Add user and workdir elfuse launch flags by henrybear327 · Pull Request #286 · sysprog21/elfuse

henrybear327 · 2026-08-11T20:12:52Z

Summary by cubic

Adds --user UID[:GID] and --workdir DIR to select the guest identity and initial working directory, enforced in elfuse_launch so every launcher (including elfuse-oci run) behaves consistently. Previously guests started with the built‑in uid/gid and the host cwd; now callers can set both, with refusals that prevent privilege confusion and starting outside the sysroot.

--user: digits-only numeric spec; a bare UID sets GID=UID. Staged before bring-up so auxv AT_UID/AT_GID match getuid/getgid, consumed once per launch, and cleared on any early failure. Refuses --fakeroot unless --user 0:0. Symbolic name resolution stays in elfuse-oci.
--workdir: requires a guest-absolute path. Resolved under --sysroot after the casefold probe and must resolve inside the sysroot (carve‑out for --sysroot /). Paths that exist only on the host are rejected. /dev/shm workdirs are refused to avoid following a symlink leaf and to keep guest-visible spelling stable. Cwd is set before the first guest instruction and path state is refreshed.
CLI/API: --help/usage include both flags. launch_args_t adds has_creds, uid, gid, and cwd_guest. New proc_set_initial_ids/proc_clear_initial_ids implement consume‑once staging. All failure paths, including refusals before prepare, unlink a temp FUSE ELF.
Tests/docs: tests/test-launch-flags.sh covers parse/rejection, sysroot containment, /dev/shm refusal, and fakeroot pairing; tests/test-identity-override-host.c pins consume‑once/clear semantics. docs/usage.md documents the flags and rules.

^{Written for commit 4cc9f15. Summary will update on new commits.}

cubic-dev-ai

All reported issues were addressed across 10 files

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai

All reported issues were addressed across 3 files (changes from recent commits).

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

An OCI image front end needs to set the guest identity and working directory without patching the runtime; both flags map onto launch_args_t fields and `elfuse-oci run` drives exactly this interface. The --user identity is staged before bring-up (proc_set_initial_ids) so the auxv AT_UID/AT_GID snapshot taken by build_linux_stack matches what getuid()/getgid() later report. proc_identity_init consumes the staged value, and the elfuse_launch fail path calls proc_clear_initial_ids: a bring-up that fails before proc_init would otherwise leave the value staged for the next launch in the same host process. parse_id_component accepts digits only. strtoul negates the unsigned result, so "-0" would parse as root and "-18446744073709551615" as uid 1, identities the spec on the command line never names. --workdir rejects non-absolute paths up front instead of silently resolving them against the host cwd, and is applied by elfuse_launch after the casefold probe so the translation sees the sysroot's real case behavior. The resolved host path must sit inside the sysroot prefix: proc_resolve_sysroot_path falls back to the host spelling when the sysroot has no entry at the path, which is the overlay contract for guest syscalls but would start the guest in a same-named host directory here, so the launch refuses it. --fakeroot and a non-root --user are refused together. Fakeroot starts the guest as uid/gid 0 and uid_is_permitted() grants every id switch on that basis; a non-root --user would keep that grant while the guest reported an unprivileged uid, letting the guest call setuid(0) at will. The refusal lives in elfuse_launch beside the Rosetta GDB check, so every launcher inherits the privilege rule, and it exits through the shared fail unwind so a FUSE-materialized temp ELF is unlinked even when bring-up never starts. tests/test-launch-flags.sh covers the refusal, the parse rules, and the --workdir sysroot containment; its sign, leading-space, and negated-zero cases were observed failing against the strtoul spelling, while the UINT32_MAX boundary and empty-GID cases are regression guards that spelling also rejected. tests/test-identity-override-host.c pins the staging consume-once and clear semantics as regression guards (the cross-launch leak needs two bring-ups in one host process, which no launcher performs). docs/usage.md documents both flags, the containment rule, and the two-sided root requirement behind the fakeroot refusal.

path_translate_at redirects /dev/shm/<leaf> into the per-UID host backing dir and returns before sysroot resolution, so elfuse_launch ran only sys_chdir's real-directory branch for such a workdir. The plain chdir followed a symlink leaf that shm_open_leaf's O_NOFOLLOW fd refuses, and proc_cwd_refresh published the backing location, so getcwd reported /private/tmp/elfuse-shm-<uid>/<leaf> where a guest chdir into the same directory reports /dev/shm/<leaf>. Entering the leaf correctly needs that O_NOFOLLOW fd and the virtual-cwd publish, which would make launch.c a second holder of the never-follow duty dev_shm_resolve_path enumerates, for a workdir no image asks for. The flag refuses the path instead, on the same grounds guest_bootstrap_prepare refuses a /dev/shm ELF interpreter. The test chmods the backing root because create_private_dir rejects a group or other permission bit, and that failure surfaces as a resolve error rather than the refusal the case measures. The leaf itself never has to exist: path_translate_at sets is_dev_shm from the guest prefix alone.