actiondfs: harden staged permissions and simplify backing paths - #27
Merged
Conversation
dzbarsky
added a commit
that referenced
this pull request
Aug 2, 2026
Follow merged #27 with 14 independently reviewable actiondfs optimization and security commits. Reduce actiondfs work by acquiring 472,190 input backing files through RCU, avoiding approximately 75,358 exclusive staged-directory locks, resolving CAS blobs directly without 13,489 temporary PATH_MAX allocations (about 52.7 MiB), deferring directory iterator allocation and merged-directory metadata, transferring owned backing dentries, reusing complete slab buckets, initializing invariant inode flags, inheriting safe backing-filesystem security flags, and avoiding locks before inode publication. Contain the working directory immediately after chroot and drop privileges before resolving untrusted Command.working_directory, preventing /proc/self/cwd and /proc/1/root escapes that could access concurrent actions or shared CAS contents. Copy mount-idmapped backing UID/GID to staged synthetic inodes. A direct REAPI VM regression exercises both attack variants and confirms a normal staged working directory remains writable; additional VM assertions validate root, directory, and file ownership. Validation: all 66 supported ARM64/x86 Bazel build targets and repository tests; standalone timing-parser test; production and instrumented macOS Virtualization.framework VM suites; fresh LLVM VM smoke with 2,017 warmup and 2,106 measured actions; all five GitHub Actions checks passed. Matched CI LLVM comparisons each executed exactly 1,998 actions: Linux actiond 308.045s / native 311.801s = 0.988x versus current main 0.982x; Windows actiond 365.289s / native 380.077s = 0.961x versus current main 1.008x. The Linux delta is 0.66%; Windows improves 4.64%. Both VM timing reports are refreshed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Continue merged #26 with 30 separately reviewable actiondfs commits.
Prevent unprivileged staged operations from triggering the Linux notify_change BUG on privilege removal; serialize staged writes and copy_file_range, preserve and correctly clear setuid/setgid bits, honor backing mount idmaps, reject malformed protobuf keys, and sanitize forwarded ATTR_OPEN. Simplify staged dentry publication, inode classification and ownership, CAS and staged path references, cached-child allocation, generation locking, and protobuf fixed-width decoding. The actiondfs implementation removes 28 net lines and adds focused VM regressions for non-root privileged-file creation, truncation, copy_file_range, and O_TRUNC.
Validation: all 66 supported cross-architecture Bazel build targets and repository tests; standalone timing-parser test; production and instrumented macOS Virtualization.framework VM suites; fresh LLVM VM smoke with 2,017 warmup and 2,106 measured actions; all five GitHub Actions checks passed. Matched 1,998-action CI benchmarks: Linux actiond 304.743s / native 313.029s = 0.974x versus main 1.055x; Windows actiond 348.083s / native 373.566s = 0.932x versus main 1.005x. Both VM timing reports are refreshed.