Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Keep OpenVMM's report and console files readable under a restrictive umask

Open
  • Is something wrong?
#651 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
62/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
rust
Domain
backend

Research direction

Start with openvmm/openvmm/openvmm_entry/src/microvm/report.rs and openvmm/openvmm/openvmm_entry/src/serial_io.rs to trace how the report and captured console files are created. Compare the two listed options and check how #628 handles file modes; done means both files remain readable by their owner under a restrictive umask without unintentionally changing console permissions under the common umask 022.

Written by the indexing model from the issue text.

Description

Summary

An OpenVMM that nvx::host::process::launch spawns inherits the caller's umask. OpenVMM does not set the modes of the files it creates for the caller again, so under a umask that clears the owner's own read permission (for example 0400), the owner cannot read them:

  • The microVM report (openvmm/openvmm/openvmm_entry/src/microvm/report.rs) is staged in a tempfile created with mode 0600 and published without a chmod, so umask 0400 publishes it with mode 0200.
  • A console captured to a file (file_serial in openvmm/openvmm/openvmm_entry/src/serial_io.rs) is opened with create(true) (mode 0666), so umask 0400 leaves it at 0266.

The sandbox store already sets the modes of its own files again (#628), so its records stay usable under such a umask; this issue covers only the files that OpenVMM writes.

Options

  1. In nvx-rs, set a fixed umask such as 0o077 in the child's existing pre_exec hook (nvx-rs/src/host/sys/process.rs, detach). This also changes a console file from 0644 to 0600 under the common umask 022.
  2. In OpenVMM, set the intended mode of the report and the console file explicitly after creating them.

Notes

A umask that clears the owner's own permissions is unusual. This was found in the final review of #628 and deferred there as out of scope.

Dominant language
Python
Stars
408
Forks
28
Avg merge
15h 15m
Merged PRs (30d)
322

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/nvx

All issues in microsoft/nvx

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.