Running at rev 8803834036205cf2cac5cfca98bb3875812c897a.
OwnershipFixer::fix_if_needed (src/guest/src/storage/perms.rs:17-90) stats the mount root, samples read_dir(...).take(5), and on any uid/gid mismatch shells out to chown -R <uid>:<gid> over the whole path.
Consequence: a box whose guest state is deliberately owned by a non-root user comes back from a wake with everything owned by root. Content and modes survive, so it presents as a permission error much later rather than at boot. Which way it goes is decided by ext4 readdir order over the first five entries, so it is per-box deterministic but looks intermittent across boxes.
We compensate by re-asserting ownership after every start(), but a boot-time pass that rewrites ownership across a whole rootfs based on a five-entry sample seems worth revisiting: the sample can disagree with the tree it is used to "fix".
Running at rev
8803834036205cf2cac5cfca98bb3875812c897a.OwnershipFixer::fix_if_needed(src/guest/src/storage/perms.rs:17-90) stats the mount root, samplesread_dir(...).take(5), and on any uid/gid mismatch shells out tochown -R <uid>:<gid>over the whole path.Consequence: a box whose guest state is deliberately owned by a non-root user comes back from a wake with everything owned by root. Content and modes survive, so it presents as a permission error much later rather than at boot. Which way it goes is decided by ext4 readdir order over the first five entries, so it is per-box deterministic but looks intermittent across boxes.
We compensate by re-asserting ownership after every
start(), but a boot-time pass that rewrites ownership across a whole rootfs based on a five-entry sample seems worth revisiting: the sample can disagree with the tree it is used to "fix".