mirab 0.0.0-stage → 0.2.0

package/src/isolation/firecracker.ts

@@ -0,0 +1,414 @@
+// Linux backend: one Firecracker microVM per job.
+// Rootfs is shared and read-only; the job work directory is packed into a
+// per-VM ext4 image attached as a second drive, so the base image is never
+// written and nothing of the host is visible to the guest.
+import { rmSync } from 'node:fs'
+import { spawn, execFileSync, type ChildProcess } from 'node:child_process'
+import {
+  createConnection,
+  createServer,
+  type Server,
+  type Socket,
+} from 'node:net'
+import { tmpdir } from 'node:os'
+import {
+  mkdir,
+  mkdtemp,
+  open as openFile,
+  rm,
+  truncate,
+  readFile,
+  rename,
+  stat,
+} from 'node:fs/promises'
+import { existsSync, accessSync, constants } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { bootNetArgs, networkState, planNetwork } from './network'
+import {
+  checkGuestProtocol,
+  guestExec,
+  guestFiles,
+  guestPing,
+  guestPty,
+  readOneMessage,
+  guestPut,
+  GuestProtocolError,
+  type Channel,
+  type Isolation,
+  type Opener,
+} from './session'
+
+export interface FirecrackerConfig {
+  firecracker: string
+  kernel: string
+  /** Read-only base image containing mirab-guest-agent and /init-mirab.sh. */
+  rootfs: string
+  memoryMiB: number
+  vcpus: number
+  /** Guest vsock port the agent listens on. */
+  port: number
+  /** `block` = no network device; `allow` = tap or refuse; `auto` = tap when set up, else none. */
+  egress: 'auto' | 'block' | 'allow'
+}
+
+export const GUEST_WORK = '/workspace'
+
+/**
+ * The Firecracker to run when isolation.json names none: the one shipped next
+ * to the mirab executable (where mirab's packaging will put it), else
+ * `firecracker` on PATH. `vm.firecracker` in isolation.json wins over both.
+ */
+export function defaultFirecracker(execPath = process.execPath) {
+  const bundled = join(dirname(execPath), 'firecracker')
+  try {
+    accessSync(bundled, constants.X_OK)
+    return bundled
+  } catch {
+    return 'firecracker'
+  }
+}
+
+/** /dev/kvm, Firecracker and mke2fs: what this host needs besides the guest image. */
+export function firecrackerHostReady(firecracker: string) {
+  try {
+    accessSync('/dev/kvm', constants.R_OK | constants.W_OK)
+    execFileSync(firecracker, ['--version'], { stdio: 'ignore' })
+    execFileSync('mke2fs', ['-V'], { stdio: 'ignore' })
+    return true
+  } catch {
+    return false
+  }
+}
+
+export function firecrackerAvailable(
+  c: Pick<FirecrackerConfig, 'firecracker' | 'kernel' | 'rootfs'>,
+) {
+  try {
+    accessSync(c.kernel, constants.R_OK)
+    accessSync(c.rootfs, constants.R_OK)
+  } catch {
+    return false
+  }
+  return firecrackerHostReady(c.firecracker)
+}
+
+// Minimal HTTP/1.1 over the API unix socket (Bun's node:http lacks socketPath).
+function api(socket: string, method: string, path: string, body: unknown) {
+  return new Promise<void>((resolve, reject) => {
+    const data = JSON.stringify(body)
+    const sock = createConnection(socket)
+    let text = ''
+    sock.on('error', reject)
+    sock.on('connect', () =>
+      sock.write(
+        `${method} ${path} HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\nContent-Type: application/json\r\nContent-Length: ${Buffer.byteLength(data)}\r\n\r\n${data}`,
+      ),
+    )
+    let done = false
+    const finish = () => {
+      if (done) return
+      done = true
+      sock.destroy()
+      const status = Number(/^HTTP\/1\.1 (\d+)/.exec(text)?.[1] ?? 500)
+      if (status < 300) resolve()
+      else
+        reject(
+          new Error(`firecracker ${method} ${path}: ${text.slice(0, 300)}`),
+        )
+    }
+    // Firecracker answers 204 without closing: the header block is the reply.
+    sock.on('data', (c) => {
+      text += c
+      if (text.includes('\r\n\r\n')) finish()
+    })
+    sock.on('close', finish)
+  })
+}
+
+const wait = (ms: number) => new Promise((r) => setTimeout(r, ms))
+
+export function vsockChannel(uds: string, port: number): Promise<Channel> {
+  return new Promise((resolve, reject) => {
+    const sock: Socket = createConnection(uds)
+    let head = Buffer.alloc(0),
+      ready = false,
+      dataCb: (c: Buffer) => void = () => {},
+      closeCb: (e?: Error) => void = () => {}
+    const channel: Channel = {
+      write: (d) => void sock.write(d),
+      onData: (cb) => (dataCb = cb),
+      onClose: (cb) => (closeCb = cb),
+      close: () => sock.destroy(),
+    }
+    sock.on('error', (e) => (ready ? closeCb(e) : reject(e)))
+    sock.on('close', () =>
+      ready ? closeCb() : reject(new Error('vsock closed')),
+    )
+    sock.on('connect', () => sock.write(`CONNECT ${port}\n`))
+    sock.on('data', (chunk) => {
+      if (ready) return dataCb(chunk)
+      head = Buffer.concat([head, chunk])
+      const nl = head.indexOf('\n')
+      if (nl < 0) return
+      if (!head.subarray(0, nl).toString().startsWith('OK'))
+        return reject(new Error('vsock refused: ' + head.subarray(0, nl)))
+      ready = true
+      resolve(channel)
+      const rest = head.subarray(nl + 1)
+      if (rest.length) dataCb(rest)
+    })
+  })
+}
+
+/**
+ * The Isolation members every vsock backend shares (Firecracker, vz): the
+ * work directory (when there is one) appears at /workspace, and guest connections to host port N
+ * arrive on the unix socket `<uds>_N` (Firecracker's convention, which the vz
+ * helper follows too).
+ */
+export function vsockMembers(
+  open: Opener,
+  uds: string,
+  work: string | null,
+  listeners: Server[],
+): Pick<
+  Isolation,
+  | 'guestPath'
+  | 'put'
+  | 'exec'
+  | 'pty'
+  | 'files'
+  | 'onGuestMessage'
+  | 'onGuestConnect'
+> {
+  const toGuest = (p: string) =>
+    work === null
+      ? p
+      : p === work
+        ? GUEST_WORK
+        : p.startsWith(work + '/')
+          ? GUEST_WORK + p.slice(work.length)
+          : p
+  return {
+    guestPath: toGuest,
+    put: (p, content, mode) => guestPut(open, toGuest(p), content, mode),
+    exec: (argv, o) => guestExec(open, argv, o),
+    pty: (request) => guestPty(open, request),
+    files: guestFiles(open),
+    onGuestMessage: (port, handler) => {
+      const server = createServer((c) => {
+        void readOneMessage(c)
+          .then(handler, () => {})
+          .finally(() => c.destroy())
+      })
+      server.listen(`${uds}_${port}`)
+      listeners.push(server)
+    },
+    // The path names this VM: the hypervisor delivers only its guest's
+    // connections there, so whoever serves it knows which VM is calling.
+    onGuestConnect: async (port, serve) => {
+      // A socket left by an earlier VM at this path would refuse the listen.
+      rmSync(`${uds}_${port}`, { force: true })
+      listeners.push(await serve(`${uds}_${port}`))
+    },
+  }
+}
+
+/** What a VM start may add to the backend's config. */
+export interface VmStartOptions {
+  /** Grow this VM's root disk clone to this size before boot (sparse; never
+   *  shrinks). The guest sees a bigger /dev/vda; growing the filesystem on it
+   *  (resize2fs) is the guest's job. */
+  rootGiB?: number
+  /** vz: guest-to-host vsock ports to forward (default GUEST_TO_HOST_PORTS);
+   *  [] for a VM that must not reach the host at all. Firecracker forwards a
+   *  port only when someone serves it (onGuestConnect), so it needs no list. */
+  listen?: number[]
+}
+
+/** Sparse-grows a disk image file to `gib` GiB; refuses to shrink one. */
+export async function growDisk(path: string, gib: number) {
+  const want = gib * 1024 ** 3
+  const have = (await stat(path)).size
+  if (want < have)
+    throw new Error(
+      `rootGiB ${gib} is smaller than the image (${(have / 1024 ** 3).toFixed(1)} GiB); a disk never shrinks`,
+    )
+  if (want > have) await truncate(path, want)
+}
+
+/** Checked bytes, not a signed 32-bit shift: large work images stay positive. */
+export function workImageBytes(usedKiB: number) {
+  if (!Number.isSafeInteger(usedKiB) || usedKiB < 0)
+    throw new Error('invalid workspace disk usage')
+  const sizeMiB = Math.max(256, Math.ceil((usedKiB * 2) / 1024) + 128)
+  const bytes = sizeMiB * 1024 ** 2
+  if (!Number.isSafeInteger(bytes) || bytes > 8 * 1024 ** 3)
+    throw new Error('workspace VM image exceeds the 8 GiB limit')
+  return bytes
+}
+
+export interface BootTimings {
+  imageMs: number
+  bootToAgentMs: number
+}
+
+export async function startFirecracker(
+  cfg: FirecrackerConfig,
+  work: string | null,
+  vmDir: string,
+  log: (line: string) => void = () => {},
+  opts: VmStartOptions = {},
+): Promise<Isolation & { timings: BootTimings; pid: number }> {
+  await mkdir(vmDir, { recursive: true, mode: 0o700 })
+  // Unix socket paths are limited to ~108 bytes, so they live in a short dir.
+  const sockDir = await mkdtemp(join(tmpdir(), 'gf-'))
+  const apiSock = join(sockDir, 'a'),
+    uds = join(sockDir, 'v'),
+    image = join(vmDir, 'work.ext4'),
+    root = join(vmDir, 'rootfs.ext4')
+  const t0 = Date.now()
+  // Pack the checkout into a fresh ext4 image (no root needed). No work
+  // directory (a CI runner): no second drive, nothing of the host's inside.
+  if (work !== null) {
+    const used = Number(
+      execFileSync('du', ['-sk', work], { encoding: 'utf8' }).split(/\s+/)[0],
+    )
+    const sizeBytes = workImageBytes(used)
+    await (await openFile(image, 'w', 0o600)).close()
+    await truncate(image, sizeBytes)
+    execFileSync('mke2fs', ['-q', '-t', 'ext4', '-d', work, '-F', image], {
+      stdio: 'ignore',
+    })
+  }
+  // This VM's own writable copy of the root disk, as on vz: copy-on-write
+  // where the filesystem can (reflink), a sparse copy where it can't.
+  execFileSync('cp', ['--reflink=auto', '--sparse=always', cfg.rootfs, root], {
+    stdio: 'ignore',
+  })
+  if (opts.rootGiB) await growDisk(root, opts.rootGiB)
+  const timings: BootTimings = { imageMs: Date.now() - t0, bootToAgentMs: 0 }
+
+  const plan = planNetwork(
+    cfg.egress,
+    networkState(),
+    join(tmpdir(), `mirab-vm-slots-${process.getuid?.() ?? 0}`),
+  )
+  log(plan.note)
+  const serial = await openFile(join(vmDir, 'serial.log'), 'w', 0o600)
+  const fc: ChildProcess = spawn(cfg.firecracker, ['--api-sock', apiSock], {
+    stdio: ['ignore', serial.fd, serial.fd],
+  })
+  // A VM never outlives mirab when it exits (as vz's helper stops when its
+  // input closes). `mirab dev` and the spawn worker turn SIGINT, SIGTERM and
+  // SIGHUP into an exit, so this runs for them; a signal that kills mirab
+  // outright (SIGKILL, or one nothing handles) skips it.
+  const onExit = () => {
+    try {
+      fc.kill('SIGKILL')
+    } catch {}
+  }
+  process.once('exit', onExit)
+  const listeners: Server[] = []
+  const kill = () => {
+    process.off('exit', onExit)
+    try {
+      fc.kill('SIGKILL')
+    } catch {}
+    plan.release()
+  }
+  try {
+    for (let i = 0; i < 2500 && !existsSync(apiSock); i++) await wait(2)
+    await api(apiSock, 'PUT', '/machine-config', {
+      vcpu_count: cfg.vcpus,
+      mem_size_mib: cfg.memoryMiB,
+      smt: false,
+    })
+    await api(apiSock, 'PUT', '/boot-source', {
+      kernel_image_path: cfg.kernel,
+      // i8042 flags skip a 500 ms keyboard probe; measured 1.2 s -> 0.3 s boot.
+      boot_args:
+        'console=ttyS0 reboot=k panic=1 pci=off init=/init-mirab.sh i8042.noaux i8042.nokbd i8042.nopnp i8042.dumbkbd quiet loglevel=1' +
+        // The host's time, as vz passes it: TLS needs a right clock from the start.
+        ` mirab.time=${Math.floor(Date.now() / 1000)}` +
+        (plan.net ? ' ' + bootNetArgs(plan.net) : ''),
+    })
+    await api(apiSock, 'PUT', '/drives/rootfs', {
+      drive_id: 'rootfs',
+      path_on_host: root,
+      is_root_device: true,
+      is_read_only: false,
+    })
+    if (work !== null)
+      await api(apiSock, 'PUT', '/drives/work', {
+        drive_id: 'work',
+        path_on_host: image,
+        is_root_device: false,
+        is_read_only: false,
+      })
+    await api(apiSock, 'PUT', '/vsock', {
+      vsock_id: 'vsock0',
+      guest_cid: 3,
+      uds_path: uds,
+    })
+    if (plan.net)
+      await api(apiSock, 'PUT', '/network-interfaces/eth0', {
+        iface_id: 'eth0',
+        guest_mac: plan.net.mac,
+        host_dev_name: plan.net.tap,
+      })
+    const t1 = Date.now()
+    await api(apiSock, 'PUT', '/actions', { action_type: 'InstanceStart' })
+    const open: Opener = () => vsockChannel(uds, cfg.port)
+    for (;;) {
+      try {
+        checkGuestProtocol(await guestPing(open), cfg.rootfs)
+        break
+      } catch (e) {
+        if (e instanceof GuestProtocolError) throw e
+        if (Date.now() - t1 > 20_000)
+          throw new Error(
+            'microVM agent did not come up: ' + (e as Error).message,
+          )
+        if (fc.exitCode !== null)
+          throw new Error(
+            'firecracker exited: ' +
+              (await readFile(join(vmDir, 'serial.log'), 'utf8')).slice(-400),
+          )
+        await wait(5)
+      }
+    }
+    timings.bootToAgentMs = Date.now() - t1
+    log(
+      `microVM ready in ${timings.bootToAgentMs} ms (image ${timings.imageMs} ms)`,
+    )
+    return {
+      level: 'vm',
+      backend: 'firecracker',
+      label: 'vm (firecracker)',
+      timings,
+      pid: fc.pid!,
+      ...vsockMembers(open, uds, work, listeners),
+      close: async (options) => {
+        for (const l of listeners) l.close()
+        const exited =
+          fc.exitCode !== null || fc.signalCode !== null
+            ? Promise.resolve()
+            : new Promise<void>((r) => fc.once('exit', () => r()))
+        kill()
+        // Its disk is only taken once Firecracker is gone.
+        await Promise.race([exited, wait(5000)])
+        await serial.close()
+        await rm(sockDir, { recursive: true, force: true })
+        if (options?.keepRoot) await rename(root, options.keepRoot)
+        if (!options?.preserveWorkspace)
+          await rm(vmDir, { recursive: true, force: true })
+      },
+    }
+  } catch (e) {
+    kill()
+    await serial.close().catch(() => {})
+    await rm(sockDir, { recursive: true, force: true })
+    throw e
+  }
+}

package/src/isolation/guest-protocol.json

@@ -0,0 +1 @@
+{ "protocol": 2 }

package/src/isolation/host-user.ts

@@ -0,0 +1,247 @@
+// `host` level: steps run on this machine as a dedicated, unprivileged OS user
+// (the old mirab's `sandbox = "host"`, Layer 1). The owner creates the user once
+// with scripts/host-user-setup.sh (needs root); mirab never runs sudo for setup,
+// it only uses the one sudo rule that script installs: run the guest agent as
+// that user. Same exec contract as a VM or container (`--stdio`), so runner
+// code does not change. What it isolates: the owner's files (home, other
+// checkouts) and, through the per-user firewall rule, the LAN. What it does
+// not: the kernel, other world-readable files, CPU and memory.
+import { execFileSync, spawn } from 'node:child_process'
+import { randomBytes } from 'node:crypto'
+import {
+  chmod,
+  cp,
+  lchown,
+  lstat,
+  readdir,
+  rename,
+  rm,
+  symlink,
+  unlink,
+  writeFile,
+} from 'node:fs/promises'
+import { readFileSync, statSync } from 'node:fs'
+import { userInfo } from 'node:os'
+import { join } from 'node:path'
+import {
+  guestExec,
+  guestPing,
+  guestPty,
+  type Channel,
+  type Isolation,
+  type Opener,
+} from './session'
+
+export const MARKER_DIR = '/etc/mirab/host-users'
+
+/** What scripts/host-user-setup.sh wrote to /etc/mirab/host-users/<user>.json. */
+export interface Marker {
+  version: 1
+  user: string
+  uid: number
+  gid: number
+  owner: string
+  agent: string
+  workRoot: string
+  network?: string
+}
+
+/** Everything detection looks at, so tests can describe any machine. */
+export interface HostProbe {
+  marker(user: string): string | undefined
+  uidOf(user: string): number | undefined
+  me: { uid: number; name: string; groups: number[] }
+  stat(
+    path: string,
+  ): { uid: number; gid: number; mode: number; dir: boolean } | undefined
+}
+
+export const systemProbe = (markerDir = MARKER_DIR): HostProbe => ({
+  marker: (user) => {
+    try {
+      return readFileSync(join(markerDir, `${user}.json`), 'utf8')
+    } catch {
+      return undefined
+    }
+  },
+  uidOf: (user) => {
+    try {
+      return Number(
+        execFileSync('id', ['-u', user], {
+          encoding: 'utf8',
+          stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim(),
+      )
+    } catch {
+      return undefined
+    }
+  },
+  me: {
+    uid: process.getuid?.() ?? -1,
+    name: userInfo().username,
+    groups: process.getgroups?.() ?? [],
+  },
+  stat: (path) => {
+    try {
+      const s = statSync(path)
+      return { uid: s.uid, gid: s.gid, mode: s.mode, dir: s.isDirectory() }
+    } catch {
+      return undefined
+    }
+  },
+})
+
+export type HostUserState =
+  { ok: true; marker: Marker } | { ok: false; reason: string; fix: string }
+
+export const setupCommand = (user: string, owner: string) =>
+  `sudo scripts/host-user-setup.sh ${user} ${owner} --agent <mirab-guest-agent for this OS>`
+
+/** Is the host tier for `user` set up, and set up safely? Never runs sudo. */
+export function hostUserState(user: string, probe: HostProbe): HostUserState {
+  const fix = `Needs Sami: ${setupCommand(user, probe.me.name)}`
+  const no = (reason: string): HostUserState => ({ ok: false, reason, fix })
+  const raw = probe.marker(user)
+  if (!raw) return no(`${user} is not set up (no ${MARKER_DIR}/${user}.json)`)
+  let m: Marker
+  try {
+    m = JSON.parse(raw)
+  } catch {
+    return no(`${MARKER_DIR}/${user}.json is not valid JSON`)
+  }
+  if (m.version !== 1 || m.user !== user)
+    return no(`${MARKER_DIR}/${user}.json does not describe ${user}`)
+  const uid = probe.uidOf(user)
+  if (uid === undefined) return no(`OS user ${user} does not exist`)
+  if (uid !== m.uid)
+    return no(`${user} has uid ${uid}, setup recorded ${m.uid}`)
+  if (uid === 0) return no(`${user} is root`)
+  if (uid === probe.me.uid)
+    return no(`${user} is the runner's own user; that is not isolation`)
+  if (m.owner !== probe.me.name)
+    return no(`${user} was set up for ${m.owner}, not ${probe.me.name}`)
+  if (!probe.me.groups.includes(m.gid))
+    return {
+      ok: false,
+      reason: `${probe.me.name} is not in group ${user} yet`,
+      fix: 'log out and in again (group membership is read at login)',
+    }
+  const agent = probe.stat(m.agent)
+  if (!agent || agent.dir) return no(`agent ${m.agent} is missing`)
+  if (agent.uid !== 0 || agent.mode & 0o022)
+    return no(
+      `agent ${m.agent} must be root-owned and not group/other-writable`,
+    )
+  const work = probe.stat(m.workRoot)
+  if (!work?.dir) return no(`work root ${m.workRoot} is missing`)
+  if (work.gid !== m.gid || (work.mode & 0o070) !== 0o070 || work.mode & 0o007)
+    return no(`work root ${m.workRoot} must be group ${user}, mode 2770`)
+  return { ok: true, marker: m }
+}
+
+/** Give the shared group read/write on everything (the dedicated user is in it, not the owner's other files). */
+async function shareWithGroup(path: string, gid: number) {
+  const st = await lstat(path)
+  // Files the dedicated user made are already shared (setgid dirs, umask 007).
+  if (st.isSymbolicLink() || st.uid !== process.getuid?.()) return
+  if (st.gid !== gid) await lchown(path, -1, gid)
+  if (st.isDirectory()) {
+    await chmod(path, (st.mode & 0o7777) | 0o2070)
+    for (const name of await readdir(path))
+      await shareWithGroup(join(path, name), gid)
+  } else await chmod(path, (st.mode & 0o777) | 0o060 | ((st.mode & 0o100) >> 3))
+}
+
+async function move(from: string, to: string) {
+  try {
+    await rename(from, to)
+  } catch (e) {
+    if ((e as NodeJS.ErrnoException).code !== 'EXDEV') throw e
+    await cp(from, to, { recursive: true, verbatimSymlinks: true })
+    await rm(from, { recursive: true, force: true })
+  }
+}
+
+function stdioChannel(argv: string[]): Channel {
+  const child = spawn(argv[0], argv.slice(1), {
+    stdio: ['pipe', 'pipe', 'pipe'],
+  })
+  let closeCb: (e?: Error) => void = () => {},
+    stderr = ''
+  child.stderr!.on('data', (d) => (stderr = (stderr + d).slice(-2000)))
+  child.on('close', (code) =>
+    closeCb(
+      code && stderr
+        ? new Error(`${argv[0]} exited ${code}: ${stderr.trim()}`)
+        : undefined,
+    ),
+  )
+  child.on('error', (e) => closeCb(e))
+  return {
+    write: (d) => void child.stdin!.write(d),
+    onData: (cb) => child.stdout!.on('data', cb),
+    onClose: (cb) => (closeCb = cb),
+    close: () => {
+      child.stdin!.end()
+      setTimeout(() => child.kill('SIGKILL'), 2000).unref()
+    },
+  }
+}
+
+/**
+ * Stage the job directory under the shared work root, then run the agent as
+ * the dedicated user. `runAs` is the privilege switch: the sudo rule from the
+ * setup script; tests pass [] to exercise the same path as themselves.
+ */
+export async function startHostUser(
+  marker: Marker,
+  work: string,
+  log: (line: string) => void = () => {},
+  runAs: string[] = ['sudo', '-n', '-u', marker.user, '--'],
+): Promise<Isolation> {
+  const staged = join(marker.workRoot, `job-${randomBytes(6).toString('hex')}`)
+  await move(work, staged)
+  // The runner keeps using its own path; the dedicated user sees the staged one.
+  await symlink(staged, work)
+  const restore = async () => {
+    await unlink(work).catch(() => {})
+    await move(staged, work)
+  }
+  try {
+    await shareWithGroup(staged, marker.gid)
+    const open: Opener = async () =>
+      stdioChannel([...runAs, marker.agent, '--stdio', '--shared'])
+    try {
+      await guestPing(open)
+    } catch (e) {
+      throw new Error(
+        `cannot run the agent as ${marker.user}: ${(e as Error).message}. Needs Sami: ${setupCommand(marker.user, marker.owner)}`,
+      )
+    }
+    log(`steps run as OS user ${marker.user} in ${staged}`)
+    const guest = (p: string) =>
+      p === work
+        ? staged
+        : p.startsWith(work + '/')
+          ? staged + p.slice(work.length)
+          : p
+    return {
+      level: 'host',
+      backend: 'os-user',
+      label: `host (OS user ${marker.user})`,
+      guestPath: guest,
+      // The runner's own files (step scripts) are written by the runner and
+      // shared with the group, not by the dedicated user into a runner-owned file.
+      put: async (p, content, mode = 0o600) => {
+        await writeFile(guest(p), content, { mode })
+        await shareWithGroup(guest(p), marker.gid)
+      },
+      exec: (argv, o) => guestExec(open, argv, o),
+      pty: (request) => guestPty(open, request),
+      close: restore,
+    }
+  } catch (e) {
+    await restore()
+    throw e
+  }
+}