Track virtual file ownership through chown EPERM

[jserv]

A rootless macOS host cannot chown a file to an arbitrary uid/gid, so the existing fallback turns the host EPERM into no-op success. Follow-up stat still returns the host's real owner instead of the value the guest just chowned to, which trips programs that diff metadata after extraction (tar --same-owner, cp -p, rsync -a, install -o user, dpkg, Python shutil.chown + os.stat).

Add a small (dev, ino) -> (uid, gid) overlay keyed by host stat. sys_fchownat and sys_fchown record the intent on EPERM and on host success alike, with the partial-chown -1 sentinel preserving the prior field. The stat-family wrappers in src/syscall/fs-stat.c consult the overlay once before translating struct stat into linux_stat[x]_t, so fstat / newfstatat / statx all pick up the override automatically. The set helper auto-prunes entries whose final (uid, gid) matches host's current values, so a guest that resets to the host owner walks away with a clean table.

Host inode reuse is defended by hooks in sys_unlinkat, sys_renameat2, and sys_close: stat the identity before the operation, and clear the overlay only when no other path or open fd still references the same (dev, ino). Forked children inherit the overlay through a new chown_overlay_send / chown_overlay_recv pair on the existing fork IPC socket. The recv helper reads records into a transient heap buffer before taking the lock so blocking IO does not serialize sibling stats; it also rejects out-of-band record counts.

stat is hot. The lock is a pthread_rwlock_t with apply / send taking the read lock and set / clear / recv taking the write lock; an atomic entry counter lets apply skip the lock entirely when no overrides exist.

The fork IPC header drops the standalone version field. The first header word is the protocol identity: bumping FORK_IPC_PROTOCOL_MAGIC (0x454C464C, "ELFL") replaces what bumping IPC_VERSION used to do, with one fewer field on the wire and one fewer concept in the code.

---

Summary by cubic

Adds a virtual ownership overlay so chown on rootless macOS records intended uid/gid even on EPERM, and stat/fstat/statx return it. Also switches fork IPC to a protocol magic and adds tests.

• New Features

  • Record ownership on chown success or EPERM; honor -1 partial updates; auto-prune when values match the host.
  • stat/fstat/newfstatat/statx consult the overlay once, keyed by (st_dev, st_ino) so it survives renames and covers hard links.
  • Clear entries on unlink, rename-overwrite, and when the last open fd to an unlinked inode closes.
  • Forked children inherit the overlay via fork IPC; recv pre-reads outside the lock. Readers use an rwlock; a fast path skips locking when empty.
  • Errors: non-EPERM chown errors propagate; return ENOMEM if the overlay entry cannot be allocated.
  • Tests: added test-chown-overlay and wired it into make check.

• Refactors

  • Fork IPC header now uses FORK_IPC_PROTOCOL_MAGIC ("ELFL") as the protocol identity; removed IPC_VERSION; has_shm and is_rosetta are bools.
  • Added native test-fork-ipc-protocol-host and build/test targets.

^{Written for commit 8f51995. Summary will update on new commits.}

[cubic-dev-ai]

7 issues found across 13 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/runtime/fork-state.h">

<violation number="1" location="src/runtime/fork-state.h:29">
P2: The fork IPC header now uses `bool` fields in a raw-serialized struct, making the wire layout compiler/ABI-dependent.</violation>
</file>

<file name="src/syscall/fs.c">

<violation number="1" location="src/syscall/fs.c:2007">
P2: `sys_fchownat` uses a non-atomic restat-by-path for overlay identity, so concurrent path replacement can attach virtual ownership to the wrong inode.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The fork IPC header now uses bool fields in a raw-serialized struct, making the wire layout compiler/ABI-dependent.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/runtime/fork-state.h, line 29:

<comment>The fork IPC header now uses `bool` fields in a raw-serialized struct, making the wire layout compiler/ABI-dependent.</comment>

<file context>
@@ -15,23 +15,18 @@
-    uint32_t version;
     uint32_t ipa_bits;
-    uint32_t has_shm;
+    bool has_shm;
     int64_t child_pid, parent_pid;
     uint64_t guest_size;
</file context>

[cubic-dev-ai]

P2: sys_fchownat uses a non-atomic restat-by-path for overlay identity, so concurrent path replacement can attach virtual ownership to the wrong inode.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/syscall/fs.c, line 2007:

<comment>`sys_fchownat` uses a non-atomic restat-by-path for overlay identity, so concurrent path replacement can attach virtual ownership to the wrong inode.</comment>

<file context>
@@ -1906,8 +1999,16 @@ int64_t sys_fchownat(guest_t *g,
+
+    struct stat host_st;
+    const struct stat *st_ptr = NULL;
+    if (fstatat(dir_ref.fd, tx.host_path, &host_st, mac_flags) == 0)
+        st_ptr = &host_st;
+
</file context>