- Spectrum Development - spectrum-os.org

[PATCH] host/rootfs: add /dev/fd and /dev/std*
by Demi Marie Obenour 31 Aug '25

31 Aug '25

This is the same as 14483e1a690c (img/app: add /dev/fd and /dev/std*), but for the host. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/etc/s6-linux-init/scripts/rc.init | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/host/rootfs/etc/s6-linux-init/scripts/rc.init b/host/rootfs/etc/s6-linux-init/scripts/rc.init index 674fd38cc76837c7be25a5ef060f0f4d4b786394..ec654dd0ff329e01a25c03bdd80ee839e679e4d0 100755 --- a/host/rootfs/etc/s6-linux-init/scripts/rc.init +++ b/host/rootfs/etc/s6-linux-init/scripts/rc.init @@ -2,6 +2,11 @@ # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2022, 2024 Alyssa Ross <hi(a)alyssa.is> +if { ln -s /proc/self/fd /dev } +if { ln -s /proc/self/fd/0 /dev/stdin } +if { ln -s /proc/self/fd/1 /dev/stdout } +if { ln -s /proc/self/fd/2 /dev/stderr } + if { s6-rc-init -c /etc/s6-rc /run/service } if { mount --make-shared /run } --- base-commit: 39baa378367d95fac6ce4d0140b25203b2ee9b53 change-id: 20250805-host-dev-fd-51d57d8341bb -- Sincerely, Demi Marie Obenour (she/her/hers)

2 3

'make clean' followed by 'make' in the same Nix shell doesn't work
by Demi Marie Obenour 31 Aug '25

31 Aug '25

The following command fails to rebuild the image: $ nix-shell --run 'make clean && make run-qemu' The following command succeeds: $ nix-shell --pure --run 'make clean' && nix-shell --pure --run 'make run-qemu' Interactive Nix shells exhibit the same problems, and adding --pure to the first invocation does not help. -- Sincerely, Demi Marie Obenour (she/her/hers)

2 5

Speeding up image builds?
by Demi Marie Obenour 31 Aug '25

31 Aug '25

I often find myself waiting for image builds to run. What are some steps I can take to make them faster? Generally, I find that image builds are I/O bound (CPU usage remains quite low), so one option would be to use a machine with better I/O. What is the best option for this? Is this something where thin provisioning (instead of thick provisioning) causes a large performance penalty? Or is the only solution to throw hardware at the problem? If the latter, what would better hardware be? -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

Moderate Cybersecurity Concern
by ball drinker 29 Aug '25

29 Aug '25

Salutations -- I write not as another spammer talking of riches and fame but as a concerned cybersecurity student aspiring to be a graduate. YOUR OPENSSH PRIVATE KEY WAS COMPROMISED IN A GOOGLE DORK IN CASE YOU WERE NOT AWARE! I figure that now that the important part was stated, I should share some proof of it. Attached will be a series of two (2) images. These were stumbled across while I was completing an assignment for my college course. I only wanted to share the information with you considering I figured it'd be pertinent for something like this.

2 1

Spectrum OS management daemon?
by Demi Marie Obenour 22 Aug '25

22 Aug '25

I'm wondering if Spectrum OS should have a management daemon that is responsible for a few tasks: - Starting VMs when requested by the UI. - Notifying the user of various situations that require their attention, such if a VM crashes. - Suspending VMs before the host suspends, and resuming them after the host resumes. I believe Qubes OS didn't do this initially, but that led to problems so they do do this now. - Acting on devices being plugged and unplugged from system VM. -- Sincerely, Demi Marie Obenour (she/her/hers)

2 3

Switching to udev?
by Demi Marie Obenour 20 Aug '25

20 Aug '25

I'm seriously wondering if Spectrum should switch from mdevd to udev. It's where all of the upstream device detection work happens, and it would avoid needing to statically configure sound devices for PipeWire. The current PipeWire patch statically creates devices. This works for VMs because VMs are statically configured and only have virtio devices. This was also the most challenging part of the effort, and I still had to guess some of the parameters. Supporting hotplug would require either a custom PipeWire module, a custom daemon that talked to PipeWire, keeping pw-cli running in interactive mode, or patches to PipeWire to make device lingering work. In the audio case, ALSA expects device paths of the form hw:card:device:subdevice. However, I don't believe card numbers are stable: they reflect the order in which the kernel enumerates devices, and that is not at all guaranteed. A VM that only has a virtio sound device will only ever have card 0, device 0, and subdevice 0, so hard-coding hw:0,0,0 is fine. This is not true if physical hardware is present. That requires a lot of device identification logic, and all of the upstream work on that is in udev or the systemd hardware database (which udev also uses). In the future, there may be other projects Spectrum wants to use that rely on udev for enumerating devices. Some of them might *only* support PipeWire and have no other means of configuration. Even if other means of configuration *exist*, I expect them to be very rarely used by upstream and thus poorly tested. tl;dr: you can get away without udev in VMs, but I expect problems with physical hardware, and I want to switch to udev as a preemptive measure to avoid those problems and to ease development. -- Sincerely, Demi Marie Obenour (she/her/hers)

2 6

Re: Arranging groups of services
by James Smith 20 Aug '25

20 Aug '25

Forwarding for <Nathaniel Reindal nrr(a)corvidae.org> on this : Both systemd and s6, so I might be uniquely qualified here. (Though, I must admit that I haven't been deep in systemd's internals lately.) Any chance I can take a peek at some s6 service directories to get a better idea of how things work currently? A quick perusal of the spectrum git tree wasn't terribly enlightening. On Sat, Aug 16, 2025, 6:11 PM Demi Marie Obenour <demiobenour(a)gmail.com> wrote: I'm working on Spectrum OS (https://spectrum-os.org/) and am currently porting it from s6 (https://skarnet.org/software/s6-linux-init/) to systemd. Spectrum OS's host (which is what is being ported) is rather different from a normal system: - The root filesystem is completely read-only. There's no writable /var. I decided to put a tmpfs there for now. - There is no network access, so /etc/resolv.conf isn't needed. - The real work happens in VMs, each of which depends on a few services: - Cloud Hypervisor (https://www.cloudhypervisor.org) which runs the VM. - crosvm (https://crosvm.dev/book/) used for graphics. - virtiofsd (https://virtio-fs.gitlab.io) to provide a filesystem - Spectrum OS's own proxy for the XDG desktop portals - In the future, an instance of vhost-device-sound ( https://github.com/rust-vmm/vhost-device/blob/main/vhost-device-sound/READM… ) used for sound - A per-VM D-Bus daemon - An instance of xdg-desktop-portal If the Cloud Hypervisor instance is stopped or exits, the others should be stopped automatically, as they have no other use. Having BindsTo=, After=, PropagatesStopTo=, and PropagatesReloadTo= should handle most cases, but I don't know if that is sufficient if Cloud Hypervisor exits spontaneously (because the guest shut down) or crashes. Additionally, these services have different sandboxing needs. Cloud Hypervisor should only be able to connect to its own instance of the daemons that serve it, rather than to any instance. crosvm needs GPU and Wayland access and vhost-device-sound needs to connect to PipeWire. virtiofsd needs an id-mapped mount. I would also like to block abstract AF_UNIX socket access. Are there existing systemd features that can easily meet these needs? For the sockets I am thinking of placing them in RuntimeDirectory= and only giving the correct units access to those directories. Also, I would like to use `DynamicUser=` for everything where that is possible.

2 1

[PATCH] vm: do not require KVM to run QEMU
by Demi Marie Obenour 15 Aug '25

15 Aug '25

This prevented running QEMU on Qubes OS. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- img/app/Makefile | 2 +- scripts/run-qemu.sh | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/img/app/Makefile b/img/app/Makefile index 5380ffb76e7bdf8867dcb61560d77028bf910fa3..e458ffebb7db0718007dd15af6a17dda74d36d0a 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -148,7 +148,7 @@ start-virtiofsd: scripts/start-virtiofsd.elb .PHONY: start-virtiofsd run-qemu: $(imgdir)/appvm/blk/root.img start-vhost-user-net start-virtiofsd - @../../scripts/run-qemu.sh -m 256 -cpu host -kernel $(KERNEL) -vga none \ + @../../scripts/run-qemu.sh -m 256 -kernel $(KERNEL) -vga none \ -drive file=$(imgdir)/appvm/blk/root.img,if=virtio,format=raw,readonly=on \ -append "root=PARTLABEL=root nokaslr" \ -gdb unix:build/gdb.sock,server,nowait \ diff --git a/scripts/run-qemu.sh b/scripts/run-qemu.sh index 64fd29259ab108bc547cb7c74623ae9dc288b3b7..9fa240aed44822a0aff295d246cb23a0e1cf7b8a 100755 --- a/scripts/run-qemu.sh +++ b/scripts/run-qemu.sh @@ -5,6 +5,8 @@ # This script wraps around QEMU to paper over platform differences, # which can't be handled portably in Make language. +cpu='-cpu host' +if [ ! -f /dev/kvm ]; then cpu=; fi case "${ARCH:="$(uname -m)"}" in aarch64) machine=virt,accel=kvm:tcg,gic-version=3,iommu=smmuv3 @@ -51,7 +53,7 @@ while [ $i -lt $# ]; do virtualization=on) case "$ARCH" in aarch64) - opt="$opt,accel=tcg" + opt="$opt,accel=tcg" cpu= ;; *) continue @@ -88,4 +90,5 @@ exec ${QEMU_SYSTEM:-qemu-system-$ARCH} \ -machine "$machine" \ ${kernel:+${append:+-append "$append"}} \ ${iommu:+-device "$iommu"} \ + $cpu \ "$@" --- base-commit: 39baa378367d95fac6ce4d0140b25203b2ee9b53 change-id: 20250807-no-require-kvm-c6755f4ade76 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 4

[PATCH] Add .envrc files for use with nix-direnv
by Demi Marie Obenour 14 Aug '25

14 Aug '25

This allows automatically setting up environment variables when entering a directory. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- .envrc | 1 + .gitignore | 1 + host/initramfs/.envrc | 1 + host/rootfs/.envrc | 1 + img/app/.envrc | 1 + release/checks/wayland/surface-notify/.envrc | 1 + release/live/.envrc | 1 + tools/.envrc | 1 + tools/lseek/.envrc | 1 + vm/sys/net/.envrc | 1 + 10 files changed, 10 insertions(+) diff --git a/.envrc b/.envrc new file mode 100644 index 0000000000000000000000000000000000000000..1d953f4bd73593aba0a2af3db2d14178e2b8b9fe --- /dev/null +++ b/.envrc @@ -0,0 +1 @@ +use nix diff --git a/.gitignore b/.gitignore index 8bb50396847bb2d64fb7db9ea230f0fab23b17b1..86ebca8ba9af2c63122364a6f2b2a5337ca0f0e5 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ target/ **/subprojects/* !**/subprojects/*.wrap !**/subprojects/packagefiles +**/.direnv/* diff --git a/host/initramfs/.envrc b/host/initramfs/.envrc new file mode 100644 index 0000000000000000000000000000000000000000..1d953f4bd73593aba0a2af3db2d14178e2b8b9fe --- /dev/null +++ b/host/initramfs/.envrc @@ -0,0 +1 @@ +use nix diff --git a/host/rootfs/.envrc b/host/rootfs/.envrc new file mode 100644 index 0000000000000000000000000000000000000000..1d953f4bd73593aba0a2af3db2d14178e2b8b9fe --- /dev/null +++ b/host/rootfs/.envrc @@ -0,0 +1 @@ +use nix diff --git a/img/app/.envrc b/img/app/.envrc new file mode 100644 index 0000000000000000000000000000000000000000..1d953f4bd73593aba0a2af3db2d14178e2b8b9fe --- /dev/null +++ b/img/app/.envrc @@ -0,0 +1 @@ +use nix diff --git a/release/checks/wayland/surface-notify/.envrc b/release/checks/wayland/surface-notify/.envrc new file mode 100644 index 0000000000000000000000000000000000000000..1d953f4bd73593aba0a2af3db2d14178e2b8b9fe --- /dev/null +++ b/release/checks/wayland/surface-notify/.envrc @@ -0,0 +1 @@ +use nix diff --git a/release/live/.envrc b/release/live/.envrc new file mode 100644 index 0000000000000000000000000000000000000000..1d953f4bd73593aba0a2af3db2d14178e2b8b9fe --- /dev/null +++ b/release/live/.envrc @@ -0,0 +1 @@ +use nix diff --git a/tools/.envrc b/tools/.envrc new file mode 100644 index 0000000000000000000000000000000000000000..1d953f4bd73593aba0a2af3db2d14178e2b8b9fe --- /dev/null +++ b/tools/.envrc @@ -0,0 +1 @@ +use nix diff --git a/tools/lseek/.envrc b/tools/lseek/.envrc new file mode 100644 index 0000000000000000000000000000000000000000..1d953f4bd73593aba0a2af3db2d14178e2b8b9fe --- /dev/null +++ b/tools/lseek/.envrc @@ -0,0 +1 @@ +use nix diff --git a/vm/sys/net/.envrc b/vm/sys/net/.envrc new file mode 100644 index 0000000000000000000000000000000000000000..1d953f4bd73593aba0a2af3db2d14178e2b8b9fe --- /dev/null +++ b/vm/sys/net/.envrc @@ -0,0 +1 @@ +use nix --- base-commit: ecafd460a61e3ecf1a084e3e66eba32a0f7865a7 change-id: 20250808-envrc-d05f5fe739d7 -- Sincerely, Demi Marie Obenour (she/her/hers)

1 1

[PATCH] Add wrapper scripts to run make in a Nix shell
by Demi Marie Obenour 08 Aug '25

08 Aug '25

It is very easy to forget to do this, and the results are confusing at best and wrong at worst. Add wrapper scripts that get it right and also automatically change to the correct directory for you. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/initramfs/run-make.sh | 1 + host/rootfs/run-make.sh | 1 + img/app/run-make.sh | 1 + release/live/run-make.sh | 1 + scripts/run-make.sh | 12 ++++++++++++ tools/lseek/run-make.sh | 1 + vm/sys/net/run-make.sh | 1 + 7 files changed, 18 insertions(+) diff --git a/host/initramfs/run-make.sh b/host/initramfs/run-make.sh new file mode 120000 index 0000000000000000000000000000000000000000..2142d230828768016cf5a4a59a895448ae3b12d9 --- /dev/null +++ b/host/initramfs/run-make.sh @@ -0,0 +1 @@ +../../scripts/run-make.sh \ No newline at end of file diff --git a/host/rootfs/run-make.sh b/host/rootfs/run-make.sh new file mode 120000 index 0000000000000000000000000000000000000000..2142d230828768016cf5a4a59a895448ae3b12d9 --- /dev/null +++ b/host/rootfs/run-make.sh @@ -0,0 +1 @@ +../../scripts/run-make.sh \ No newline at end of file diff --git a/img/app/run-make.sh b/img/app/run-make.sh new file mode 120000 index 0000000000000000000000000000000000000000..2142d230828768016cf5a4a59a895448ae3b12d9 --- /dev/null +++ b/img/app/run-make.sh @@ -0,0 +1 @@ +../../scripts/run-make.sh \ No newline at end of file diff --git a/release/live/run-make.sh b/release/live/run-make.sh new file mode 120000 index 0000000000000000000000000000000000000000..2142d230828768016cf5a4a59a895448ae3b12d9 --- /dev/null +++ b/release/live/run-make.sh @@ -0,0 +1 @@ +../../scripts/run-make.sh \ No newline at end of file diff --git a/scripts/run-make.sh b/scripts/run-make.sh new file mode 100755 index 0000000000000000000000000000000000000000..b865bb3461b5d3f192598d273cee278a76d0a6b7 --- /dev/null +++ b/scripts/run-make.sh @@ -0,0 +1,12 @@ +#!/usr/bin/env -S bash -- +# SPDX-License-Identifier: CC0-1.0 +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +set -eu +case $0 in (/*) cd "${0%/*}/";; (*/*) cd "./${0%/*}";; esac +if [ ! -f shell.nix ] || [ ! -f Makefile ]; then + echo "Must have a shell.nix and a Makefile" >&2 + exit 1 +fi +cmd='exec make' +for i; do cmd+=" '"${i//\'/\'\\\'\'}\'; done +exec nix-shell --pure --run "$cmd" diff --git a/tools/lseek/run-make.sh b/tools/lseek/run-make.sh new file mode 120000 index 0000000000000000000000000000000000000000..2142d230828768016cf5a4a59a895448ae3b12d9 --- /dev/null +++ b/tools/lseek/run-make.sh @@ -0,0 +1 @@ +../../scripts/run-make.sh \ No newline at end of file diff --git a/vm/sys/net/run-make.sh b/vm/sys/net/run-make.sh new file mode 120000 index 0000000000000000000000000000000000000000..38a7b0cf91ebf669e9794d91c6962cbe882de20f --- /dev/null +++ b/vm/sys/net/run-make.sh @@ -0,0 +1 @@ +../../../scripts/run-make.sh \ No newline at end of file --- base-commit: 39baa378367d95fac6ce4d0140b25203b2ee9b53 change-id: 20250807-make-wrapper-scripts-77231ac0c0a7 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 5