{"record":{"id":"569f8122a88b38cb","repo":"astrid-runtime/astrid","slug":"fuse-service-parent-start-identity-is-required-on","errorCode":null,"errorMessage":"FUSE service parent start identity is required on Linux","messagePattern":"FUSE service parent start identity is required on Linux","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-storage-provider-fuse/src/service.rs","lineNumber":199,"sourceCode":"    parent: &astrid_core::storage_filesystem::StorageProviderParentLifetimeV1,\n) -> Result<()> {\n    if parent.pid <= 1 || parent.pid == std::process::id() {\n        bail!(\"invalid FUSE service parent PID\");\n    }\n    if parent.token.len() < 16\n        || parent.token.len() > 512\n        || parent.token.chars().any(char::is_control)\n    {\n        bail!(\"invalid FUSE service parent token\");\n    }\n    if let Some(identity) = parent.start_identity.as_deref()\n        && (identity.is_empty() || identity.len() > 512 || identity.chars().any(char::is_control))\n    {\n        bail!(\"invalid FUSE service parent start identity\");\n    }\n    #[cfg(target_os = \"linux\")]\n    if parent.start_identity.is_none() {\n        bail!(\"FUSE service parent start identity is required on Linux\");\n    }\n    Ok(())\n}\n\nfn validate_lease(lease: &StorageMountLeaseV1) -> Result<()> {\n    if lease.lease_token.len() < 16\n        || lease.lease_token.len() > 4096\n        || lease.lease_token.chars().any(char::is_control)\n    {\n        bail!(\"invalid FUSE callback token\");\n    }\n    let now = SystemTime::now()\n        .duration_since(UNIX_EPOCH)\n        .context(\"read system clock\")?\n        .as_secs();\n    if lease.expires_at_epoch_secs < now {\n        bail!(\"FUSE lease is expired\");\n    }","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-storage-provider-fuse/src/service.rs#L181-L217","documentation":"On Linux, `start_identity` is mandatory: the helper uses it to verify the parent's start context (e.g. process start identity) so a rogue process cannot impersonate the parent. Launching without it on Linux always fails validation.","triggerScenarios":"`validate_parent` runs under `#[cfg(target_os = \"linux\")]` and finds `parent.start_identity.is_none()` while building the launch in `validate_launch`.","commonSituations":"Cross-platform code that only sets start_identity on macOS/Windows; older client versions predating the field; a caller that treats the field as optional everywhere.","solutions":["Always populate `start_identity` on Linux (e.g. /proc-derived start identifier of the parent process).","Feature-gate client code so Linux paths set the identity before launching the helper.","Upgrade the client/mount library so the launch descriptor includes the field on Linux.","In tests or tools targeting Linux, supply a synthetic but valid identity string."],"exampleFix":"// before\nlet parent = StorageProviderParentLifetimeV1 { pid, token, start_identity: None, .. };\n// after\nlet parent = StorageProviderParentLifetimeV1 { pid, token, start_identity: Some(parent_start_identity()), .. };","handlingStrategy":"validation","validationCode":"#[cfg(target_os = \"linux\")]\nif parent.start_identity.is_none() {\n    return Err(\"start_identity is required on Linux\");\n}","typeGuard":"fn linux_parent_ready(parent: &StorageProviderParentLifetimeV1) -> bool {\n    #[cfg(target_os = \"linux\")]\n    { parent.start_identity.is_some() }\n    #[cfg(not(target_os = \"linux\"))]\n    { true }\n}","tryCatchPattern":null,"preventionTips":["Always populate start_identity on Linux before launching","Set the field in shared launcher code, not per-platform call sites","Cover Linux launches in tests"],"tags":["fuse","linux","validation","security"],"backgroundTag":"missing-required-argument","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}