December 2025 - Spectrum Development

[PATCH] host/rootfs: Sandbox Cloud Hypervisor
by Demi Marie Obenour 09 Dec '25

09 Dec '25

It only needs access to a small number of resources. Unfortunately, it needs access to /dev/vfio right now. This should be fixed by using file descriptor passing instead. Also, Cloud Hypervisor should not run as root. Cloud Hypervisor needs to be able to lock memory. Running in a user namespace prevents it from using CAP_IPC_LOCK. Therefore, it is necessary to increase RLIMIT_MLOCK before running Cloud Hypervisor. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/usr/bin/run-vmm | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm index ba8b59c2677408acdd01c2eda3cf2dd60992d881..24c3d607bfcf6fea6196b61d2941141486d33fd6 100755 --- a/host/rootfs/image/usr/bin/run-vmm +++ b/host/rootfs/image/usr/bin/run-vmm @@ -52,5 +52,36 @@ unexport ! fdmove -c 3 0 redirfd -r 0 /dev/null +s6-softlimit -H -l 18446744073709551615 if { udevadm wait /dev/kvm } -cloud-hypervisor --api-socket fd=3 +bwrap + --unshare-all + --unshare-user + --dev /dev + --dev-bind /dev/kvm /dev/kvm + --dev-bind /dev/vfio /dev/vfio + --tmpfs /dev/shm + --tmpfs /tmp + --tmpfs /var/tmp + --ro-bind /etc /etc + --ro-bind /lib /lib + --ro-bind /nix /nix + --ro-bind /usr /usr + --ro-bind /sys /sys + --bind /run /run + --proc /proc + --ro-bind /proc/sys /proc/sys + --tmpfs /proc/scsi + --remount-ro /proc/scsi + --tmpfs /proc/acpi + --remount-ro /proc/acpi + --tmpfs /proc/fs + --remount-ro /proc/fs + --tmpfs /proc/irq + --remount-ro /proc/irq + --ro-bind /dev/null /proc/timer_list + --ro-bind /dev/null /proc/kcore + --ro-bind /dev/null /proc/kallsyms + --ro-bind /dev/null /proc/sysrq-trigger + -- + cloud-hypervisor --api-socket fd=3 --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251206-b4-sandbox-9be7e5ed9926 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 5

[PATCH v2 1/2] vm/app/systemd-sysupdate: fix mounting overlay
by Alyssa Ross 09 Dec '25

09 Dec '25

This assumed it would be run as root, so has been broken since we stopped running application scripts as root inside img/app VMs. Reported-by: Johannes Süllner <johannes.suellner(a)mailbox.org> Link: https://matrix.to/#/!xSysqhzbOZImdvGpix:fairydust.space/$9psDI3BIP00EIzW-qO… Fixes: 8bfcbf9 ("img/app: run applications as non-root") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: remove redundant -U flag v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251208154738.300709… vm/app/systemd-sysupdate/download-update | 1 + 1 file changed, 1 insertion(+) diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update index eada41c..f8f5aed 100755 --- a/vm/app/systemd-sysupdate/download-update +++ b/vm/app/systemd-sysupdate/download-update @@ -3,6 +3,7 @@ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> export LC_ALL C export LANGUAGE C +unshare -mr if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX } # Not a useless use of cat: if there are NUL bytes in the URL base-commit: 5104fa720ce8b00612c5487fc47124fbf99e58c6 -- 2.51.0

2 3

[PATCH] img/app: fix running AppImages
by Alyssa Ross 09 Dec '25

09 Dec '25

The non-root user that applications run as can't mount FUSE filesystems. I don't want to introduce setuid or an IPC service just for running AppImages, although we could revisit if we find that applications themselves rely on being able to mount FUSE filesystems. For now, it'll be more efficient to use the in-kernel squashfs implementation anyway. We do need to set a few environment variables normally set by the AppImage runtime, but as far as I can tell it doesn't do much more than this that applications could rely on. This only works for type 2 AppImages, but I expect that's just about every AppImage nowadays, and if turns out not to be it shouldn't be too hard to support type 1. Fixes: 8bfcbf9 ("img/app: run applications as non-root") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- img/app/Makefile | 2 +- img/app/image/etc/s6-rc/app/run | 11 +++++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/img/app/Makefile b/img/app/Makefile index ddfc8ef..7354f89 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -30,7 +30,7 @@ $(imgdir)/appvm/blk/root.img: ../../scripts/make-gpt.sh ../../scripts/sfdisk-fie build/rootfs.erofs:root:5460386f-2203-4911-8694-91400125c604:root mv $@.tmp $@ -DIRS = dev home/user run proc sys tmp \ +DIRS = dev home/user run mnt proc sys tmp \ etc/s6-linux-init/run-image/pipewire \ etc/s6-linux-init/run-image/service \ etc/s6-linux-init/run-image/user \ diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run index e05d4fe..e691a63 100755 --- a/img/app/image/etc/s6-rc/app/run +++ b/img/app/image/etc/s6-rc/app/run @@ -14,10 +14,17 @@ foreground { withstdinas -E type case $type { appimage { - if { modprobe fuse } + if { modprobe loop } + if { + backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset } + mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt + } s6-setuidgid user + export APPIMAGE /run/virtiofs/virtiofs0/config/run + export APPDIR /mnt + export ARGV0 /mnt/AppRun export LD_LIBRARY_PATH /lib64 - /run/virtiofs/virtiofs0/config/run + /mnt/AppRun } flatpak { s6-envdir -fnL /run/virtiofs/virtiofs0/config/params base-commit: 5104fa720ce8b00612c5487fc47124fbf99e58c6 -- 2.51.0

3 3

[PATCH] img/app: fix X11
by Alyssa Ross 09 Dec '25

09 Dec '25

Xwayland only accepts connections from the user it's running as. It is started by wayland-proxy-virtwl, which does not allow passing extra options, so we can't change its authentication method. Therefore, the only way for X11 to work with the current software is to run wayland-proxy-virtwl as the same user as the application. I expect that in the near future, we will use xwayland-satellite instead of the built-in Xwayland translation in wayland-proxy-virtwl. When that happens, we can run the stub compositor as its own user again. Fixes: cb27e3a ("img/app: wayland-proxy-virtwl: run as non-root") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- img/app/image/etc/group | 1 - img/app/image/etc/mdev.conf | 2 +- img/app/image/etc/passwd | 1 - img/app/image/etc/s6-rc/wayland-proxy-virtwl/run | 2 +- 4 files changed, 2 insertions(+), 4 deletions(-) diff --git a/img/app/image/etc/group b/img/app/image/etc/group index b2c3a2e..e84da60 100644 --- a/img/app/image/etc/group +++ b/img/app/image/etc/group @@ -1,4 +1,3 @@ -wayland:x:1:wayland wireplumber:x:2:wireplumber pipewire:x:3:pipewire user:x:1000:user diff --git a/img/app/image/etc/mdev.conf b/img/app/image/etc/mdev.conf index d4cd825..33a07d6 100644 --- a/img/app/image/etc/mdev.conf +++ b/img/app/image/etc/mdev.conf @@ -4,7 +4,7 @@ -$MODALIAS=.* 0:0 0 ! +importas -Siu MODALIAS modprobe -q $MODALIAS $INTERFACE=.* 0:0 0 ! +/etc/mdev/iface $MODALIAS=virtio:d0000001Av.* 0:0 0 ! +/etc/mdev/virtiofs -dri/card0 wayland:wayland 660 +background { /etc/mdev/listen card0 } +dri/card0 user:user 660 +background { /etc/mdev/listen card0 } -SUBSYSTEM=sound;.* pipewire:pipewire 660 snd/controlC0 pipewire:pipewire 660 +background { /etc/mdev/listen controlC0 } diff --git a/img/app/image/etc/passwd b/img/app/image/etc/passwd index 08324b0..425908e 100644 --- a/img/app/image/etc/passwd +++ b/img/app/image/etc/passwd @@ -1,5 +1,4 @@ root:x:0:0:System administrator:/run/root:/bin/sh -wayland:x:1:1:wayland-proxy-virtwl service user:/:/usr/bin/nologin wireplumber:x:2:2:WirePlumber service user:/:/usr/bin/nologin pipewire:x:3:3:PipeWire service user:/:/usr/bin/nologin user:x:1000:1000:Spectrum application user:/home/user:/bin/sh diff --git a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run index 86d7f63..5d06b7a 100755 --- a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run +++ b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run @@ -26,6 +26,6 @@ export LISTEN_FDS 2 export LISTEN_FDNAMES wayland:x11 getpid LISTEN_PID -s6-setuidgid wayland +s6-setuidgid user wayland-proxy-virtwl --virtio-gpu --x-display=0 base-commit: 5104fa720ce8b00612c5487fc47124fbf99e58c6 -- 2.51.0

3 2

[REGRESSION] Networking for Firefox broken on second VM run
by Alyssa Ross 09 Dec '25

09 Dec '25

Since we introduced the userspace router, if I start the Firefox VM, quit Firefox, wait for the VM to shut down, and then start it again, networking no longer works, and I see repeating log lines like this: 2025-12-09 09:13:29.147240893 [2025-12-09T09:13:29Z WARN spectrum_router::router] interface App(0) has been blocked for 1 sec, dropping packet Full reproduction steps: 1. cd host/rootfs 2. nix-shell --run 'make clean && make run' 3. Start Firefox VM with vm-start 4. See that networking works 5. Quit Firefox and wait a few seconds for VM to stop 6. Start Firefox VM with vm-start again 7. No more networking, and log lines like the above

1 2

[PATCH] img/app: Delete dependency on nonexistent nftables service
by Demi Marie Obenour 09 Dec '25

09 Dec '25

This file was not included in the application image. Fixes: dcee941 ("vm/sys/net: integrate xdp-forwarder") Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables | 0 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables b/img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables deleted file mode 100644 index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..0000000000000000000000000000000000000000 --- base-commit: 44f32b7a4b3cfbb4046447318e6753dd0eb71add change-id: 20251201-fix-file-list-3fdfd53bd150 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 2

[PATCH] vm/sys/net: start nftables service
by Yureka Lilian 09 Dec '25

09 Dec '25

This was supposed to be here all along to ensure the net-vm does not create any traffic on any interfaces except for the xdp-forwarder setup. Fixes: dcee941 ("vm/sys/net: integrate xdp-forwarder") Signed-off-by: Yureka Lilian <yureka(a)cyberchaos.dev> --- vm/sys/net/file-list.mk | 1 + vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables | 0 2 files changed, 1 insertion(+) create mode 100644 vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables diff --git a/vm/sys/net/file-list.mk b/vm/sys/net/file-list.mk index 7cc3520..dfea2a8 100644 --- a/vm/sys/net/file-list.mk +++ b/vm/sys/net/file-list.mk @@ -26,6 +26,7 @@ S6_RC_FILES = \ image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd \ image/etc/s6-rc/mdevd-coldplug/type \ image/etc/s6-rc/mdevd-coldplug/up \ + image/etc/s6-rc/mdevd/dependencies.d/nftables \ image/etc/s6-rc/mdevd/notification-fd \ image/etc/s6-rc/mdevd/run \ image/etc/s6-rc/mdevd/type \ diff --git a/vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables b/vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables new file mode 100644 index 0000000..e69de29 -- 2.51.2

3 2

[PATCH] host/rootfs: Set no_new_privs in PID 1
by Demi Marie Obenour 08 Dec '25

08 Dec '25

This prevents any program on the host from gaining privileges via execve(), ever. There are currently no such programs on the host so this should be a no-op for now. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/etc/init | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host/rootfs/image/etc/init b/host/rootfs/image/etc/init index 4085fa55545e7309004967e443e47fc2b82b0663..e9938acec866045962a8ead096d199cbd3792469 100755 --- a/host/rootfs/image/etc/init +++ b/host/rootfs/image/etc/init @@ -2,4 +2,4 @@ # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> -/bin/s6-linux-init -c /etc/s6-linux-init -s /run/param -- $@ +/usr/bin/setpriv --no-new-privs -- /bin/s6-linux-init -c /etc/s6-linux-init -s /run/param -- $@ --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251205-no-new-privs-2f22088c0736 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 2

[PATCH] vm/app/systemd-sysupdate: fix mounting overlay
by Alyssa Ross 08 Dec '25

08 Dec '25

This assumed it would be run as root, so has been broken since we stopped running application scripts as root inside img/app VMs. Reported-by: Johannes Süllner <johannes.suellner(a)mailbox.org> Link: https://matrix.to/#/!xSysqhzbOZImdvGpix:fairydust.space/$9psDI3BIP00EIzW-qO… Fixes: 8bfcbf9 ("img/app: run applications as non-root") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- vm/app/systemd-sysupdate/download-update | 1 + 1 file changed, 1 insertion(+) diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update index eada41c..335e389 100755 --- a/vm/app/systemd-sysupdate/download-update +++ b/vm/app/systemd-sysupdate/download-update @@ -3,6 +3,7 @@ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> export LC_ALL C export LANGUAGE C +unshare -rUm if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX } # Not a useless use of cat: if there are NUL bytes in the URL base-commit: 9f33ec29d39df59589ed7c1b85d54e116e135df8 -- 2.51.0

2 6

[REGRESSION] VMs can't be rebooted
by Alyssa Ross 07 Dec '25

07 Dec '25

Since a655117 ("tools: start-vmm: enable Cloud Hypervisor landlock"), it's not possible to reboot a VM: ~ # ch-remote --api-socket /run/vm/by-id/dLPcEC/vmm reboot [2025-12-07T13:04:25Z ERROR cloud_hypervisor] Fatal error: HttpApiClient(ServerResponse(InternalServerError, Some("[\"Error from API\",\"The VM could not reboot\",\"Error creating console devices\",\"Error creating console device\",\"Permission denied (os error 13)\"]"))) Error: ch-remote exited with the following chain of errors: 0: http client error 1: Server responded with InternalServerError 2: Error from API 3: The VM could not reboot 4: Error creating console devices 5: Error creating console device 6: Permission denied (os error 13) I've opened an upstream bug reported about this: https://github.com/cloud-hypervisor/cloud-hypervisor/issues/7547

1 0