update docs

rust/fds-cartridged/src/consumers.rs

@@ -69,11 +69,36 @@ pub fn start(
 ) -> Result<Child> {
     start_group(&format!("bay{bay}"), arguments, working, environment)
 }
+pub fn foreground(
+    bay: Bay,
+    arguments: &[String],
+    working: &str,
+    environment: &[(String, String)],
+    descriptors: [OwnedFd; 3],
+    terminal: bool,
+) -> Result<Child> {
+    spawn(
+        &format!("bay{bay}"),
+        arguments,
+        working,
+        environment,
+        Some((descriptors, terminal)),
+    )
+}
 pub fn start_group(
     name: &str,
     arguments: &[String],
     working: &str,
     environment: &[(String, String)],
+) -> Result<Child> {
+    spawn(name, arguments, working, environment, None)
+}
+fn spawn(
+    name: &str,
+    arguments: &[String],
+    working: &str,
+    environment: &[(String, String)],
+    io: Option<([OwnedFd; 3], bool)>,
 ) -> Result<Child> {
     if !fds_common::manifest::identifier(name) {
         return Err(Error("Invalid process group".into()));
@@ -95,11 +120,11 @@ pub fn start_group(
         .custom_flags(libc::O_CLOEXEC)
         .open(path.join("cgroup.procs"))?;
     let mut command = Command::new(&arguments[0]);
+    let working = c(working)?;
     command
         .args(&arguments[1..])
-        .current_dir(working)
         .env_clear()
-        .env("PATH", "/usr/bin:/bin")
+        .env("PATH", "/usr/bin:/bin:/run/fds/bin")
         .env("HOME", "/home/fds")
         .env("USER", "fds")
         .env("LOGNAME", "fds")
@@ -109,6 +134,14 @@ pub fn start_group(
         .stdout(Stdio::inherit())
         .stderr(Stdio::inherit());
     command.envs(environment.iter().cloned());
+    let mut terminal = false;
+    if let Some(([input, output, errors], tty)) = io {
+        command
+            .stdin(Stdio::from(input))
+            .stdout(Stdio::from(output))
+            .stderr(Stdio::from(errors));
+        terminal = tty;
+    }
     // Only async-signal-safe syscalls are used in the forked child. Writing 0
     // moves the child itself, avoiding PID reuse and parent/child migration races.
     unsafe {
@@ -119,6 +152,9 @@ pub fn start_group(
             if libc::setsid() < 0 {
                 return Err(io::Error::last_os_error());
             }
+            if terminal && libc::ioctl(0, libc::TIOCSCTTY, 0) < 0 {
+                return Err(io::Error::last_os_error());
+            }
             if libc::setgroups(0, std::ptr::null()) < 0
                 || libc::setgid(1000) < 0
                 || libc::setuid(1000) < 0
@@ -128,6 +164,10 @@ pub fn start_group(
             if libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0 {
                 return Err(io::Error::last_os_error());
             }
+            // Resolve client-selected working directories only as the user.
+            if libc::chdir(working.as_ptr()) < 0 {
+                return Err(io::Error::last_os_error());
+            }
             let mut mask: libc::sigset_t = std::mem::zeroed();
             libc::sigemptyset(&mut mask);
             if libc::sigprocmask(libc::SIG_SETMASK, &mask, std::ptr::null_mut()) < 0 {