- Spectrum Development - spectrum-os.org

Rapidly iterating OS changes on bare hardware
by Demi Marie Obenour 05 Jan '26

05 Jan '26

What is the best way to rapidly iterate changes to Spectrum on bare hardware? Having to do a full reinstall isn't fast. Is updating into the new version of Spectrum the best option? -- Sincerely, Demi Marie Obenour (she/her/hers)

1 0

dirlock: a tool to manage encrypted filesystems
by No Name 25 Dec '25

25 Dec '25

just thought yall would find this useful/interesting https://gitlab.steamos.cloud/holo/dirlock https://www.igalia.com/downloads/slides/albertogarcia-DirlockANewRustToolto… no name

1 0

[PATCH] host/rootfs: Sandbox Weston (almost) for real
by Demi Marie Obenour 16 Dec '25

16 Dec '25

The "almost" is because of the need for Weston to create /run/user/0/wayland-1. This can be fixed by passing the listening socket into Weston. Also Weston still runs as root and there is no seccomp filtering or MAC. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/etc/s6-rc/weston/run | 54 ++++++++++++++++++++++++++++++++-- 1 file changed, 52 insertions(+), 2 deletions(-) diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run index 251f5da4597a916c4e46a0dfd64cec261d519d23..87579d1bddb4c191dda0c1659f88e74c178d13a1 100644 --- a/host/rootfs/image/etc/s6-rc/weston/run +++ b/host/rootfs/image/etc/s6-rc/weston/run @@ -18,5 +18,55 @@ redirfd -r 0 /dev/tty1 importas -i home HOME cd $home if { udevadm wait /dev/dri/card0 } -unshare --cgroup --ipc --net --uts -weston +bwrap + # no --unshare-net, breaks udev hotplug + --unshare-ipc + --unshare-uts + --unshare-cgroup + --cap-add CAP_SYS_TTY_CONFIG + --dev-bind /dev /dev + --bind /run /run + --ro-bind /etc /etc + --ro-bind /nix /nix + --ro-bind /usr /usr + --ro-bind /lib /lib + --ro-bind /bin /bin + --ro-bind /sbin /sbin + # For /run/seatd.sock + --tmpfs /run + # For OpenGL/Vulkan/etc + --ro-bind /run/opengl-driver /run/opengl-driver + # For udev + --ro-bind /run/udev /run/udev + --tmpfs /tmp + --tmpfs /dev/shm + # Filtered /proc (without nasty stuff) + --proc /proc + --ro-bind /proc/sys /proc/sys + --tmpfs /proc/scsi + --remount-ro /proc/scsi + --tmpfs /proc/acpi + --remount-ro /proc/acpi + --tmpfs /proc/fs + --remount-ro /proc/fs + --tmpfs /proc/irq + --remount-ro /proc/irq + --ro-bind /dev/null /proc/timer_list + --ro-bind /dev/null /proc/kcore + --ro-bind /dev/null /proc/kallsyms + --ro-bind /dev/null /proc/sysrq-trigger + --ro-bind /sys /sys + --dev /dev + # GPUs + --dev-bind /dev/dri /dev/dri + # Input devices + --dev-bind /dev/input /dev/input + # Virtual consoles + --dev-bind /dev/tty1 /dev/tty1 + --dev-bind /dev/tty0 /dev/tty0 + # Kernel console + --dev-bind /dev/console /dev/console + # So that Weston can create its listening socket + --bind /run/user/0 /run/user/0 + -- +/usr/bin/weston --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251205-sandbox-weston-7bb8c5e0b55f -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH] release/update.nix: fix import of efi
by Alyssa Ross 16 Dec '25

16 Dec '25

import does not pass through custom configuration options. Fixes: 49f33a1 ("release: Create directory with system update") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- release/update.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/release/update.nix b/release/update.nix index 18a91ac..f6e7772 100644 --- a/release/update.nix +++ b/release/update.nix @@ -6,7 +6,7 @@ import ../lib/call-package.nix ( { callSpectrumPackage, config, runCommand, stdenv }: let - efi = import ../host/efi.nix {}; + efi = callSpectrumPackage ../host/efi.nix {}; in runCommand "spectrum-update-directory" { __structuredAttrs = true; base-commit: 6ceeb9b236cc50d2bba90068533ca1b7ff229c8b -- 2.51.0

3 2

The upcoming nixpkgs staging cycle
by Yureka 15 Dec '25

15 Dec '25

Hi, I attempted running the spectrum release checks on nixpkgs staging commit dc05cdb0ced63fee5124d22a5cc43a0eab3a23bb. I found the following build failures (all from the default glibc/non-cross package set) and reported them upstream: https://github.com/NixOS/nixpkgs/issues/470961 https://github.com/NixOS/nixpkgs/issues/470962 https://github.com/NixOS/nixpkgs/issues/470964 Kind regards, Yureka

3 2

[PATCH] host/roots: Sandbox xdg-desktop-portal-spectrum-host
by Demi Marie Obenour 15 Dec '25

15 Dec '25

It is quite possible that these Landlock rules are unnecessarily permissive, but all of the paths to which read and execute access is granted are part of the root filesystem and therefore assumed to be public knowledge. Removing access from any of them would only increase the risk of accidental breakage in the future, and would not provide any security improvements. seccomp *could* provide some improvements, but the effort needed is too high for now. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- .../template/data/service/xdg-desktop-portal-spectrum-host/run | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run index d2bf78cefc3837b5d5369dbab819606e71bf1fc5..c3d67b6520d490c71bdce0f1056b2960115108b3 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run @@ -12,4 +12,12 @@ s6-ipcserver-socketbinder -a 0700 /run/vm/by-id/${VM}/vsock_219 if { fdmove 1 3 echo } fdclose 3 +unshare -inu -- +setpriv + --landlock-access fs + --landlock-rule path-beneath:read-file,execute:/nix/store + --landlock-rule path-beneath:read-file,execute:/usr/bin + --landlock-rule path-beneath:read-file,execute:/usr/lib + --landlock-rule path-beneath:read-file:/run/vm/by-id/${VM}/portal-bus + -- xdg-desktop-portal-spectrum-host --- base-commit: 59cda41acc455513cf9936e99b8d97647955ac07 change-id: 20251212-sandbox-dbus-portal-4f98ba29c23a -- Sincerely, Demi Marie Obenour (she/her/hers)

4 12

[PATCH v2 1/7] host/rootfs: make fs root directories shared
by Alyssa Ross 14 Dec '25

14 Dec '25

We want every mount under here to show up inside the virtiofsd sandbox. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: no change host/rootfs/image/usr/bin/create-vm-dependencies | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies index 9e123fcf..6bf12d03 100755 --- a/host/rootfs/image/usr/bin/create-vm-dependencies +++ b/host/rootfs/image/usr/bin/create-vm-dependencies @@ -30,8 +30,8 @@ if { # Needs to be shared so that additional mounts under config/ (e.g. from # mount-flatpak) will be propagated into the virtiofsd sandbox. - if { mount --make-shared --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } - if { mount --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --make-shared --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } # Needs to be shared so that when xdg-document-portal mounts its fuse # filesystem at /run/doc/${1}/doc, it will propagate to /run/fs/${1}/doc. base-commit: 227a3ea149281b6dddb0c1ba70008fffb7404c1f -- 2.51.0

3 15

[PATCH] tools/xdg-desktop-portal-spectrum-host: landlock
by Alyssa Ross 14 Dec '25

14 Dec '25

This program doesn't do anything restricted by landlock, so we can just set up a maximally restrictive ruleset and be done with it. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- .../Cargo.lock | 32 +++++++++++++++++++ .../Cargo.toml | 1 + .../src/main.rs | 19 ++++++++++- 3 files changed, 51 insertions(+), 1 deletion(-) diff --git a/tools/xdg-desktop-portal-spectrum-host/Cargo.lock b/tools/xdg-desktop-portal-spectrum-host/Cargo.lock index d09e36ff..147a6b9a 100644 --- a/tools/xdg-desktop-portal-spectrum-host/Cargo.lock +++ b/tools/xdg-desktop-portal-spectrum-host/Cargo.lock @@ -513,6 +513,17 @@ dependencies = [ "hashbrown", ] +[[package]] +name = "landlock" +version = "0.4.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "49fefd6652c57d68aaa32544a4c0e642929725bdc1fd929367cdeb673ab81088" +dependencies = [ + "enumflags2", + "libc", + "thiserror", +] + [[package]] name = "libc" version = "0.2.178" @@ -767,6 +778,26 @@ dependencies = [ "windows-sys", ] +[[package]] +name = "thiserror" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8" +dependencies = [ + "thiserror-impl", +] + +[[package]] +name = "thiserror-impl" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + [[package]] name = "tinystr" version = "0.7.6" @@ -988,6 +1019,7 @@ dependencies = [ "async-executor", "async-io", "futures-lite", + "landlock", "percent-encoding", "rustix", "url", diff --git a/tools/xdg-desktop-portal-spectrum-host/Cargo.toml b/tools/xdg-desktop-portal-spectrum-host/Cargo.toml index 96459c82..7b177cbf 100644 --- a/tools/xdg-desktop-portal-spectrum-host/Cargo.toml +++ b/tools/xdg-desktop-portal-spectrum-host/Cargo.toml @@ -10,6 +10,7 @@ edition = "2024" async-executor = { version = "1.12.0", features = ["static"] } async-io = "2.3.2" futures-lite = "2.3.0" +landlock = "0.4.4" percent-encoding = "2.3.1" rustix = "0.38.34" url = "2.5.0" diff --git a/tools/xdg-desktop-portal-spectrum-host/src/main.rs b/tools/xdg-desktop-portal-spectrum-host/src/main.rs index 3fc49cf3..a8672197 100644 --- a/tools/xdg-desktop-portal-spectrum-host/src/main.rs +++ b/tools/xdg-desktop-portal-spectrum-host/src/main.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: EUPL-1.2+ -// SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> +// SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> mod documents; mod file_chooser; @@ -19,6 +19,10 @@ use async_executor::StaticExecutor; use async_io::Async; use futures_lite::prelude::*; use futures_lite::stream::StreamExt; +use landlock::{ + ABI, Access, AccessFs, AccessNet, CompatLevel, Compatible, Ruleset, RulesetAttr, RulesetError, + Scope, +}; use zbus::{AuthMechanism, Connection, MessageStream, connection}; use file_chooser::FileChooser; @@ -208,6 +212,17 @@ fn listening_vsock_path(connection: &UnixListener) -> Result<PathBuf, String> { Ok(OsString::from_vec(listening_addr).into()) } +fn set_up_landlock() -> Result<(), RulesetError> { + Ruleset::default() + .handle_access(AccessFs::from_all(ABI::V6))? + .handle_access(AccessNet::from_all(ABI::V6))? + .scope(Scope::from_all(ABI::V6))? + .create()? + .set_compatibility(CompatLevel::HardRequirement) + .restrict_self()?; + Ok(()) +} + fn read_argv() { let mut args = args_os(); args.next(); @@ -219,6 +234,8 @@ fn read_argv() { } fn run() -> Result<(), String> { + set_up_landlock().map_err(|e| format!("setting up landlock: {e}"))?; + read_argv(); async_io::block_on(EXECUTOR.run(async { base-commit: 073642b88d65fd3d5a10e45226cb8ba580ac7bd3 -- 2.51.0

2 1

[PATCH 1/2] tools: start-vmm: output serial to VM directory
by Alyssa Ross 14 Dec '25

14 Dec '25

When we run the VMM as non-root, it shouldn't be able to create files directly under /run, so this needs to go somewhere else. Really this should probably be going through s6-log, but I think it makes sense to revisit that after we have persistent storage figured out, so that we can get lots out of RAM. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- release/checks/integration/networking.c | 2 +- release/checks/integration/portal.c | 2 +- tools/start-vmm/lib.rs | 2 +- tools/start-vmm/tests/vm_command-basic.rs | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/release/checks/integration/networking.c b/release/checks/integration/networking.c index 078e31fc..c3d873f5 100644 --- a/release/checks/integration/networking.c +++ b/release/checks/integration/networking.c @@ -153,7 +153,7 @@ void test(struct config c) "s6-rc -bu change vmm-env && " "vm-import user /run/mnt/vms && " "vm-start \"$(basename \"$(readlink /run/vm/by-name/user.nc)\")\" && " - "tail -Fc +0 /run/log/current /run/*.log &\n", + "tail -Fc +0 /run/log/current /run/vm/by-id/*/serial &\n", vm_console_writer(vm)) == EOF) { fputs("error writing to console\n", stderr); exit(EXIT_FAILURE); diff --git a/release/checks/integration/portal.c b/release/checks/integration/portal.c index 6ba5654a..9af225e5 100644 --- a/release/checks/integration/portal.c +++ b/release/checks/integration/portal.c @@ -17,7 +17,7 @@ void test(struct config c) "mount \"$(findfs UUID=a7834806-2f82-4faf-8ac4-4f8fd8a474ca)\" /run/mnt && " "s6-rc -bu change vmm-env && " "vm-import user /run/mnt/vms && " - "(tail -Fc +0 /run/*.log &) && " + "(tail -Fc +0 /run/vm/by-id/*/serial &) && " "s6-svc -O /run/vm/by-name/user.portal/service && " "vm-start \"$(basename \"$(readlink /run/vm/by-name/user.portal)\")\" && " "s6-svwait -d /run/vm/by-name/user.portal/service\n", diff --git a/tools/start-vmm/lib.rs b/tools/start-vmm/lib.rs index dfbca8d8..a536f0f6 100644 --- a/tools/start-vmm/lib.rs +++ b/tools/start-vmm/lib.rs @@ -160,7 +160,7 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> { }, serial: ConsoleConfig { mode: "File", - file: Some(format!("/run/{vm_name}.log")), + file: Some(format!("/run/vm/by-id/{vm_name}/serial")), }, vsock: VsockConfig { cid: 3, diff --git a/tools/start-vmm/tests/vm_command-basic.rs b/tools/start-vmm/tests/vm_command-basic.rs index 95c43f86..2e9ad0c7 100644 --- a/tools/start-vmm/tests/vm_command-basic.rs +++ b/tools/start-vmm/tests/vm_command-basic.rs @@ -40,7 +40,7 @@ fn main() -> std::io::Result<()> { assert_eq!(config.memory.size, 0x40000000); assert!(config.memory.shared); assert_eq!(config.serial.mode, "File"); - assert_eq!(config.serial.file.unwrap(), "/run/testvm.log"); + assert_eq!(config.serial.file.unwrap(), "/run/vm/by-id/testvm/serial"); assert_eq!(config.vsock.cid, 3); assert_eq!(config.vsock.socket, "/run/vsock/testvm/vsock"); base-commit: 227a3ea149281b6dddb0c1ba70008fffb7404c1f -- 2.51.0

2 3

[PATCH] host/rootfs: add mount-userdata command
by Alyssa Ross 14 Dec '25

14 Dec '25

We shouldn't leave it to the user to manually mount user data partitions. We want to ensure restrictive mount flags are set, and be able to do other operations around the mounting. It's also nice to have a single place where all user data partitions can be mounted. I've taken inspiration from the FHS in using /media for this. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- .../development/persistent-storage.adoc | 19 ++++++++++----- .../using-spectrum/creating-custom-vms.adoc | 5 ++-- .../using-spectrum/vm-file-access.adoc | 4 ++-- host/rootfs/Makefile | 2 +- host/rootfs/file-list.mk | 1 + host/rootfs/image/etc/fstab | 11 +++++---- host/rootfs/image/usr/bin/mount-userdata | 24 +++++++++++++++++++ 7 files changed, 50 insertions(+), 16 deletions(-) create mode 100755 host/rootfs/image/usr/bin/mount-userdata diff --git a/Documentation/development/persistent-storage.adoc b/Documentation/development/persistent-storage.adoc index 12426b46..c4bcc163 100644 --- a/Documentation/development/persistent-storage.adoc +++ b/Documentation/development/persistent-storage.adoc @@ -2,7 +2,7 @@ :page-parent: Development :page-nav_order: 2 -// SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> +// SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> // SPDX-License-Identifier: GFDL-1.3-no-invariants-or-later OR CC-BY-SA-4.0 Spectrum's root filesystem is immutable, so if you want to be able to @@ -10,8 +10,15 @@ persist data between sessions, you'll need to create a persistent storage partition. Spectrum comes with `cryptsetup`, and in future is likely to assume that btrfs-specific features are available. -Conventionally, the persistent storage partition is mounted on /ext -after booting. It's not mounted automatically, because generally the -partition should be encrypted, meaning a key has to be supplied to -mount it anyway, and because there might be multiple persistent data -partitions to choose from. +Persistent storage can be mounted as follows: + +[source,shell] +---- +cryptsetup open /dev/sda1 userdata +mount-userdata /dev/mapper/userdata +---- + +It's not mounted automatically, because generally the partition should +be encrypted, meaning a key has to be supplied to mount it anyway, and +because there might be multiple persistent data partitions to choose +from. diff --git a/Documentation/using-spectrum/creating-custom-vms.adoc b/Documentation/using-spectrum/creating-custom-vms.adoc index a397ac50..1eca7f36 100644 --- a/Documentation/using-spectrum/creating-custom-vms.adoc +++ b/Documentation/using-spectrum/creating-custom-vms.adoc @@ -13,8 +13,9 @@ configurations are directories under a dedicated parent directory, and the name of each configuration directory determines the name of the VM. After mounting the persistent storage partition, the configured VMs can be made available by running `vm-import user -/ext/vms`, replacing /ext/vms with the directory containing the VM -definitions. +/media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/vms`, replacing +/media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/vms with the directory +containing the VM definitions. The directory can contain the following files: diff --git a/Documentation/using-spectrum/vm-file-access.adoc b/Documentation/using-spectrum/vm-file-access.adoc index 1b4fe9a5..a079cfe8 100644 --- a/Documentation/using-spectrum/vm-file-access.adoc +++ b/Documentation/using-spectrum/vm-file-access.adoc @@ -48,7 +48,7 @@ can be bind-mounted into it: + [listing] [source,shell] -echo "Hello, world!" > /ext/example.txt +echo "Hello, world!" > /media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/example.txt 2. Create an empty file to bind mount over: + @@ -60,5 +60,5 @@ touch /run/vm/by-name/user.appvm-example/fs/example.txt + [listing] [source,shell] -mount --rbind /ext/example.txt /run/vm/by-name/user.appvm-example/fs/example.txt +mount --rbind /media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/example.txt /run/vm/by-name/user.appvm-example/fs/example.txt ==== diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index 7bec1259..211fb5dd 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -33,8 +33,8 @@ DIRS = \ etc/s6-linux-init/run-image/user \ etc/s6-linux-init/run-image/vm/by-id \ etc/s6-linux-init/run-image/vm/by-name \ - ext \ home \ + media \ proc \ run \ sys \ diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index f69775d2..6bf40ff8 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -56,6 +56,7 @@ FILES = \ image/etc/xdg/weston/weston.ini \ image/usr/bin/assign-devices \ image/usr/bin/create-vm-dependencies \ + image/usr/bin/mount-userdata \ image/usr/bin/root-terminal \ image/usr/bin/run-appimage \ image/usr/bin/run-flatpak \ diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab index 5c23a374..18bb5e45 100644 --- a/host/rootfs/image/etc/fstab +++ b/host/rootfs/image/etc/fstab @@ -1,7 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 # SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi(a)alyssa.is> -proc /proc proc nosuid,nodev,noexec 0 0 -devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs nosuid,nodev 0 0 -sysfs /sys sysfs nosuid,nodev,noexec 0 0 -tmpfs /tmp tmpfs nosuid,nodev 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +tmpfs /media tmpfs nosuid,nodev,noexec,nosymfollow,mode=755 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +tmpfs /tmp tmpfs nosuid,nodev 0 0 diff --git a/host/rootfs/image/usr/bin/mount-userdata b/host/rootfs/image/usr/bin/mount-userdata new file mode 100755 index 00000000..e4a873c0 --- /dev/null +++ b/host/rootfs/image/usr/bin/mount-userdata @@ -0,0 +1,24 @@ +#!/bin/execlineb -W +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +backtick -D "" uuid { + importas -Siu 1 + blkid -o value -s UUID $1 +} + +multisubstitute { + importas -Siu 0 + importas -Siu 1 + importas -Siu uuid +} + +case $uuid { + "" { + fdmove -c 1 2 + printf "%s: '%s' does not have a UUID\n" $0 $1 + } +} + +if { mount -m -o nosuid,nodev,noexec,nosymfollow -- $1 /media/${uuid} } +printf "%s\n" /media/${uuid} base-commit: 1afc3a7042ee1c40b6d2e564219be31ea8f1017f -- 2.51.0

3 4