Repository navigation
T65 — Lay out the split users, directories and socket modes for a split-user VMM #2560
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Proxy as the operator, VM as its own user | L | needs care | strongest | an agent | 700 (380 code, 320 tests) |
min finalize-installcan lay out the split users and directories at the T57 design's modes, minvmd accepts and enforces those modes, and the guest and telemetry doors admit theminimal-vmmuid.
Covers:
- BEP-047
Layers:
- install:
- crates/minimal/src/cmd/finalize_install.rs: the vm-users script creates the
minimal-vmmandminimal-gvproxyusers and groups, the provider dir at 0710 groupminimal-vmm,vmm/,<gvproxy dir>,<gvproxy config dir>and<gate dir>asdocs/design/2026-10-25-split-user-vmm-provider-dir.mdlays them out, and renders the sudoers drop-in; the item is not offered until T66 spawns throughsudo -n(narrowed 2026-10-25 by the epic owner to the foundation feat(minimal): lay out the split VM users, directories and socket modes (T65) #2561 delivered; arch C3 on feat(minimal): lay out the split VM users, directories and socket modes (T65) #2561) cargo nextest run -p minimal finalize_install_creates_the_split_users_dirs_and_drop_in
- crates/minimal/src/cmd/finalize_install.rs: the vm-users script creates the
- sockets:
- crates/minvmd/src/sock.rs:
prepare_socket_dir,restrict_owned_dirandverify_provider_dir_ownershipaccept 0710 with groupminimal-vmm;enforce_socket_permissionsandverify_socket_permissionstake the mode and the group from the design's table - crates/minvmd/src/cmd/vmm_child.rs: creates the boot log with mode 0640
- crates/minvmd/src/volume.rs:
create_sparse_rawcreates the data volume with mode 0600 - crates/minvmd/src/control.rs: the guest door admits the
minimal-vmmuid and the supervisor's own uid; the host door keeps its check - crates/minvmd/src/guest_telemetry.rs:
accept_loopadmits theminimal-vmmuid and the supervisor's own uid cargo nextest run -p minvmd split_user_provider_dir_modes_are_enforced
- crates/minvmd/src/sock.rs:
Waits on:
Plan block
### T65 — Lay out the split users, directories and socket modes for a split-user VMM
slice: S8
kind: task
covers: BEP-047
size: L
est: 380 code, 320 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: `min finalize-install` names the vm-users item and why it cannot set up the split users (a user-writable binary path, or a home directory the dedicated users cannot search)
observability: one debug log line when minvmd gives a socket 0600 because it does not hold the socket's group
layers:
- install:
- crates/minimal/src/cmd/finalize_install.rs: the vm-users script creates the `minimal-vmm` and `minimal-gvproxy` users and groups, the provider dir at 0710 group `minimal-vmm`, `vmm/`, `<gvproxy dir>`, `<gvproxy config dir>` and `<gate dir>` as `docs/design/2026-10-25-split-user-vmm-provider-dir.md` lays them out, and renders the sudoers drop-in; the item is not offered until T66 spawns through `sudo -n` (narrowed 2026-10-25 by the epic owner to the foundation #2561 delivered; arch C3 on #2561)
test: cargo nextest run -p minimal finalize_install_creates_the_split_users_dirs_and_drop_in
- sockets:
- crates/minvmd/src/sock.rs: `prepare_socket_dir`, `restrict_owned_dir` and `verify_provider_dir_ownership` accept 0710 with group `minimal-vmm`; `enforce_socket_permissions` and `verify_socket_permissions` take the mode and the group from the design's table
- crates/minvmd/src/cmd/vmm_child.rs: creates the boot log with mode 0640
- crates/minvmd/src/volume.rs: `create_sparse_raw` creates the data volume with mode 0600
- crates/minvmd/src/control.rs: the guest door admits the `minimal-vmm` uid and the supervisor's own uid; the host door keeps its check
- crates/minvmd/src/guest_telemetry.rs: `accept_loop` admits the `minimal-vmm` uid and the supervisor's own uid
test: cargo nextest run -p minvmd split_user_provider_dir_modes_are_enforced
produces: none
consumes: none
proof: `min finalize-install` can lay out the split users and directories at the T57 design's modes, minvmd accepts and enforces those modes, and the guest and telemetry doors admit the `minimal-vmm` uid.
depends on:
- blocked by T57
Generated by Claude Code
Reacted by minimal-foundry
Activity
minimal-foundry commentedon Oct 25, 2026
Done. #2561 merged.
branch
agent/2560-run-gvproxy-and-the-vmm-child-as-their-dedicated· epic #1501 · PR #256173418a18271bfa99487b1b07Updated 2026-10-25T23:04:17.963Z.
[-]T65 — Run gvproxy and the VMM child as their dedicated users[/-][+]T65 — Lay out the split users, directories and socket modes for a split-user VMM[/+]