container2wasm icon indicating copy to clipboard operation
container2wasm copied to clipboard

Support chmod/chown

Open gregnr opened this issue 11 months ago • 1 comments

Hey 👋 this might not be possible with the current state of wasip1, but wanted to start a discussion to confirm and see what options are available. Right now if I try to chmod/chown a pre-opened directory from within the VM (mounted via 9p under the hood), I get a:

chmod: /var/lib/postgresql/data: Protocol error
chown: /var/lib/postgresql/data: Protocol error

(I'm trying to run a postgres c2w image and mount the data directory - postgres tries to change permissions and ownership on it and fails)

I noticed in your Bochs fork, chown is marked as not supported with a todo note: https://github.com/bochs-emu/Bochs/blob/a88d1f687ec83ff82b5318f59dcecb8dab44fc83/bochs/wasm.cc#L1028-L1033

AFAICT, there is no file ownership API available in wasip1, but I would love to be wrong. I'm aware of:

  • fd_fdstat_set_flags
  • fd_fdstat_set_rights
  • fd_filestat_set_size
  • fd_filestat_set_times

I'm not 100% sure if any of these are appropriate for ownership logic (fd_fdstat_set_rights?)

Can you see a path to make this work? Ultimately I don't actually care about file ownership, but some programs like Postgres seem to need it.


Edit 1:

Alternatively, we could maybe add an option during init to specify a custom uid/gid (eg. uid=postgres,gid=postgres) when mounting the 9p fs. I don't have a complete understanding of how the 9p FS is mounted though and if this has any unintended consequences.


Edit 2:

Just tried the above by modifying syscall.Mount() in cmd/init/main.go with a hardcoded uid=1000,gid=1000 but for some reason this didn't change anything (all directories were still mounted as root). I must be doing something wrong.

gregnr avatar Feb 27 '25 20:02 gregnr

Thanks for the suggestion. I think we need to emulate the ownership operations in Bochs. An easier solution might be using a filesystem that enables mapping ownership inside the guest (e.g. bindfs)

ktock avatar Mar 06 '25 04:03 ktock