Make mounted GPU libraries accessible to non-root users (#40690)
* Save state * Save state * Prepare for PR * Format * Cleanup diff * Apply PR feedback * Apply PR feedback * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Cleanup diff * Revert "Potential fix for pull request finding" This reverts commit 2ffa39c4e9985b72e567531bbbf5ee96f26e986c. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Restore test --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Blue committed
Jun 5, 2026 at 12:38 UTC
fcfdbeb7a9e73d77650fadd79d11434547bb5c0e
2 files changed
+26
-2
src/linux/init/WSLCInit.cpp
+13
-2
@@ -652,8 +652,19 @@ void HandleMessageImpl(
652
// Chroot without OverlayFs is not supported — the chroot logic depends on the overlay target path.
653
THROW_ERRNO_IF(EINVAL, WI_IsFlagSet(Message.Flags, WSLC_MOUNT::Chroot) && !WI_IsFlagSet(Message.Flags, WSLC_MOUNT::OverlayFs));
654
655
- THROW_LAST_ERROR_IF(
656
- UtilMount(source, target, readField(Message.TypeIndex), options.MountFlags, options.StringOptions.c_str(), c_defaultRetryTimeout) < 0);
655
+ auto type = readField(Message.TypeIndex);
656
+ THROW_LAST_ERROR_IF(UtilMount(source, target, type, options.MountFlags, options.StringOptions.c_str(), c_defaultRetryTimeout) < 0);
657
+
658
+ // Workaround for a Linux bug where virtiofs permissions aren't properly propagated when an overlay is mounted on top of a virtiofs share before the permissions have been fetched.
659
+ // TODO: Remove once fixed upstream.
660
+ if (wsl::shared::string::IsEqual(type, VIRTIO_FS_TYPE))
661
+ {
662
+ struct stat targetStat{};
663
+ if (stat(target, &targetStat) < 0)
664
+ {
665
+ LOG_ERROR("stat({}) after virtiofs mount failed {}", target, errno);
666
+ }
667
+ }
668
669
std::optional<std::string> overlayTarget;
670
if (WI_IsFlagSet(Message.Flags, WSLC_MOUNT::OverlayFs))
test/windows/WSLCTests.cpp
+13
@@ -3423,6 +3423,19 @@ class WSLCTests
3423
3424
ValidateContainerOutput(container, {{1, ""}}, 1);
3425
}
3426
+
3427
+ // Validate that the directories are readable by non-root users.
3428
+ {
3429
+ WSLCContainerLauncher launcher(
3430
+ "debian:latest", "test-container-gpu-nobody", {"/bin/ls", "/usr/lib/wsl/lib", "/usr/lib/wsl/drivers"});
3431
+
3432
+ launcher.SetContainerFlags(WSLCContainerFlagsGpu);
3433
+ launcher.SetUser("nobody");
3434
+
3435
+ auto container = launcher.Launch(*session);
3436
+
3437
+ ValidateContainerOutput(container, {}, 0);
3438
+ }
3439
}
3440
3441
WSLC_TEST_METHOD(Modules)