workdirrequires a guest‑absolute path. It is translated under--sysrootafter casefold probing and must resolve inside the sysroot; paths that only exist on the host are rejected. Relative paths are rejected up front.The usage synopsis now shows these flags in both
--helpand error paths. Rosetta (x86_64) guests still refuse--gdb.Implements
elfuse_launch(launch_args_t)with new fields:has_creds,uid,gid,cwd_guest. Addsproc_set_initial_ids/proc_clear_initial_idsto stage/clear credentials around bring‑up.Adds
tests/test-launch-flags.shfor rejection and containment checks and extends identity staging tests. Updatesdocs/usage.mdandmk/tests.mk;ELFUSE_USAGE_BODYkeeps help and error usage in sync.Written for commit 238f4de. Summary will update on new commits.