From 7e2d4de0ffb3b33ec03aed8bd19ed7c51ac849b2 Mon Sep 17 00:00:00 2001
From: Anatoly Trosinenko <atrosinenko@accesssoftek.com>
Date: Tue, 18 Aug 2026 16:58:49 +0300
Subject: [PATCH] Fix permission denied errors due to root-owned directories

Build inside the container is performed by the `root` user, who
owns the produced build artifacts which are written to the host
directories mounted as volumes. The most important outcome of
this is that running `./build.sh host-build` after the `./ccache`
directory was populated by an earlier containerized build results
in the `host-build` silently disabling the build cache.

Fixing this may involve duplicating the non-privileged UID from
the host to the container, so that all build artifacts are owned
by the correct user from the beginning. This patch implements a
simpler ad-hoc approach of using two separate cache directories:
root-owned `ccache-docker` for containerized builds and
`ccache-host` owned by the regular user.

Furthermore, this patch makes `build.sh` pre-create the top-level
directories before mounting them via `docker run --volume ...`
(assuming `docker` and thus the `build.sh` script can be run by
the regular user without `sudo`).
---
 README.md                  | 2 +-
 build.sh                   | 8 ++++++++
 scripts/global-vars.inc.sh | 6 +++++-
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 38b1ddb..5a53c48 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@ This directory contains scripts to build an LLVM PAuth toolchain from scratch.
 
 The sources of LLVM, Musl and Linux kernel are first checked out on host under
 `./src/` and then the toolchain is built inside a Docker container.
-To speed up rebuilds significantly, a `./ccache/` directory is mounted from the host.
+To speed up rebuilds significantly, a `./ccache-docker/` directory is mounted from the host.
 The resulting toolchain is written to `./output/llvm-pauth.squashfs` - it is a
 compressed read-only file system image which is intended to be `mount`ed to
 `/opt/llvm-pauth`.
diff --git a/build.sh b/build.sh
index a19f2b1..5b6d75b 100755
--- a/build.sh
+++ b/build.sh
@@ -100,6 +100,14 @@ build_in_docker() {
   check_repo_sha "$LLVM_SOURCE_DIR_docker_host" "$LLVM_SHA"
   check_repo_sha "$MUSL_SOURCE_DIR_docker_host" "$MUSL_SHA"
 
+  # Assuming our non-privileged user is allowed to run `docker` directly, create
+  # the directories like ./output as the regular user before executing `docker run`,
+  # so that their direct contents (such as ./output/llvm-pauth.squashfs) can be
+  # renamed/deleted without `sudo`.
+  mkdir -p "$OUTPUT_DIR_docker_host"
+  mkdir -p "$CCACHE_DIR_docker_host"
+  mkdir -p "$REPO_ROOT_docker_host/tmp"
+
   $DOCKER_CMD build \
       -t "$DOCKER_IMAGE_NAME" \
       -f Dockerfile.builder \
diff --git a/scripts/global-vars.inc.sh b/scripts/global-vars.inc.sh
index b69362e..e77cf19 100644
--- a/scripts/global-vars.inc.sh
+++ b/scripts/global-vars.inc.sh
@@ -23,18 +23,22 @@ set_global_variables() {
   local host_repo_root="$2" # Must be empty if purpose is "docker"
 
   local repo_root
+  local ccache_dir
   case "$purpose" in
   host_build)
     repo_root="$host_repo_root"
+    ccache_dir="$repo_root/ccache-host"
   ;;
   docker_host)
     repo_root="$host_repo_root"
+    ccache_dir="$repo_root/ccache-docker"
   ;;
   docker)
     [ "x$host_repo_root" != "x" ] && \
         report_fatal_error "Do not specify host_repo_root with 'docker'."
 
     repo_root="/repo"
+    ccache_dir="$repo_root/ccache-docker"
   ;;
   *)
     report_fatal_error "Expected one of host_build, docker_host, docker."
@@ -45,7 +49,7 @@ set_global_variables() {
 
   eval  REPO_ROOT_$purpose='"$repo_root"'
   eval OUTPUT_DIR_$purpose='"$repo_root/output"'
-  eval CCACHE_DIR_$purpose='"$repo_root/ccache"'
+  eval CCACHE_DIR_$purpose='"$ccache_dir"'
   eval  BUILD_TMP_$purpose='"$repo_root/build"'
 
   eval SRC_DIR_$purpose='"$repo_root/src"'