Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Test the managed agent's direct-mode launch without privileges

Open
  • Is something wrong?
#601 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@esaurez is already working on this.

Since Oct 20, 2026.

  • #629 by @esaurez — open

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
linux, python, rust
Domain
backend, security, testing

Research direction

Start with the dispatch and spawn paths in nvx-rs/src/guest/managed_agent/seam.rs and nvx-rs/src/guest/sys/spawn.rs, then review the existing cases in git show 8142d4e54~1:scripts/test_nvx_tools.py. The issue calls for a fork-safe identity-call seam, a setpriv shim, a real spawn path, and a pseudo-terminal helper in nvx-rs/tests/guest_tools.rs. Done means the listed working-directory, identity, PWD, and sandbox STOP cases run without root privileges.

Written by the indexing model from the issue text.

Description

Follow-up to #561, part of #358.

#561 deletes scripts/test_managed_agent.py and the C-backed managed-agent classes of scripts/test_nvx_tools.py, and ports their cases to nvx-rs. The remaining cases need the real direct-mode launch, which no unprivileged test can run today:

  • TestSystem::spawn in nvx-rs/src/guest/managed_agent/seam.rs returns ENOSYS, so the dispatch tests stop before a workload starts.
  • The child's setgroups, setegid, seteuid, and chdir calls in nvx-rs/src/guest/sys/spawn.rs run after fork and bypass the System seam, so a non-root test fails at setgroups before it reaches the directory check.

The C harnesses stubbed those calls at link time and ran a setpriv shim. These cases remain to port, from ManagedAgentWorkingDirectoryTests and ManagedAgentStopTests (git show 8142d4e54~1:scripts/test_nvx_tools.py):

  • Working-directory refusals. A missing directory (ENOENT), a regular file (ENOTDIR), and a directory that the workload cannot search (EACCES) each print nvx-managed-agent: cannot enter working directory DIR: STRERROR on the workload's stderr, then answer APP_ERROR(errno, "cwd-failed"), and run nothing. This is the guest side of FEATURE_EXEC_CWD.
  • Identity failure. A setgroups failure answers APP_ERROR(125, "launch-failed") and runs nothing.
  • Checked directory. A symbolic link retargeted, or a directory renamed, between the check and the exec still starts the workload in the directory that was checked.
  • End-to-end PWD. The default working directory is /; a requested directory sets both the physical directory and PWD; a symbolic link keeps its name in PWD, while link/. gives the physical path; an exact environment controls PWD; a layered environment keeps the agent's PWD.
  • Sandbox stop. In sandbox mode, STOP answers STOPPED, and the agent process then exits 0.

What is needed:

  1. A fork-safe, test-only way to make the identity calls in spawn.rs succeed or fail without privileges, as the C harness's link-time stubs did.
  2. A setpriv shim through Paths.setpriv that can change the file system between the directory check and the exec.
  3. A scripted or real spawn path in the dispatch test harness.
  4. A pseudo-terminal helper in nvx-rs/tests/guest_tools.rs that drives a real agent through RESET and STOP, then reaps it.

Running these tests as root in CI would avoid (1) for the success paths, but unprivileged developers would then skip them.

Dominant language
Python
Stars
408
Forks
28
Avg merge
15h 20m
Merged PRs (30d)
301

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/nvx

All issues in microsoft/nvx

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.