From eb8c20695643923598d0516e86b1fcef144f65fa Mon Sep 17 00:00:00 2001
From: SulfurNitride <SulfurNitride@users.noreply.github.com>
Date: Wed, 11 Mar 2026 04:02:27 -0500
Subject: Fix FUSE passthrough: use proper API, drop LD_LIBRARY_PATH,
 auto-apply cap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Use fuse_passthrough_open/close API instead of raw fd assignment to
  fi->backing_id, which caused EIO on every file open through the VFS
- Remove LD_LIBRARY_PATH from launcher script — DT_RPATH handles lib
  resolution, and LD_LIBRARY_PATH triggers AT_SECURE which drops file
  capabilities (cap_sys_admin) needed for passthrough
- Auto-detect missing cap_sys_admin at mount time and prompt via pkexec
  to re-apply it (handles binary copy/update/extract losing the cap)
- Disable passthrough for session if fuse_passthrough_open fails, avoiding
  "Operation not permitted" spam in terminal
- Fix Nix flake: tinyxml2 → tinyxml-2, xorg.lib* → top-level names
- CI: eliminate artifact zip round-trip for GitHub releases

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 flake.nix | 55 ++++++++++++++++++++++++++++---------------------------
 1 file changed, 28 insertions(+), 27 deletions(-)

(limited to 'flake.nix')

diff --git a/flake.nix b/flake.nix
index d982917..6e66a5e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -142,7 +142,7 @@
 
           # System libraries
           sqlite
-          tinyxml2
+          tinyxml-2
           spdlog
           fuse3
           lz4
@@ -382,7 +382,8 @@ RUN="''${BIN_DST}"
 PYTHON_DIR="''${RUN}/python"
 
 export PATH="''${RUN}:''${PATH}"
-export LD_LIBRARY_PATH="''${RUN}/lib:''${PYTHON_DIR}/lib:''${LD_LIBRARY_PATH:-}"
+# NOTE: Do NOT set LD_LIBRARY_PATH — DT_RPATH handles library resolution.
+# Setting it on a capability-bearing binary drops file capabilities (AT_SECURE).
 export MO2_BASE_DIR="''${RUN}"
 export MO2_PLUGINS_DIR="''${RUN}/plugins"
 export MO2_DLLS_DIR="''${RUN}/dlls"
@@ -443,19 +444,19 @@ LAUNCH
           vulkan-loader
           mesa
 
-          xorg.libX11
-          xorg.libxcb
-          xorg.libXext
-          xorg.libXrandr
-          xorg.libXcursor
-          xorg.libXi
-          xorg.libXfixes
-          xorg.libXrender
-          xorg.libXcomposite
-          xorg.libXdamage
-          xorg.libXtst
-          xorg.libXScrnSaver
-          xorg.libXinerama
+          libx11
+          libxcb
+          libxext
+          libxrandr
+          libxcursor
+          libxi
+          libxfixes
+          libxrender
+          libxcomposite
+          libxdamage
+          libxtst
+          libxscrnsaver
+          libxinerama
           libxkbcommon
 
           wayland
@@ -490,18 +491,18 @@ LAUNCH
           fontconfig
           zlib
           glib
-          xorg.libX11
-          xorg.libxcb
-          xorg.libXext
-          xorg.libXrandr
-          xorg.libXcursor
-          xorg.libXi
-          xorg.libXfixes
-          xorg.libXrender
-          xorg.libXcomposite
-          xorg.libXdamage
-          xorg.libXtst
-          xorg.libXinerama
+          libx11
+          libxcb
+          libxext
+          libxrandr
+          libxcursor
+          libxi
+          libxfixes
+          libxrender
+          libxcomposite
+          libxdamage
+          libxtst
+          libxinerama
           wayland
           libxkbcommon
           gnutls
-- 
cgit v1.3.1