avoid triggering loopback alias creation for freebsd bootstrap when nfsd is already running

Author: nohajc

anylinuxfs/src/main.rs

@@ -175,6 +175,9 @@ pub(crate) fn default_linux_image_source(prefs: &impl Preferences) -> ImageSourc
         .unwrap_or(ImageSource::default())
 }
 
+/// 2049=NFS, 32765=statd, 32767=mountd.
+const GVPROXY_FORWARDED_PORTS: &[u16] = &[2049, 32765, 32767];
+
 fn load_config(common_args: &CommonArgs, debug_args: &DebugArgs) -> anyhow::Result<Config> {
     let identity =
         privilege::resolve_invoker_identity().context("Could not determine invoking user")?;
@@ -230,6 +233,8 @@ fn load_config(common_args: &CommonArgs, debug_args: &DebugArgs) -> anyhow::Resu
     let vsock_path = format!("/tmp/anylinuxfs-{}-vsock", rand_string(8));
     let unixgram_sock_path = format!("/tmp/vfkit-{}.sock", rand_string(8));
 
+    let gvproxy_forwards = GVPROXY_FORWARDED_PORTS.into();
+
     let global_prefix_dir = if prefix_dir.starts_with("/opt/homebrew") {
         PathBuf::from("/opt/homebrew")
     } else {
@@ -293,6 +298,7 @@ fn load_config(common_args: &CommonArgs, debug_args: &DebugArgs) -> anyhow::Resu
         },
         network: NetworkConfig {
             gvproxy_net_sock_path,
+            gvproxy_forwards,
             vsock_path,
             unixgram_sock_path,
             preferred_net_helper,

anylinuxfs/src/netutil.rs

@@ -230,7 +230,7 @@ mod darwin {
             let Some(addr) = itf.address.ip_addr() else {
                 continue;
             };
-            let mut ip_candidate = None;
+            let mut ip_candidate = Some(addr);
             let ipv6_scope = if addr.is_ipv6() { itf.index } else { None };
             for port in required_ports.iter().cloned() {
                 if let Some(mut sock) = (addr, port).to_socket_addrs()?.next() {

anylinuxfs/src/settings.rs

@@ -58,6 +58,7 @@ pub struct LogPaths {
 #[derive(Clone, Debug, Default, Deserialize, Serialize)]
 pub struct NetworkConfig {
     pub gvproxy_net_sock_path: String,
+    pub gvproxy_forwards: Vec<u16>,
     pub vsock_path: String,
     pub unixgram_sock_path: String,
     pub preferred_net_helper: NetHelper,
@@ -138,6 +139,13 @@ impl Config {
 
         new_config
     }
+
+    // returns copy of Config with modified NetworkConfig
+    pub fn with_network_config(&self, net_conf_fn: impl FnOnce(&mut NetworkConfig)) -> Self {
+        let mut new_config = self.clone();
+        net_conf_fn(&mut new_config.network);
+        new_config
+    }
 }
 
 pub trait Preferences {

anylinuxfs/src/vm_image.rs

@@ -219,6 +219,15 @@ mod freebsd {
             anyhow::bail!("FreeBSD base directory not specified");
         }
 
+        // We don't forward any ports during VM bootstrap.
+        // This affects which loopback interface will be selected for gvproxy.
+        // Normally, when there's a NFS port conflict, we ask the OS to create
+        // a loopback alias which is a privileged operation. Without any ports,
+        // no additional alias is needed and a non-root user can always proceed.
+        let config = config.with_network_config(|net_conf| {
+            net_conf.gvproxy_forwards = vec![];
+        });
+
         let base_path = config.paths.profile_path.join(&src.base_dir);
         let mtimes_path = base_path.join("mtimes");
         let tmp_path = base_path.join("tmp");

anylinuxfs/src/vm_network/mod.rs

@@ -73,10 +73,6 @@ pub fn vsock_cleanup(vsock_path: &str) -> anyhow::Result<()> {
     Ok(())
 }
 
-/// Ports gvproxy needs to forward through the loopback IP we select.
-/// 2049=NFS, 32765=statd, 32767=mountd.
-const GVPROXY_FORWARDED_PORTS: &[u16] = &[2049, 32765, 32767];
-
 pub fn start_gvproxy(config: &Config) -> anyhow::Result<NetHelperService> {
     vfkit_sock_cleanup(&config.network.unixgram_sock_path)?;
 
@@ -126,7 +122,7 @@ pub fn start_gvproxy(config: &Config) -> anyhow::Result<NetHelperService> {
         .spawn()
         .context("Failed to start gvproxy process")?;
 
-    let loopback_ip = netutil::pick_usable_loopback_ip(GVPROXY_FORWARDED_PORTS)?;
+    let loopback_ip = netutil::pick_usable_loopback_ip(&config.network.gvproxy_forwards)?;
 
     Ok(NetHelperService {
         proc: gvproxy_process,