Repository navigation
Preserve public Git snapshot access for fixed nonroot P2 execution - #1036
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A Git snapshot extracted under caller umask 077 can be inaccessible to the fixed non-root P2 container. Normalize only the validated public snapshot to directories 0755 and files 0644/0755 according to Git executable bits. Keep private parents, output ownership, readonly binds and the runtime isolation contract unchanged; refuse links, special files and changed extraction populations before launch.
The existing RunAsync fixture now uses real tar under a child-local restrictive mask and checks bytes, executable classes and private ancestors at an inert Podman port. It also covers symlink/FIFO, extra/missing and escaped-tree refusals. Both focused runner tests passed after a warning-as-error ABI declaration correction; the original FS0009 build failure is retained. Source review accepted both the implementation and that narrow correction. Atlas captures the source boundary without claiming execution as actual UID32768.
Validation: SDK 10.0.400; locked private restore; Release build with warnings as errors; two focused PortableWorkspaceExecutorTests passed. No actual Podman, image, container-UID or full FourD acceptance is claimed. Refs https://github.com/FS-GG/FS.GG.FourD/issues/37; its full acceptance, original image-success/P2-failure evidence and policy #39 hold remain open. This PR supplies the producer correction for that same owned acceptance route and does not close the owning issue.