erix/posixd
Watch
1
0
Fork
You've already forked posixd
 0
generated from erix/meta
Code Issues 5 Pull requests 1 Projects Releases Packages Wiki Activity Actions

[FEATURE] Implement POSIX file descriptors and namespace semantics within delegated roots #2

New issue
Open
opened 2026-09-12 07:56:26 +02:00 by erikinkinen · 0 comments
erikinkinen commented 2026-09-12 07:56:26 +02:00
Owner
Copy link

Problem and motivation

Cargo, compilers and build scripts require shared open-file descriptions, atomic filesystem operations, locking and race-free readiness. Native pathname and held-directory behavior must be reconciled with these semantics without weakening object identity.

Proposed behavior and scope

Implement fd allocation/duplication, short and positioned I/O, pipes, directory/status operations, link/rename/truncate/durability, scoped temporary files, locks, readiness and only manifest-required local sockets. Exercise parallel build-style workloads and resource exhaustion.

This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is Phase 6 and AC1–AC24.

Authority, security and reliability

Resolve each operation within delegated roots and exact-entry rights. Preserve native admission before deny-only modes/ACLs, retire descriptor aliases and wake only affected waiters, and reject cross-realm traversal or stale object reuse. Network or device names cannot grant network/device access.

Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel.

Acceptance criteria

  • Implement per-process fd tables distinct from shared open-file descriptions; record
    rights, offset, status flags, inheritance and alias count.
  • Implement open/openat/close and dup/dup2/fcntl duplication with atomic replacement,
    lowest-free allocation and complete transfer cleanup.
  • Implement read/write/pread/pwrite/readv/writev and lseek as required, covering
    zero/short I/O, shared offsets, append atomicity, EINTR and nonblocking.
  • Implement pipe endpoints, EOF/hangup/broken-pipe semantics and bounded buffering;
    descriptor closure must wake exactly the affected waiters.
  • Implement stat/fstat/lstat/fstatat, readdir and seekable directory iteration with
    stable identity, correct dot entries, mode/size/link counts and source-qualified
    ctime/mtime/atime behavior.
  • Implement mkdir/rmdir/unlink/link/symlink/readlink/rename variants required by the
    workload, with exact-entry authority and atomic visibility; cross-filesystem operations fail
    deterministically without partial mutation.
  • Resolve the existing held-directory pin restrictions against POSIX cwd/open-object
    rename/unlink expectations; implement safe object lifetime and namespace detachment without
    reverting to path-based reopening or stale grants.
  • Implement truncate/ftruncate, sparse growth, fsync/fdatasync and durability
    contracts; test concurrent access, ENOSPC and interrupted failure.
  • Implement required mode/umask/ownership/access/ACL semantics with an explicit
    trusted metadata source. ACL byte preservation alone is not permission enforcement;
    unsupported provider behavior must be explicit.
  • Implement mkstemp/temp-directory and atomic output replacement semantics within
    delegated tmp/output trees; no host /tmp or ambient search.
  • Implement required advisory locks with process/open-description lifetime,
    contention, cancellation and crash cleanup for Cargo/Git/build tools.
  • Implement poll/select readiness, timeout and cancellation using race-free event
    registration rather than periodic busy loops or fake timeouts.
  • Provide only manifest-required local socket/socketpair semantics through bounded
    endpoints. Network sockets remain unavailable without later networking authority; device-node
    names alone grant no device access.
  • Test symlink/parent traversal, rename races, fd/PID reuse, shared offsets,
    directory lifetime, revoked handles and mutation outside scope.
  • Add multi-process build-style filesystem VMs for parallel files, atomic rename,
    locks, large trees, long paths and explicit resource exhaustion.

For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates.

Alternatives and tradeoffs

Reopening by path or loosening provider pins can substitute an object after authorization. Preserve open-object identity and specify namespace detachment and rollback explicitly, with unsupported provider behavior reported as an error.

Tracking and rollout

Dependencies: lib-posixabi#1, posixd#1

Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use feature/posix-compat, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection.

Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.

## Problem and motivation Cargo, compilers and build scripts require shared open-file descriptions, atomic filesystem operations, locking and race-free readiness. Native pathname and held-directory behavior must be reconciled with these semantics without weakening object identity. ## Proposed behavior and scope Implement fd allocation/duplication, short and positioned I/O, pipes, directory/status operations, link/rename/truncate/durability, scoped temporary files, locks, readiness and only manifest-required local sockets. Exercise parallel build-style workloads and resource exhaustion. This issue records planned work; its unchecked criteria are not implementation proof. The normative basis is [Phase 6 and AC1–AC24](https://git.erikinkinen.fi/erix/docs/src/branch/main/phases/6.md). ## Authority, security and reliability Resolve each operation within delegated roots and exact-entry rights. Preserve native admission before deny-only modes/ACLs, retire descriptor aliases and wake only affected waiters, and reject cross-realm traversal or stale object reuse. Network or device names cannot grant network/device access. Apply the priority order: security, reliability, then performance. Keep suspected vulnerabilities in the repository’s restricted SECURITY.md reporting channel. ## Acceptance criteria - [ ] Implement per-process fd tables distinct from shared open-file descriptions; record rights, offset, status flags, inheritance and alias count. - [ ] Implement open/openat/close and dup/dup2/fcntl duplication with atomic replacement, lowest-free allocation and complete transfer cleanup. - [ ] Implement read/write/pread/pwrite/readv/writev and lseek as required, covering zero/short I/O, shared offsets, append atomicity, EINTR and nonblocking. - [ ] Implement pipe endpoints, EOF/hangup/broken-pipe semantics and bounded buffering; descriptor closure must wake exactly the affected waiters. - [ ] Implement stat/fstat/lstat/fstatat, readdir and seekable directory iteration with stable identity, correct dot entries, mode/size/link counts and source-qualified ctime/mtime/atime behavior. - [ ] Implement mkdir/rmdir/unlink/link/symlink/readlink/rename variants required by the workload, with exact-entry authority and atomic visibility; cross-filesystem operations fail deterministically without partial mutation. - [ ] Resolve the existing held-directory pin restrictions against POSIX cwd/open-object rename/unlink expectations; implement safe object lifetime and namespace detachment without reverting to path-based reopening or stale grants. - [ ] Implement truncate/ftruncate, sparse growth, fsync/fdatasync and durability contracts; test concurrent access, ENOSPC and interrupted failure. - [ ] Implement required mode/umask/ownership/access/ACL semantics with an explicit trusted metadata source. ACL byte preservation alone is not permission enforcement; unsupported provider behavior must be explicit. - [ ] Implement mkstemp/temp-directory and atomic output replacement semantics within delegated tmp/output trees; no host `/tmp` or ambient search. - [ ] Implement required advisory locks with process/open-description lifetime, contention, cancellation and crash cleanup for Cargo/Git/build tools. - [ ] Implement poll/select readiness, timeout and cancellation using race-free event registration rather than periodic busy loops or fake timeouts. - [ ] Provide only manifest-required local socket/socketpair semantics through bounded endpoints. Network sockets remain unavailable without later networking authority; device-node names alone grant no device access. - [ ] Test symlink/parent traversal, rename races, fd/PID reuse, shared offsets, directory lifetime, revoked handles and mutation outside scope. - [ ] Add multi-process build-style filesystem VMs for parallel files, atomic rename, locks, large trees, long paths and explicit resource exhaustion. For each implementation slice, retain actual formatting, strict Clippy, unit/doctest and warning-denied build results for all altered Rust repositories and valid configurations. Add relevant runtime VM coverage, monitor older unit/VM regressions in exact-head CI, and update canonical component documents and affected technical-manual/API material. Every authored code file must remain below 1,000 physical lines, with meaningful inline documentation and missing_docs enforcement in Rust crates. ## Alternatives and tradeoffs Reopening by path or loosening provider pins can substitute an object after authorization. Preserve open-object identity and specify namespace detachment and rollback explicitly, with unsupported provider behavior reported as an error. ## Tracking and rollout Dependencies: [lib-posixabi#1](https://git.erikinkinen.fi/erix/lib-posixabi/issues/1), [posixd#1](https://git.erikinkinen.fi/erix/posixd/issues/1) Dependencies identify required contracts and closure gates; preparatory inventory/design can proceed in parallel under one owner per edited file. Link bounded implementation issues and their PRs here before claiming acceptance. Use `feature/posix-compat`, regular signed commits in the canonical contribution format, and WIP PRs linked to the exact coherent component graph. All cross-repository Cargo/catalog selections and CI helpers use full 40-character lowercase commit hashes, including transitive dependencies; do not substitute branch, tag or implicit HEAD selection. Close criteria only with their own reviewed deliverables and validation evidence. Pending, skipped, cancelled, failed or predecessor-only results remain distinct. Keep main images unchanged until explicit promotion direction; technical completion does not authorize merges, release tags or publication.
erikinkinen changed title from [FEATURE] [P07] Implement POSIX file descriptors and namespace semantics within delegated roots to [FEATURE] Implement POSIX file descriptors and namespace semantics within delegated roots 2026-09-12 08:02:05 +02:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feature/posix-compat
No results found.
Labels
Clear labels
  
bug
Something is not working

  
ci

   
docs

   
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
performance
Measured performance profiling, bottleneck analysis, and regression budgets.

  
phase-6
Phase 6: POSIX compatibility, full EriX self-hosting, and its required audits and validation.

  
question
More information is needed

  
refactor
Code cleanup, removal of obsolete paths, and structural improvements preserving behavior.

  
security

   
wontfix
This won't be fixed

No labels
bug
ci
docs
duplicate
enhancement
help wanted
invalid
performance
phase-6
question
refactor
security
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
erix/posixd#2
No description provided.