Track virtual file ownership through chown EPERM

A rootless macOS host cannot chown a file to an arbitrary uid/gid, so
the existing fallback turns the host EPERM into no-op success. Follow-up
stat still returns the host's real owner instead of the value the guest
just chowned to, which trips programs that diff metadata after extraction
(tar --same-owner, cp -p, rsync -a, install -o user, dpkg, Python
shutil.chown + os.stat).

Add a small (dev, ino) -> (uid, gid) overlay keyed by host stat.
sys_fchown{at} record the intent on EPERM and on host success alike,
with the partial-chown -1 sentinel preserving the prior field. The
stat-family wrappers in src/syscall/fs-stat.c consult the overlay once
before translating struct stat into linux_stat[x]_t, so fstat /
newfstatat / statx all pick up the override automatically. The set helper
auto-prunes entries whose final (uid, gid) matches host's current values,
so a guest that resets to the host owner walks away with a clean table.

Host inode reuse is defended by hooks in sys_unlinkat, sys_renameat2,
and sys_close: stat the identity before the operation, and clear the
overlay only when no other path or open fd still references the same
(dev, ino). Forked children inherit the overlay through a new
chown_overlay_{send,recv} on the existing fork IPC socket. The recv
helper reads records into a transient heap buffer before taking the lock
so blocking IO does not serialize sibling stats; it also rejects
out-of-band record counts.

stat is hot. The lock is a pthread_rwlock_t with apply / send taking the
read lock and set / clear / recv taking the write lock; an atomic entry
counter lets apply skip the lock entirely when no overrides exist.

The fork IPC header drops the standalone version field. The first header
word is the protocol identity: bumping FORK_IPC_PROTOCOL_MAGIC
(0x454C464C, "ELFL") replaces what bumping IPC_VERSION used to do, with
one fewer field on the wire and one fewer concept in the code.

Close #59

Author: jserv

Makefile

@@ -40,6 +40,7 @@ SRCS := \
     syscall/path.c \
     syscall/fuse.c \
     syscall/sidecar.c \
+    syscall/chown-overlay.c \
     syscall/fs.c \
     syscall/fs-stat.c \
     syscall/fs-xattr.c \
@@ -142,6 +143,14 @@ $(BUILD_DIR)/test-tlbi-encoder-host: $(BUILD_DIR)/test-tlbi-encoder-host.o \
 	@echo "  LD      $@"
 	$(Q)$(CC) $(CFLAGS) -o $@ $^
 
+## Build the fork IPC protocol identity unit test (native macOS binary).
+# Pure C; no HVF entitlement needed. Pins the first header word as the
+# cross-version protocol discriminator after IPC_VERSION removal.
+$(BUILD_DIR)/test-fork-ipc-protocol-host: \
+		$(BUILD_DIR)/test-fork-ipc-protocol-host.o | $(BUILD_DIR)
+	@echo "  LD      $@"
+	$(Q)$(CC) $(CFLAGS) -o $@ $^
+
 ## Build the proctitle argv-tail regression test (native macOS binary)
 # Links against the project-built proctitle.o so the exact in-tree code is
 # exercised; no HVF entitlement is needed because the test only manipulates

mk/config.mk

@@ -20,7 +20,8 @@ endif
 
 # Exclude native macOS test files from cross-compilation
 NATIVE_TESTS := tests/test-multi-vcpu.c tests/test-rwx.c \
-                tests/test-tlbi-encoder-host.c
+                tests/test-tlbi-encoder-host.c \
+                tests/test-fork-ipc-protocol-host.c
 SPECIAL_TEST_SRCS := tests/test-lowbase-mem.c
 SPECIAL_TEST_BINS := $(BUILD_DIR)/test-lowbase-mem-200000 $(BUILD_DIR)/test-lowbase-mem-300000
 

mk/tests.mk

@@ -10,7 +10,7 @@
         test-matrix test-matrix-elfuse-aarch64 test-matrix-qemu-aarch64 \
         test-full test-multi-vcpu test-rwx test-sysroot-rename \
         test-case-collision test-case-collision-fallback test-getdents64-overlong \
-        test-sysroot-create-paths \
+        test-sysroot-create-paths test-fork-ipc-protocol-host \
         test-proctitle-host test-proctitle-low-stack \
         test-sysroot-procfs-exec test-timeout-disable test-fuse-alpine \
         test-sysroot-nofollow test-sysroot-chdir perf
@@ -37,10 +37,13 @@ endef
 
 ## Run the unit test suite plus busybox applet validation
 check: $(ELFUSE_BIN) $(TEST_DEPS) check-syscall-coverage \
-		$(BUILD_DIR)/test-tlbi-encoder-host
+		$(BUILD_DIR)/test-tlbi-encoder-host \
+		$(BUILD_DIR)/test-fork-ipc-protocol-host
 	@bash tests/driver.sh -e $(ELFUSE_BIN) -d $(TEST_DIR) -v
 	@printf "\n$(BLUE)━━━ TLBI RVAE1IS encoder unit test ━━━$(RESET)\n"
 	@$(BUILD_DIR)/test-tlbi-encoder-host
+	@printf "\n$(BLUE)━━━ fork IPC protocol identity unit test ━━━$(RESET)\n"
+	@$(BUILD_DIR)/test-fork-ipc-protocol-host
 	@printf "\n$(BLUE)━━━ proctitle argv-tail regression ━━━$(RESET)\n"
 	@$(MAKE) --no-print-directory test-proctitle-host
 	@printf "\n$(BLUE)━━━ proctitle low-stack regression ━━━$(RESET)\n"
@@ -569,6 +572,11 @@ test-multi-vcpu: $(BUILD_DIR)/test-multi-vcpu
 test-rwx: $(BUILD_DIR)/test-rwx
 	$(BUILD_DIR)/test-rwx
 
+# Fork IPC protocol identity regression
+## Run the fork IPC protocol identity unit test
+test-fork-ipc-protocol-host: $(BUILD_DIR)/test-fork-ipc-protocol-host
+	$(BUILD_DIR)/test-fork-ipc-protocol-host
+
 # Proctitle argv-tail regression
 ## Run the deterministic argv-tail overshoot guard test
 test-proctitle-host: $(BUILD_DIR)/test-proctitle-host

src/runtime/fork-state.c

@@ -36,6 +36,7 @@ int fork_ipc_write_all(int fd, const void *buf, size_t len)
                 continue;
             return -1;
         }
+
         if (n == 0) {
             /* Defensive: an unexpected zero return on a blocking socket would
              * otherwise spin forever, since p and len stay at the same offset.

src/runtime/fork-state.h

@@ -15,23 +15,18 @@
 #include "syscall/abi.h"
 #include "syscall/signal.h"
 
-/* Magic values for IPC frame delimiters */
-#define IPC_MAGIC_HEADER 0x454C464BU   /* "ELFK" */
-#define IPC_MAGIC_SENTINEL 0x454C4F4BU /* "ELOK" */
-/* Bumped to 11 when regions_tracker_stale was added to process state so forked
- * children preserve mprotect fast-path correctness.
- *
- * Bumped to 10 when the rosetta placement / kbuf / ttbr1 tuple was added so a
- * rosetta-aware child rejects an older parent's header instead of trying to
- * interpret unknown trailing fields.
+/* Fork IPC protocol identity. Bump this whenever the header layout or ordered
+ * fork payload changes incompatibly.
  */
-#define IPC_VERSION 11
+#define FORK_IPC_PROTOCOL_MAGIC 0x454C464CU /* "ELFL" */
+
+#define IPC_MAGIC_HEADER FORK_IPC_PROTOCOL_MAGIC
+#define IPC_MAGIC_SENTINEL 0x454C4F4BU /* "ELOK" */
 
 typedef struct {
     uint32_t magic;
-    uint32_t version;
     uint32_t ipa_bits;
-    uint32_t has_shm;
+    bool has_shm;
     int64_t child_pid, parent_pid;
     uint64_t guest_size;
     uint64_t elf_load_min;
@@ -46,14 +41,14 @@ typedef struct {
     uint32_t _pad;
     uint64_t absock_namespace_id;
     int64_t sid, pgid;
+
     /* Rosetta placement fields. All zero for aarch64 guests; populated when the
      * parent is_rosetta. The child rebuilds the TTBR1 kbuf tree from the PT
      * pool that came across in the memory transfer; rosetta_guest_base /
      * va_base / size pin the segments at the same primary-buffer location so
      * the non-identity page-table mapping remains coherent across the fork.
      */
-    uint32_t is_rosetta;
-    uint32_t _rosetta_pad;
+    bool is_rosetta;
     uint64_t rosetta_guest_base;
     uint64_t rosetta_va_base;
     uint64_t rosetta_size;

src/runtime/forkipc.c

@@ -37,6 +37,7 @@
 #include "runtime/futex.h"
 
 #include "syscall/abi.h"
+#include "syscall/chown-overlay.h"
 #include "syscall/internal.h"
 #include "syscall/mem.h"
 #include "syscall/net.h"  /* absock namespace IPC state */
@@ -89,8 +90,8 @@ int fork_child_main(int ipc_fd,
     proc_init();
     fork_child_vfork_notify_fd = vfork_notify_fd;
 
-    /* The header fixes the IPC protocol version and the guest identity before
-     * any variable-length state is trusted.
+    /* The header magic identifies the fork IPC protocol before any
+     * variable-length state is trusted.
      */
     ipc_header_t hdr;
     if (fork_ipc_read_all(ipc_fd, &hdr, sizeof(hdr)) < 0) {
@@ -101,14 +102,6 @@ int fork_child_main(int ipc_fd,
         log_error("fork-child: bad magic 0x%x", hdr.magic);
         return 1;
     }
-    if (hdr.version != IPC_VERSION) {
-        log_error(
-            "fork-child: IPC version mismatch "
-            "(got %u, expected %u)",
-            hdr.version, IPC_VERSION);
-        return 1;
-    }
-
     log_debug("fork-child: pid=%lld ppid=%lld", (long long) hdr.child_pid,
               (long long) hdr.parent_pid);
 
@@ -228,7 +221,7 @@ int fork_child_main(int ipc_fd,
      * primary buffer and is copied by the region transfer below, so the child
      * can reuse it without rebuilding the tree.
      */
-    g.is_rosetta = (hdr.is_rosetta != 0);
+    g.is_rosetta = hdr.is_rosetta;
     proc_set_rosetta_active(g.is_rosetta);
     g.rosetta_guest_base = hdr.rosetta_guest_base;
     g.rosetta_va_base = hdr.rosetta_va_base;
@@ -275,6 +268,12 @@ int fork_child_main(int ipc_fd,
         return 1;
     }
 
+    if (chown_overlay_recv(ipc_fd) < 0) {
+        log_error("fork-child: failed to receive chown overlay");
+        guest_destroy(&g);
+        return 1;
+    }
+
     /* POSIX: "Signals pending to the parent shall not be pending to the child."
      * Clear pending bitmask and RT queue before applying state.
      * signal_set_state() is deferred until after thread_register_main() so that
@@ -1494,9 +1493,8 @@ int64_t sys_clone(hv_vcpu_t vcpu,
     /* Header */
     ipc_header_t hdr = {
         .magic = IPC_MAGIC_HEADER,
-        .version = IPC_VERSION,
         .ipa_bits = g->ipa_bits,
-        .has_shm = (uint32_t) use_shm,
+        .has_shm = use_shm,
         .child_pid = child_guest_pid,
         .parent_pid = proc_get_pid(),
         .guest_size = g->guest_size,
@@ -1521,7 +1519,7 @@ int64_t sys_clone(hv_vcpu_t vcpu,
         .absock_namespace_id = absock_get_namespace_id(),
         .sid = proc_get_sid(),
         .pgid = proc_get_pgid(),
-        .is_rosetta = g->is_rosetta ? 1 : 0,
+        .is_rosetta = g->is_rosetta,
         .rosetta_guest_base = g->rosetta_guest_base,
         .rosetta_va_base = g->rosetta_va_base,
         .rosetta_size = g->rosetta_size,
@@ -1621,6 +1619,11 @@ int64_t sys_clone(hv_vcpu_t vcpu,
         goto fail_snapshot;
     }
 
+    if (chown_overlay_send(ipc_sock) < 0) {
+        log_error("clone: failed to send chown overlay");
+        goto fail_snapshot;
+    }
+
     /* The process-state payload includes the SCM_RIGHTS handoff for region
      * backing fds. Keep siblings quiesced until that send completes so a
      * concurrent munmap/remap cannot close or recycle the captured fd numbers.