Repository navigation
T57 — Design the provider directory and socket ownership for a split-user VMM #2537
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Proxy as the operator, VM as its own user | S | unknown ground | strongest | an agent | 80 (20 code, 60 tests) |
The design document names an owner, a mode and the opening user for every socket and file in the provider directory, and arch has ruled on it, so T38 can be cut against it.
Covers:
- none
Layers:
- design:
- crates/minvmd/src/sock.rs: a test reads the design document and checks that every socket and file
prepare_socket_dirand the VMM child create is named with an owner, a mode and an opening user - docs/design/2026-10-25-split-user-vmm-provider-dir.md (new): with gvproxy and the VMM running as a dedicated unprivileged user, how the marker, report, telemetry, gate and ssh bridge sockets, the data volume and the boot log in the provider directory stay reachable by
minand the proxy as the login user, given thatsock::prepare_socket_dirmakes that directory 0700 owned by the caller and each socket 0600; the hypothesis is a group shared by the two users, a 0770 directory and 0660 sockets, with the uid change handed over by the sudoers drop-inmin finalize-installinstalls; the document reads crates/minvmd/src/sock.rs, vm.rs, image.rs, volume.rs, cmd/vmm_child.rs and crates/bep/src/listener.rs, lists every caller that opens each path, and ends with the ownership and permission model that arch ruled on, or with the fallback that only gvproxy runs as the dedicated user cargo nextest run -p minvmd split_user_provider_dir_design_names_every_socket_owner
- crates/minvmd/src/sock.rs: a test reads the design document and checks that every socket and file
Waits on:
Plan block
### T57 — Design the provider directory and socket ownership for a split-user VMM
slice: S8
kind: enablement
covers: none
size: S
est: 20 code, 60 tests
executor: agent
difficulty: unknown ground
model: strongest
diagnostics: the design document names, for each socket and file in the provider directory, the user that creates it, the mode it gets and the user that opens it
observability: none; this task ships a design document and no code
layers:
- design:
- crates/minvmd/src/sock.rs: a test reads the design document and checks that every socket and file `prepare_socket_dir` and the VMM child create is named with an owner, a mode and an opening user
- docs/design/2026-10-25-split-user-vmm-provider-dir.md (new): with gvproxy and the VMM running as a dedicated unprivileged user, how the marker, report, telemetry, gate and ssh bridge sockets, the data volume and the boot log in the provider directory stay reachable by `min` and the proxy as the login user, given that `sock::prepare_socket_dir` makes that directory 0700 owned by the caller and each socket 0600; the hypothesis is a group shared by the two users, a 0770 directory and 0660 sockets, with the uid change handed over by the sudoers drop-in `min finalize-install` installs; the document reads crates/minvmd/src/sock.rs, vm.rs, image.rs, volume.rs, cmd/vmm_child.rs and crates/bep/src/listener.rs, lists every caller that opens each path, and ends with the ownership and permission model that arch ruled on, or with the fallback that only gvproxy runs as the dedicated user
test: cargo nextest run -p minvmd split_user_provider_dir_design_names_every_socket_owner
produces: none
consumes: none
proof: The design document names an owner, a mode and the opening user for every socket and file in the provider directory, and arch has ruled on it, so T38 can be cut against it.
depends on:
- blocked by T19
Generated by Claude Code
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 25, 2026
Done. #2546 merged.
branch
agent/2537-design-the-provider-directory-and-socket-ownersh· epic #1501 · PR #25464a2b537cbf6bc4a4319f971c97f318b0278ee0c53957e4f98c75652a2725a6b078cae9f08f0e1213Updated 2026-10-25T09:18:02.765Z.