Hybrid-Mount/meta-hybrid_mount v6.2.1-rc.2

on GitHub

v6.2.1-rc.2

Features

• vfs Support remote kernel setup and document curl installation

Fixes

• vfs Report rejected probes and guard existing kernel providers

• Clear stale state on startup failures

• vfs Reject incomplete rule readback

• Align symlink metadata follow policy

• config Refuse unsafe fallback saves

• webui Surface startup failure diagnostics

• scanner Reject non-UTF-8 entry paths

• ci Run rust-lints unconfined so mount tests can unshare The mount rollback tests call unshare(CLONE_NEWNS) followed by mount_change("/", PRIVATE|REC). SYS_ADMIN lets the unshare through, but the docker-default AppArmor profile carries a blanket "deny mount," rule, and capabilities cannot override a loaded profile. The kernel returns EACCES from security_sb_mount(), so require_mount_namespace() panics and the whole job fails before any later gate runs. Capabilities were never the missing piece, so add apparmor=unconfined alongside the existing --cap-add SYS_ADMIN. Passing --security-opt is supported for job containers; only --network and --entrypoint are rejected. Three consecutive dev pushes (35451131001, 35476596179, 35486186501) failed on this step, including two dependency bumps unrelated to the change.

• Report VFS backend correctly and count VFS targets as active mounts A VFS-only boot creates no overlay staging backend, yet the storage phase left RunState.storage_mode empty and running_description fell through to its Ext4 catch-all, so the module description claimed "(Ext4)" while the WebUI defaulted a missing mode to "ext4". Record an explicit none sentinel (defs::NO_STORAGE_MODE) whenever overlay staging is skipped, render a storage tag only for a real tmpfs/ext4 backend, and let both WebUI skins name the backends that actually ran. VFS injection points were also excluded from active_mounts, so the WebUI activity list stayed empty on VFS-only devices. Merge VFS targets into active_mounts/confirmed_active_mounts -- they are confirmed by the provider rule read-back rather than mountinfo -- and clear vfs_active_mounts in the rollback snapshot. VFS still stays out of the KSU try-umount list because it is not a kernel mount.

• lkm Prefer ksud for shared VFS and nuke loading

• Surface VFS mount failures

Miscellaneous

• Implement stable error-class labels and enhance error logging - Added a label method to the ErrorClass enum for stable error-class tokens used in boot logs. - Introduced a new test to verify that error class labels are consistent and stable. - Updated logging in the log_phase_failure function to include error class labels. - Refactored various tests to utilize a new Fixture struct for temporary directories, improving test isolation and cleanup. - Removed redundant test support code and consolidated it into a new test_support module for better organization. - Adjusted comments and documentation for clarity and accuracy throughout the codebase.