T65 — Lay out the split users, directories and socket modes for a split-user VMM

Task

slice	size	difficulty	model	who	estimated lines
Proxy as the operator, VM as its own user	L	needs care	strongest	an agent	700 (380 code, 320 tests)

min finalize-install can lay out the split users and directories at the T57 design's modes, minvmd accepts and enforces those modes, and the guest and telemetry doors admit the minimal-vmm uid.

Covers:

BEP-047

Layers:

install:
- crates/minimal/src/cmd/finalize_install.rs: the vm-users script creates the minimal-vmm and minimal-gvproxy users and groups, the provider dir at 0710 group minimal-vmm, vmm/, <gvproxy dir>, <gvproxy config dir> and <gate dir> as docs/design/2026-10-25-split-user-vmm-provider-dir.md lays them out, and renders the sudoers drop-in; the item is not offered until T66 spawns through sudo -n (narrowed 2026-10-25 by the epic owner to the foundation feat(minimal): lay out the split VM users, directories and socket modes (T65) #2561 delivered; arch C3 on feat(minimal): lay out the split VM users, directories and socket modes (T65) #2561)
- cargo nextest run -p minimal finalize_install_creates_the_split_users_dirs_and_drop_in
sockets:
- crates/minvmd/src/sock.rs: prepare_socket_dir, restrict_owned_dir and verify_provider_dir_ownership accept 0710 with group minimal-vmm; enforce_socket_permissions and verify_socket_permissions take the mode and the group from the design's table
- crates/minvmd/src/cmd/vmm_child.rs: creates the boot log with mode 0640
- crates/minvmd/src/volume.rs: create_sparse_raw creates the data volume with mode 0600
- crates/minvmd/src/control.rs: the guest door admits the minimal-vmm uid and the supervisor's own uid; the host door keeps its check
- crates/minvmd/src/guest_telemetry.rs: accept_loop admits the minimal-vmm uid and the supervisor's own uid
- cargo nextest run -p minvmd split_user_provider_dir_modes_are_enforced

Waits on:

T57 — Design the provider directory and socket ownership for a split-user VMM #2537

Plan block

### T65 — Lay out the split users, directories and socket modes for a split-user VMM
  slice: S8
  kind: task
  covers: BEP-047
  size: L
  est: 380 code, 320 tests
  executor: agent
  difficulty: needs care
  model: strongest
  diagnostics: `min finalize-install` names the vm-users item and why it cannot set up the split users (a user-writable binary path, or a home directory the dedicated users cannot search)
  observability: one debug log line when minvmd gives a socket 0600 because it does not hold the socket's group
  layers:
    - install:
      - crates/minimal/src/cmd/finalize_install.rs: the vm-users script creates the `minimal-vmm` and `minimal-gvproxy` users and groups, the provider dir at 0710 group `minimal-vmm`, `vmm/`, `<gvproxy dir>`, `<gvproxy config dir>` and `<gate dir>` as `docs/design/2026-10-25-split-user-vmm-provider-dir.md` lays them out, and renders the sudoers drop-in; the item is not offered until T66 spawns through `sudo -n` (narrowed 2026-10-25 by the epic owner to the foundation #2561 delivered; arch C3 on #2561)
      test: cargo nextest run -p minimal finalize_install_creates_the_split_users_dirs_and_drop_in
    - sockets:
      - crates/minvmd/src/sock.rs: `prepare_socket_dir`, `restrict_owned_dir` and `verify_provider_dir_ownership` accept 0710 with group `minimal-vmm`; `enforce_socket_permissions` and `verify_socket_permissions` take the mode and the group from the design's table
      - crates/minvmd/src/cmd/vmm_child.rs: creates the boot log with mode 0640
      - crates/minvmd/src/volume.rs: `create_sparse_raw` creates the data volume with mode 0600
      - crates/minvmd/src/control.rs: the guest door admits the `minimal-vmm` uid and the supervisor's own uid; the host door keeps its check
      - crates/minvmd/src/guest_telemetry.rs: `accept_loop` admits the `minimal-vmm` uid and the supervisor's own uid
      test: cargo nextest run -p minvmd split_user_provider_dir_modes_are_enforced
  produces: none
  consumes: none
  proof: `min finalize-install` can lay out the split users and directories at the T57 design's modes, minvmd accepts and enforces those modes, and the guest and telemetry doors admit the `minimal-vmm` uid.
  depends on:
    - blocked by T57

Generated by Claude Code

Done. #2561 merged.

branch agent/2560-run-gvproxy-and-the-vmm-child-as-their-dedicated · epic #1501 · PR #2561

round	outcome	job
1	pushed	`73418a18`
2	pushed	`271bfa99`
3	pushed	`487b1b07`

Updated 2026-10-25T23:04:17.963Z.

Navigation Menu

Repository navigation

T65 — Lay out the split users, directories and socket modes for a split-user VMM #2560

Task

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

T65 — Lay out the split users, directories and socket modes for a split-user VMM #2560

Description

Task

Activity

minimal-foundry commented on Oct 25, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions