- Spectrum Development - spectrum-os.org

[PATCH v3 1/3] tools/router: use socket activation
by Alyssa Ross 14 Dec '25

14 Dec '25

This means we can use readiness notification to wait until the sockets are created without having to add special functionality for that to the router program, and also means we can do extra system-specific setup to the sockets, like changing their owners, outside of the router. Since the socket paths were the only arguments taken by the router, this also lets us drop the clap dependency entirely. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v3: • use anyhow::bail • set sockets to non-blocking in router v2: https://spectrum-os.org/lists/archives/spectrum-devel/20251209110503.674499… host/rootfs/file-list.mk | 1 + .../service/spectrum-router/notification-fd | 1 + .../spectrum-router/notification-fd.license | 2 + .../template/data/service/spectrum-router/run | 21 ++- tools/router/Cargo.lock | 148 ++++++++++++------ tools/router/Cargo.toml | 2 +- tools/router/src/main.rs | 40 +++-- 7 files changed, 141 insertions(+), 74 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce8..5a043b7b 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -28,6 +28,7 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \ + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd new file mode 100644 index 00000000..7ed6ff82 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd @@ -0,0 +1 @@ +5 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license new file mode 100644 index 00000000..0d3d47ca --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index 3ba35def..dc1ef900 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -1,14 +1,30 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> importas -i VM VM +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-driver.sock +fdmove -c 3 0 + +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-app.sock +fdmove -c 4 0 + +# Notify readiness. +if { + fdmove -c 5 1 + echo +} + +redirfd -r 0 /dev/null + bwrap --unshare-all --unshare-user --dev-bind / / --setenv RUST_LOG spectrum-router=debug,info + --setenv LISTEN_FDS 2 --tmpfs /tmp --dev /dev --tmpfs /dev/shm @@ -19,6 +35,7 @@ bwrap --ro-bind /lib /lib --bind /run/vm/by-id/${VM} /run/vm/by-id/${VM} -- + +getpid LISTEN_PID + spectrum-router - --app-listen-path /run/vm/by-id/${VM}/router-app.sock - --driver-listen-path /run/vm/by-id/${VM}/router-driver.sock diff --git a/tools/router/Cargo.lock b/tools/router/Cargo.lock index 60d7657b..d0d105aa 100644 --- a/tools/router/Cargo.lock +++ b/tools/router/Cargo.lock @@ -113,6 +113,12 @@ dependencies = [ "wyz", ] +[[package]] +name = "bumpalo" +version = "3.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43" + [[package]] name = "bytes" version = "1.11.0" @@ -120,44 +126,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3" [[package]] -name = "clap" -version = "4.5.53" +name = "cfg-if" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8" -dependencies = [ - "clap_builder", - "clap_derive", -] - -[[package]] -name = "clap_builder" -version = "4.5.53" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00" -dependencies = [ - "anstream", - "anstyle", - "clap_lex", - "strsim", -] - -[[package]] -name = "clap_derive" -version = "4.5.49" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671" -dependencies = [ - "heck", - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "clap_lex" -version = "0.7.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "colorchoice" @@ -263,12 +235,6 @@ dependencies = [ "slab", ] -[[package]] -name = "heck" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" - [[package]] name = "is_terminal_polyfill" version = "1.70.2" @@ -299,12 +265,33 @@ dependencies = [ "syn", ] +[[package]] +name = "js-sys" +version = "0.3.83" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8" +dependencies = [ + "once_cell", + "wasm-bindgen", +] + [[package]] name = "libc" version = "0.2.177" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" +[[package]] +name = "listenfd" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b87bc54a4629b4294d0b3ef041b64c40c611097a677d9dc07b2c67739fe39dba" +dependencies = [ + "libc", + "uuid", + "winapi", +] + [[package]] name = "log" version = "0.4.28" @@ -328,6 +315,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + [[package]] name = "once_cell_polyfill" version = "1.70.2" @@ -420,6 +413,12 @@ version = "0.8.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58" +[[package]] +name = "rustversion" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" + [[package]] name = "serde_core" version = "1.0.228" @@ -462,9 +461,9 @@ version = "0.1.0" dependencies = [ "anyhow", "arrayvec", - "clap", "env_logger", "futures-util", + "listenfd", "log", "tokio", "tokio-stream", @@ -474,12 +473,6 @@ dependencies = [ "zerocopy", ] -[[package]] -name = "strsim" -version = "0.11.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" - [[package]] name = "syn" version = "2.0.111" @@ -608,6 +601,16 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" +[[package]] +name = "uuid" +version = "1.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + [[package]] name = "vhost-device-net" version = "0.1.1" @@ -666,6 +669,51 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" +[[package]] +name = "wasm-bindgen" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd" +dependencies = [ + "cfg-if", + "once_cell", + "rustversion", + "wasm-bindgen-macro", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-macro" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3" +dependencies = [ + "quote", + "wasm-bindgen-macro-support", +] + +[[package]] +name = "wasm-bindgen-macro-support" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40" +dependencies = [ + "bumpalo", + "proc-macro2", + "quote", + "syn", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-shared" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4" +dependencies = [ + "unicode-ident", +] + [[package]] name = "winapi" version = "0.3.9" diff --git a/tools/router/Cargo.toml b/tools/router/Cargo.toml index 0b969113..cfdf3527 100644 --- a/tools/router/Cargo.toml +++ b/tools/router/Cargo.toml @@ -8,7 +8,6 @@ edition = "2024" [dependencies] anyhow = "1.0.100" -clap = { version = "4.5.45", features = ["derive"] } env_logger = "0.11.8" log = { version = "0.4.27", features = ["release_max_level_debug"] } vhost-device-net = "0.1.0" @@ -19,3 +18,4 @@ tokio-stream = "0.1.17" arrayvec = "0.7.6" vm-memory = "0.16" tokio-util = "0.7.17" +listenfd = "1.0.2" diff --git a/tools/router/src/main.rs b/tools/router/src/main.rs index e3aca65a..3b26ddb0 100644 --- a/tools/router/src/main.rs +++ b/tools/router/src/main.rs @@ -1,47 +1,45 @@ // SPDX-License-Identifier: EUPL-1.2+ // SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> pub(crate) mod packet; pub(crate) mod protocol; mod router; mod upstream; -use std::path::PathBuf; - use packet::*; use router::{InterfaceId, Router}; use upstream::Upstream; -use clap::Parser; +use anyhow::bail; use futures_util::{SinkExt, TryStreamExt}; +use listenfd::ListenFd; use log::{error, info}; use tokio::net::UnixListener; use vhost_device_net::{IncomingPacket, VhostDeviceNet}; use vm_memory::GuestMemoryMmap; -#[derive(Parser, Debug)] -#[command()] //version = None, about = None, long_about = None)] -struct Args { - #[arg(long)] - driver_listen_path: PathBuf, - #[arg(long)] - app_listen_path: PathBuf, -} - fn main() -> anyhow::Result<()> { env_logger::init(); - let args = Args::parse(); - for path in [&args.driver_listen_path, &args.app_listen_path] { - let _ = std::fs::remove_file(path); - } - - run_router(args) + run_router() } #[tokio::main(flavor = "current_thread")] -async fn run_router(args: Args) -> anyhow::Result<()> { - let app_listener = UnixListener::bind(&args.app_listen_path)?; - let driver_listener = UnixListener::bind(&args.driver_listen_path)?; +async fn run_router() -> anyhow::Result<()> { + let mut listenfd = ListenFd::from_env(); + + let Some(driver_listener) = listenfd.take_unix_listener(0)? else { + bail!("not activated with driver socket"); + }; + let Some(app_listener) = listenfd.take_unix_listener(1)? else { + bail!("not activated with app socket"); + }; + + driver_listener.set_nonblocking(true)?; + app_listener.set_nonblocking(true)?; + + let driver_listener = UnixListener::from_std(driver_listener)?; + let app_listener = UnixListener::from_std(app_listener)?; let mut router = Router::<GuestMemoryMmap>::new(InterfaceId::Upstream); -- 2.51.0

2 5

[PATCH 1/4] host/rootfs: make fs root directories shared
by Alyssa Ross 13 Dec '25

13 Dec '25

We want every mount under here to show up inside the virtiofsd sandbox. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/image/usr/bin/create-vm-dependencies | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies index 9e123fcf..6bf12d03 100755 --- a/host/rootfs/image/usr/bin/create-vm-dependencies +++ b/host/rootfs/image/usr/bin/create-vm-dependencies @@ -30,8 +30,8 @@ if { # Needs to be shared so that additional mounts under config/ (e.g. from # mount-flatpak) will be propagated into the virtiofsd sandbox. - if { mount --make-shared --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } - if { mount --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --make-shared --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } # Needs to be shared so that when xdg-document-portal mounts its fuse # filesystem at /run/doc/${1}/doc, it will propagate to /run/fs/${1}/doc. base-commit: ce1cfde4bf845cb1104e0eddc4128a2c3d517fb0 -- 2.51.0

2 5

[PATCH 1/2] img/app: change virtio-fs tag to "host"
by Alyssa Ross 12 Dec '25

12 Dec '25

It doesn't seem likely to me that we'll have multiple virtio-fs devices from the host, so let's use something a bit more clear and precise. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Documentation/using-spectrum/creating-custom-vms.adoc | 2 +- img/app/Makefile | 4 ++-- img/app/image/etc/mdev/virtiofs | 2 +- img/app/scripts/start-virtiofsd.elb | 2 +- release/checks/wayland/default.nix | 4 ++-- tools/start-vmm/lib.rs | 2 +- tools/start-vmm/tests/vm_command-basic.rs | 2 +- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Documentation/using-spectrum/creating-custom-vms.adoc b/Documentation/using-spectrum/creating-custom-vms.adoc index a397ac50..8d915e1a 100644 --- a/Documentation/using-spectrum/creating-custom-vms.adoc +++ b/Documentation/using-spectrum/creating-custom-vms.adoc @@ -91,7 +91,7 @@ should configure `eth0` with the IPv4 address `100.64.165.70` (because === Filesystem Every VM has a virtio-fs device that exposes the /run/vm/by-id/_VM -ID_/fs directory on the host, with the tag "virtiofs0". The VM cannot +ID_/fs directory on the host, with the tag "host". The VM cannot write directly into that directory, but it's possible to create a subdirectory on the host and bind mount a directory from a writeable filesystem into it to provide the VM with access to shared storage. diff --git a/img/app/Makefile b/img/app/Makefile index 7354f892..69c85bba 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -99,7 +99,7 @@ run-qemu: $(imgdir)/appvm/blk/root.img start-vhost-user-net start-virtiofsd -netdev vhost-user,id=net0,chardev=vhost-user-net \ -device virtio-net,netdev=net0,mac=02:00:00:00:00:01 \ -chardev socket,id=virtiofsd,path=build/virtiofsd.sock \ - -device vhost-user-fs-pci,chardev=virtiofsd,tag=virtiofs0 \ + -device vhost-user-fs-pci,chardev=virtiofsd,tag=host \ -device virtio-gpu-rutabaga-pci,cross-domain=on,hostmem=8G \ -audio driver=pipewire,model=virtio \ -object memory-backend-memfd,id=mem,size=256M,share=on \ @@ -117,7 +117,7 @@ run-cloud-hypervisor: $(imgdir)/appvm/blk/root.img start-vhost-user-gpu start-vh --api-socket path=build/vmm.sock \ --memory size=1G,shared=on \ --disk path=$(imgdir)/appvm/blk/root.img,readonly=on \ - --fs tag=virtiofs0,socket=build/virtiofsd.sock \ + --fs tag=host,socket=build/virtiofsd.sock \ --gpu socket=build/vhost-user-gpu.sock \ --vsock cid=3,socket=build/vsock.sock \ --net mac=02:00:00:00:00:01,vhost_user=on,socket=build/vhost-user-net.sock \ diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs index b6e505bc..bda77483 100755 --- a/img/app/image/etc/mdev/virtiofs +++ b/img/app/image/etc/mdev/virtiofs @@ -7,6 +7,6 @@ background { # virtiofs filesystems, so we only supported a single, hardcoded # filesystem tag for now. if { mkdir -p /run/virtiofs/virtiofs0 } - if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 } + if { mount -t virtiofs -o nodev host /run/virtiofs/virtiofs0 } /etc/mdev/listen virtiofs0 } diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb index fa3a234e..9efb436b 100755 --- a/img/app/scripts/start-virtiofsd.elb +++ b/img/app/scripts/start-virtiofsd.elb @@ -11,5 +11,5 @@ background { if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config } unshare --map-user 1000 --map-group 1000 importas -SsD virtiofsd VIRTIOFSD - $VIRTIOFSD --fd 0 --shared-dir build/fs --tag virtiofs0 + $VIRTIOFSD --fd 0 --shared-dir build/fs --tag host } diff --git a/release/checks/wayland/default.nix b/release/checks/wayland/default.nix index a053e605..55c7d6d1 100644 --- a/release/checks/wayland/default.nix +++ b/release/checks/wayland/default.nix @@ -32,7 +32,7 @@ testers.nixosTest ({ lib, pkgs, ... }: { systemd.services.cloud-hypervisor = { after = [ "crosvm-gpu.service" "weston.service" ]; requires = [ "crosvm-gpu.service" "weston.service" ]; - serviceConfig.ExecStart = "${lib.getExe pkgs.cloud-hypervisor} --memory shared=on --disk path=${appvm}/lib/spectrum/img/appvm/blk/root.img,readonly=on --cmdline \"console=ttyS0 root=PARTLABEL=root\" --fs socket=/run/virtiofsd.sock,tag=virtiofs0 --gpu socket=/run/crosvm-gpu.sock --vsock cid=3,socket=/run/vsock.sock --serial tty --console null --kernel ${appvm}/lib/spectrum/img/appvm/vmlinux"; + serviceConfig.ExecStart = "${lib.getExe pkgs.cloud-hypervisor} --memory shared=on --disk path=${appvm}/lib/spectrum/img/appvm/blk/root.img,readonly=on --cmdline \"console=ttyS0 root=PARTLABEL=root\" --fs socket=/run/virtiofsd.sock,tag=host --gpu socket=/run/crosvm-gpu.sock --vsock cid=3,socket=/run/vsock.sock --serial tty --console null --kernel ${appvm}/lib/spectrum/img/appvm/vmlinux"; }; systemd.services.crosvm = { @@ -79,7 +79,7 @@ testers.nixosTest ({ lib, pkgs, ... }: { }; systemd.services.virtiofsd = { - serviceConfig.ExecStart = "${lib.getExe pkgs.virtiofsd} --fd 3 --shared-dir /shared --tag virtiofs0"; + serviceConfig.ExecStart = "${lib.getExe pkgs.virtiofsd} --fd 3 --shared-dir /shared --tag host"; serviceConfig.Restart = "on-success"; requires = [ "shared-config.mount" ]; after = [ "shared-config.mount" ]; diff --git a/tools/start-vmm/lib.rs b/tools/start-vmm/lib.rs index b44e0375..4b2aedda 100644 --- a/tools/start-vmm/lib.rs +++ b/tools/start-vmm/lib.rs @@ -81,7 +81,7 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> { Err(e) => return Err(format!("reading directory {blk_dir:?}: {e}")), }, fs: [FsConfig { - tag: "virtiofs0", + tag: "host", socket: format!( "/run/service/vm-services/instance/{vm_name}/data/service/vhost-user-fs/env/virtiofsd.sock" ), diff --git a/tools/start-vmm/tests/vm_command-basic.rs b/tools/start-vmm/tests/vm_command-basic.rs index 866a6e19..533e2d2d 100644 --- a/tools/start-vmm/tests/vm_command-basic.rs +++ b/tools/start-vmm/tests/vm_command-basic.rs @@ -28,7 +28,7 @@ fn main() -> std::io::Result<()> { assert!(disk1.readonly); assert_eq!(config.fs.len(), 1); let fs1 = &config.fs[0]; - assert_eq!(fs1.tag, "virtiofs0"); + assert_eq!(fs1.tag, "host"); let expected = "/run/service/vm-services/instance/testvm/data/service/vhost-user-fs/env/virtiofsd.sock"; assert_eq!(fs1.socket, expected); base-commit: 814a589b2b0fb4eeed06e1a1a9ce536f6b5ee91d -- 2.51.0

1 1

[PATCH v2 1/8] host/rootfs: create dbus socket externally
by Alyssa Ross 12 Dec '25

12 Dec '25

This is the first step towards running dbus as non-root. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: no change .../template/data/service/dbus/notification-fd | 2 +- .../data/service/dbus/notification-fd.license | 2 +- .../vm-services/template/data/service/dbus/run | 13 +++++++++++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd index 00750edc..b8626c4c 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd @@ -1 +1 @@ -3 +4 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license index 5a406331..0d3d47ca 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license @@ -1,2 +1,2 @@ SPDX-License-Identifier: CC0-1.0 -SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run index 40b75355..365e1697 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run @@ -4,10 +4,19 @@ importas -i VM VM +s6-ipcserver-socketbinder -B /run/vm/by-id/${VM}/portal-bus + +fdmove -c 3 0 +redirfd -r 0 /dev/null + nsenter --mount=/run/vm/by-id/${VM}/mount unshare --cgroup --ipc --net --uts + +export LISTEN_FDS 1 +getpid LISTEN_PID + dbus-daemon --config-file /usr/share/dbus-1/session.conf - --print-address 3 - --address unix:path=/run/vm/by-id/${VM}/portal-bus + --print-address 4 + --address systemd: base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f -- 2.51.0

2 8

[PATCH 1/8] host/rootfs: create dbus socket externally
by Alyssa Ross 12 Dec '25

12 Dec '25

This is the first step towards running dbus as non-root. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- .../template/data/service/dbus/notification-fd | 2 +- .../data/service/dbus/notification-fd.license | 2 +- .../vm-services/template/data/service/dbus/run | 13 +++++++++++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd index 00750edc..b8626c4c 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd @@ -1 +1 @@ -3 +4 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license index 5a406331..0d3d47ca 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license @@ -1,2 +1,2 @@ SPDX-License-Identifier: CC0-1.0 -SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run index 40b75355..365e1697 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run @@ -4,10 +4,19 @@ importas -i VM VM +s6-ipcserver-socketbinder -B /run/vm/by-id/${VM}/portal-bus + +fdmove -c 3 0 +redirfd -r 0 /dev/null + nsenter --mount=/run/vm/by-id/${VM}/mount unshare --cgroup --ipc --net --uts + +export LISTEN_FDS 1 +getpid LISTEN_PID + dbus-daemon --config-file /usr/share/dbus-1/session.conf - --print-address 3 - --address unix:path=/run/vm/by-id/${VM}/portal-bus + --print-address 4 + --address systemd: -- 2.51.0

2 20

[PATCH] Set restrictive mount options
by Alyssa Ross 11 Dec '25

11 Dec '25

These are mostly copied from systemd, so should be pretty safe in terms of compatibility. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/initramfs/etc/fstab | 8 ++++---- host/initramfs/etc/init | 2 +- host/rootfs/image/etc/fstab | 12 ++++++------ img/app/image/etc/fstab | 12 ++++++------ img/app/image/etc/mdev/virtiofs | 2 +- img/app/image/etc/s6-rc/app/run | 4 ++-- img/app/scripts/start-virtiofsd.elb | 2 +- vm/app/systemd-sysupdate/download-update | 2 +- vm/sys/net/image/etc/fstab | 12 ++++++------ 9 files changed, 28 insertions(+), 28 deletions(-) diff --git a/host/initramfs/etc/fstab b/host/initramfs/etc/fstab index 3dfb05ab..9f43a1a9 100644 --- a/host/initramfs/etc/fstab +++ b/host/initramfs/etc/fstab @@ -1,5 +1,5 @@ # SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> -devtmpfs /dev devtmpfs defaults 0 0 -proc /proc proc defaults 0 0 -sysfs /sys sysfs defaults 0 0 +# SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi(a)alyssa.is> +devtmpfs /dev devtmpfs nosuid 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init index 71948874..723d2e1b 100755 --- a/host/initramfs/etc/init +++ b/host/initramfs/etc/init @@ -42,7 +42,7 @@ if { background { rm /dev/rootfs /dev/verity } -if { mount /dev/mapper/root-verity /mnt/root } +if { mount -o nosuid,nodev /dev/mapper/root-verity /mnt/root } wait { $mdevd_pid } if { mount --move /proc /mnt/root/proc } diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab index 6230d910..5c23a374 100644 --- a/host/rootfs/image/etc/fstab +++ b/host/rootfs/image/etc/fstab @@ -1,7 +1,7 @@ # SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> -proc /proc proc defaults 0 0 -devpts /dev/pts devpts gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs defaults 0 0 -sysfs /sys sysfs defaults 0 0 -tmpfs /tmp tmpfs defaults 0 0 +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi(a)alyssa.is> +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +tmpfs /tmp tmpfs nosuid,nodev 0 0 diff --git a/img/app/image/etc/fstab b/img/app/image/etc/fstab index 2dd1f4d8..5f78ab87 100644 --- a/img/app/image/etc/fstab +++ b/img/app/image/etc/fstab @@ -1,8 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 # SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross <hi(a)alyssa.is> -proc /proc proc defaults 0 0 -devpts /dev/pts devpts gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs defaults 0 0 -sysfs /sys sysfs defaults 0 0 -tmpfs /tmp tmpfs defaults 0 0 -tmpfs /home/user tmpfs mode=0700,uid=1000,gid=1000 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +tmpfs /tmp tmpfs nosuid,nodev 0 0 +tmpfs /home/user tmpfs nodev,mode=0700,uid=1000,gid=1000 0 0 diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs index c1fd2834..b6e505bc 100755 --- a/img/app/image/etc/mdev/virtiofs +++ b/img/app/image/etc/mdev/virtiofs @@ -7,6 +7,6 @@ background { # virtiofs filesystems, so we only supported a single, hardcoded # filesystem tag for now. if { mkdir -p /run/virtiofs/virtiofs0 } - if { mount -t virtiofs virtiofs0 /run/virtiofs/virtiofs0 } + if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 } /etc/mdev/listen virtiofs0 } diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run index 0ba1f374..997897de 100755 --- a/img/app/image/etc/s6-rc/app/run +++ b/img/app/image/etc/s6-rc/app/run @@ -17,7 +17,7 @@ foreground { if { modprobe loop } if { backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset } - mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt + mount -o offset=${offset},nodev /run/virtiofs/virtiofs0/config/run /mnt } s6-setuidgid user export APPIMAGE /run/virtiofs/virtiofs0/config/run @@ -42,7 +42,7 @@ foreground { nix { if { mount -t overlay - -o ro,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store + -o ro,nosuid,nodev,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store store /nix/store } diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb index e4d265f0..cedce9ae 100755 --- a/img/app/scripts/start-virtiofsd.elb +++ b/img/app/scripts/start-virtiofsd.elb @@ -6,7 +6,7 @@ s6-ipcserver-socketbinder -B build/virtiofsd.sock background { if { mkdir -p build/fs } unshare -rUm - if { mount -t tmpfs fs build/fs } + if { mount -t tmpfs -o nosuid,nodev fs build/fs } if { mkdir build/fs/config } if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config } importas -SsD virtiofsd VIRTIOFSD diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update index facf7f52..b397f238 100755 --- a/vm/app/systemd-sysupdate/download-update +++ b/vm/app/systemd-sysupdate/download-update @@ -5,7 +5,7 @@ export LC_ALL C export LANGUAGE C unshare -mr -if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } +if { mount -toverlay -o nosuid,nodev,lowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX } # Not a useless use of cat: if there are NUL bytes in the URL # busybox's awk might misbehave. diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab index a0b62fa5..4c240544 100644 --- a/vm/sys/net/image/etc/fstab +++ b/vm/sys/net/image/etc/fstab @@ -1,8 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> -proc /proc proc defaults 0 0 -devpts /dev/pts devpts gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs defaults 0 0 -sysfs /sys sysfs defaults 0 0 -bpffs /sys/fs/bpf bpf defaults 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +bpffs /sys/fs/bpf bpf nosuid,nodev,noexec,mode=700 0 0 base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f -- 2.51.0

3 4

[PATCH 1/2] host/rootfs: add root-terminal s6-sudod service
by Alyssa Ross 10 Dec '25

10 Dec '25

This will be needed as an interim measure to allow Weston itself to be run as non-root, without the user losing access to root entirely in the graphical environment. Currently, only root can access this service, so it's redundant, but we can later make the socket accessible to Weston's user. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/file-list.mk | 3 +++ .../service/root-terminal/notification-fd | 1 + .../service/root-terminal/notification-fd.license | 2 ++ .../run-image/service/root-terminal/run | 15 +++++++++++++++ host/rootfs/image/etc/xdg/weston/weston.ini | 4 ++-- host/rootfs/image/usr/bin/root-terminal | 5 +++++ 6 files changed, 28 insertions(+), 2 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license create mode 100755 host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run create mode 100755 host/rootfs/image/usr/bin/root-terminal diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index 6ab78e6b..f69775d2 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -15,6 +15,8 @@ FILES = \ image/etc/s6-linux-init/run-image/service/getty-tty2/run \ image/etc/s6-linux-init/run-image/service/getty-tty3/run \ image/etc/s6-linux-init/run-image/service/getty-tty4/run \ + image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd \ + image/etc/s6-linux-init/run-image/service/root-terminal/run \ image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd \ image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run \ image/etc/s6-linux-init/run-image/service/s6-svscan-log/notification-fd \ @@ -54,6 +56,7 @@ FILES = \ image/etc/xdg/weston/weston.ini \ image/usr/bin/assign-devices \ image/usr/bin/create-vm-dependencies \ + image/usr/bin/root-terminal \ image/usr/bin/run-appimage \ image/usr/bin/run-flatpak \ image/usr/bin/run-vmm \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd new file mode 100644 index 00000000..00750edc --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd @@ -0,0 +1 @@ +3 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license new file mode 100644 index 00000000..0d3d47ca --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run new file mode 100755 index 00000000..67ccfb45 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run @@ -0,0 +1,15 @@ +#!/bin/execlineb -PW +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +s6-ipcserver-socketbinder -a 0700 /run/root-terminal + +fdmove 1 3 +s6-ipcserverd -1P + +exec -c +/bin/export PATH /usr/bin +/bin/export WAYLAND_DISPLAY "" +s6-sudod +cd / +weston-terminal diff --git a/host/rootfs/image/etc/xdg/weston/weston.ini b/host/rootfs/image/etc/xdg/weston/weston.ini index a1f630cf..a4763c6d 100644 --- a/host/rootfs/image/etc/xdg/weston/weston.ini +++ b/host/rootfs/image/etc/xdg/weston/weston.ini @@ -6,8 +6,8 @@ path=/etc/xdg/weston/autolaunch [launcher] icon=/usr/share/weston/icon_terminal.png -displayname=Terminal -path=/bin/weston-terminal +displayname=Root Terminal +path=/bin/root-terminal [launcher] icon=/usr/share/icons/hicolor/20x20/apps/com.system76.CosmicFiles.png diff --git a/host/rootfs/image/usr/bin/root-terminal b/host/rootfs/image/usr/bin/root-terminal new file mode 100755 index 00000000..4f2874d1 --- /dev/null +++ b/host/rootfs/image/usr/bin/root-terminal @@ -0,0 +1,5 @@ +#!/bin/execlineb -Ws0 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +s6-sudo -- /run/root-terminal $@ -- 2.51.0

3 7

[PATCH 1/2] host/rootfs: atomically delete VM directories
by Alyssa Ross 10 Dec '25

10 Dec '25

Create a hidden empty directory, swap it with the original one, then remove both. Teach lsvm to ignore both hidden and empty directories, and now we no longer have a race where lsvm would get confused if a VM directory was in the process of being recursively removed when it looked at it. Fixes: b51a97f ("host/rootfs: add run-appimage program") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/image/usr/bin/run-appimage | 7 ++++++- host/rootfs/image/usr/bin/run-flatpak | 7 ++++++- tools/lsvm.rs | 19 ++++++++++++++----- 3 files changed, 26 insertions(+), 7 deletions(-) diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage index 36f57b85..d61a79c6 100755 --- a/host/rootfs/image/usr/bin/run-appimage +++ b/host/rootfs/image/usr/bin/run-appimage @@ -43,4 +43,9 @@ if { s6-instance-delete /run/service/vm-services $id } if { umount ${dir}/mount } # mount namespace if { umount ${dir}/mount } # private bind mount -rm -r $dir /run/configs/${id} + +# Atomically swap the VM directory with an empty one, which will be ignored by +# lsvm, then remove it, so we never have half a VM directory. +if { mkdir /run/vm/by-id/.${id} } +if { exch /run/vm/by-id/.${id} $dir } +background { rm -rf /run/vm/by-id/.${id} $dir } diff --git a/host/rootfs/image/usr/bin/run-flatpak b/host/rootfs/image/usr/bin/run-flatpak index 2ef20433..6be21075 100755 --- a/host/rootfs/image/usr/bin/run-flatpak +++ b/host/rootfs/image/usr/bin/run-flatpak @@ -45,4 +45,9 @@ if { s6-instance-delete -- /run/service/vm-services $id } if { umount ${dir}/mount } # mount namespace if { umount ${dir}/mount } # private bind mount -rm -r $dir /run/configs/${id} + +# Atomically swap the VM directory with an empty one, which will be ignored by +# lsvm, then remove it, so we never have half a VM directory. +if { mkdir /run/vm/by-id/.${id} } +if { exch /run/vm/by-id/.${id} $dir } +background { rm -rf /run/vm/by-id/.${id} $dir } diff --git a/tools/lsvm.rs b/tools/lsvm.rs index 8f98e4f6..5d67ac6f 100644 --- a/tools/lsvm.rs +++ b/tools/lsvm.rs @@ -81,12 +81,21 @@ fn run() -> Result<(), String> { for entry in read_dir("/run/vm/by-id").map_err(|e| format!("reading /run/vm/by-id: {e}"))? { let entry = entry.map_err(|e| format!("iterating /run/vm/by-id: {e}"))?; - if entry - .file_type() - .map_err(|e| format!("getting type of {:?}: {e}", entry.path()))? - .is_dir() + if !entry.file_name().as_bytes().starts_with(b".") + && entry + .file_type() + .map_err(|e| format!("getting type of {:?}: {e}", entry.path()))? + .is_dir() { - names.insert(entry.file_name(), Vec::new()); + let path = entry.path(); + if path + .read_dir() + .map_err(|e| format!("reading {path:?}: {e}"))? + .next() + .is_some() + { + names.insert(entry.file_name(), Vec::new()); + } } } -- 2.51.0

1 1

[PATCH v2 1/6] host/rootfs: make passwd and group links into /run
by Alyssa Ross 09 Dec '25

09 Dec '25

This will allow us to give shadow's useradd /run as a prefix, and have it be able to add users at runtime. Reviewed-by: Demi Marie Obenour <demiobenour(a)gmail.com> Signed-off-by: Alyssa Ross <hi(a)alyssa.is> Message-ID: <20251209085628.603316-1-hi(a)alyssa.is> --- v2: use relative paths for symlink targets v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251209085628.603316… host/rootfs/file-list.mk | 6 ++++-- host/rootfs/image/etc/group | 16 +--------------- host/rootfs/image/etc/passwd | 2 +- .../etc/{ => s6-linux-init/run-image/etc}/group | 0 .../run-image/etc}/group.license | 0 .../etc/{ => s6-linux-init/run-image/etc}/passwd | 0 .../run-image/etc}/passwd.license | 0 7 files changed, 6 insertions(+), 18 deletions(-) mode change 100644 => 120000 host/rootfs/image/etc/group mode change 100644 => 120000 host/rootfs/image/etc/passwd copy host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/group (100%) rename host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/group.license (100%) copy host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/passwd (100%) rename host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/passwd.license (100%) diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce8..6ab78e6b 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -4,13 +4,13 @@ FILES = \ image/etc/fonts/fonts.conf \ image/etc/fstab \ - image/etc/group \ image/etc/init \ image/etc/login \ image/etc/parse-devname \ - image/etc/passwd \ image/etc/s6-linux-init/env/WAYLAND_DISPLAY \ image/etc/s6-linux-init/env/XDG_RUNTIME_DIR \ + image/etc/s6-linux-init/run-image/etc/group \ + image/etc/s6-linux-init/run-image/etc/passwd \ image/etc/s6-linux-init/run-image/service/getty-tty1/run \ image/etc/s6-linux-init/run-image/service/getty-tty2/run \ image/etc/s6-linux-init/run-image/service/getty-tty3/run \ @@ -68,6 +68,8 @@ FILES = \ LINKS = \ image/bin \ + image/etc/group \ + image/etc/passwd \ image/etc/s6-linux-init/run-image/opengl-driver \ image/etc/s6-linux-init/run-image/service/vmm/template/run \ image/lib \ diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group deleted file mode 100644 index e3ade468..00000000 --- a/host/rootfs/image/etc/group +++ /dev/null @@ -1,15 +0,0 @@ -root:x:0:root -clock:x:1: -dialout:x:2: -kmem:x:3: -input:x:4: -tty:x:5: -video:x:6: -render:x:7: -sgx:x:8: -audio:x:9: -lp:x:10: -disk:x:11: -cdrom:x:12: -tape:x:13: -kvm:x:14: diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group new file mode 120000 index 00000000..8dba62ad --- /dev/null +++ b/host/rootfs/image/etc/group @@ -0,0 +1 @@ +../run/etc/group \ No newline at end of file diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd deleted file mode 100644 index 29f3b252..00000000 --- a/host/rootfs/image/etc/passwd +++ /dev/null @@ -1 +0,0 @@ -root:x:0:0:System administrator:/:/bin/sh diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd new file mode 120000 index 00000000..1429c284 --- /dev/null +++ b/host/rootfs/image/etc/passwd @@ -0,0 +1 @@ +../run/etc/passwd \ No newline at end of file diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group similarity index 100% copy from host/rootfs/image/etc/group copy to host/rootfs/image/etc/s6-linux-init/run-image/etc/group diff --git a/host/rootfs/image/etc/group.license b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group.license similarity index 100% rename from host/rootfs/image/etc/group.license rename to host/rootfs/image/etc/s6-linux-init/run-image/etc/group.license diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd similarity index 100% copy from host/rootfs/image/etc/passwd copy to host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd diff --git a/host/rootfs/image/etc/passwd.license b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd.license similarity index 100% rename from host/rootfs/image/etc/passwd.license rename to host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd.license -- 2.51.0

2 11

[PATCH 1/3] tools/router: use socket activation
by Alyssa Ross 09 Dec '25

09 Dec '25

This means we can use readiness notification to wait until the sockets are created without having to add special functionality for that to the router program, and also means we can do extra system-specific setup to the sockets, like changing their owners, outside of the router. Since the socket paths were the only arguments taken by the router, this also lets us drop the clap dependency entirely. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/file-list.mk | 1 + .../service/spectrum-router/notification-fd | 1 + .../spectrum-router/notification-fd.license | 2 + .../template/data/service/spectrum-router/run | 19 +++ tools/router/Cargo.lock | 148 ++++++++++++------ tools/router/Cargo.toml | 2 +- tools/router/src/main.rs | 37 ++--- 7 files changed, 138 insertions(+), 72 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce..5a043b7 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -28,6 +28,7 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \ + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd new file mode 100644 index 0000000..7ed6ff8 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd @@ -0,0 +1 @@ +5 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license new file mode 100644 index 0000000..0d3d47c --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index 3ba35de..61375ca 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -1,14 +1,30 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> importas -i VM VM +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-driver.sock +fdmove -c 3 0 + +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-app.sock +fdmove -c 4 0 + +# Notify readiness. +if { + fdmove -c 5 1 + echo +} + +redirfd -r 0 /dev/null + bwrap --unshare-all --unshare-user --dev-bind / / --setenv RUST_LOG spectrum-router=debug,info + --setenv LISTEN_FDS 2 --tmpfs /tmp --dev /dev --tmpfs /dev/shm @@ -19,6 +35,9 @@ bwrap --ro-bind /lib /lib --bind /run/vm/by-id/${VM} /run/vm/by-id/${VM} -- + +getpid LISTEN_PID + spectrum-router --app-listen-path /run/vm/by-id/${VM}/router-app.sock --driver-listen-path /run/vm/by-id/${VM}/router-driver.sock diff --git a/tools/router/Cargo.lock b/tools/router/Cargo.lock index 60d7657..d0d105a 100644 --- a/tools/router/Cargo.lock +++ b/tools/router/Cargo.lock @@ -113,6 +113,12 @@ dependencies = [ "wyz", ] +[[package]] +name = "bumpalo" +version = "3.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43" + [[package]] name = "bytes" version = "1.11.0" @@ -120,44 +126,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3" [[package]] -name = "clap" -version = "4.5.53" +name = "cfg-if" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8" -dependencies = [ - "clap_builder", - "clap_derive", -] - -[[package]] -name = "clap_builder" -version = "4.5.53" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00" -dependencies = [ - "anstream", - "anstyle", - "clap_lex", - "strsim", -] - -[[package]] -name = "clap_derive" -version = "4.5.49" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671" -dependencies = [ - "heck", - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "clap_lex" -version = "0.7.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "colorchoice" @@ -263,12 +235,6 @@ dependencies = [ "slab", ] -[[package]] -name = "heck" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" - [[package]] name = "is_terminal_polyfill" version = "1.70.2" @@ -299,12 +265,33 @@ dependencies = [ "syn", ] +[[package]] +name = "js-sys" +version = "0.3.83" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8" +dependencies = [ + "once_cell", + "wasm-bindgen", +] + [[package]] name = "libc" version = "0.2.177" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" +[[package]] +name = "listenfd" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b87bc54a4629b4294d0b3ef041b64c40c611097a677d9dc07b2c67739fe39dba" +dependencies = [ + "libc", + "uuid", + "winapi", +] + [[package]] name = "log" version = "0.4.28" @@ -328,6 +315,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + [[package]] name = "once_cell_polyfill" version = "1.70.2" @@ -420,6 +413,12 @@ version = "0.8.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58" +[[package]] +name = "rustversion" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" + [[package]] name = "serde_core" version = "1.0.228" @@ -462,9 +461,9 @@ version = "0.1.0" dependencies = [ "anyhow", "arrayvec", - "clap", "env_logger", "futures-util", + "listenfd", "log", "tokio", "tokio-stream", @@ -474,12 +473,6 @@ dependencies = [ "zerocopy", ] -[[package]] -name = "strsim" -version = "0.11.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" - [[package]] name = "syn" version = "2.0.111" @@ -608,6 +601,16 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" +[[package]] +name = "uuid" +version = "1.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + [[package]] name = "vhost-device-net" version = "0.1.1" @@ -666,6 +669,51 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" +[[package]] +name = "wasm-bindgen" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd" +dependencies = [ + "cfg-if", + "once_cell", + "rustversion", + "wasm-bindgen-macro", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-macro" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3" +dependencies = [ + "quote", + "wasm-bindgen-macro-support", +] + +[[package]] +name = "wasm-bindgen-macro-support" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40" +dependencies = [ + "bumpalo", + "proc-macro2", + "quote", + "syn", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-shared" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4" +dependencies = [ + "unicode-ident", +] + [[package]] name = "winapi" version = "0.3.9" diff --git a/tools/router/Cargo.toml b/tools/router/Cargo.toml index 0b96911..cfdf352 100644 --- a/tools/router/Cargo.toml +++ b/tools/router/Cargo.toml @@ -8,7 +8,6 @@ edition = "2024" [dependencies] anyhow = "1.0.100" -clap = { version = "4.5.45", features = ["derive"] } env_logger = "0.11.8" log = { version = "0.4.27", features = ["release_max_level_debug"] } vhost-device-net = "0.1.0" @@ -19,3 +18,4 @@ tokio-stream = "0.1.17" arrayvec = "0.7.6" vm-memory = "0.16" tokio-util = "0.7.17" +listenfd = "1.0.2" diff --git a/tools/router/src/main.rs b/tools/router/src/main.rs index e3aca65..a96d511 100644 --- a/tools/router/src/main.rs +++ b/tools/router/src/main.rs @@ -1,47 +1,42 @@ // SPDX-License-Identifier: EUPL-1.2+ // SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> pub(crate) mod packet; pub(crate) mod protocol; mod router; mod upstream; -use std::path::PathBuf; - use packet::*; use router::{InterfaceId, Router}; use upstream::Upstream; -use clap::Parser; +use anyhow::anyhow; use futures_util::{SinkExt, TryStreamExt}; +use listenfd::ListenFd; use log::{error, info}; use tokio::net::UnixListener; use vhost_device_net::{IncomingPacket, VhostDeviceNet}; use vm_memory::GuestMemoryMmap; -#[derive(Parser, Debug)] -#[command()] //version = None, about = None, long_about = None)] -struct Args { - #[arg(long)] - driver_listen_path: PathBuf, - #[arg(long)] - app_listen_path: PathBuf, -} - fn main() -> anyhow::Result<()> { env_logger::init(); - let args = Args::parse(); - for path in [&args.driver_listen_path, &args.app_listen_path] { - let _ = std::fs::remove_file(path); - } - - run_router(args) + run_router() } #[tokio::main(flavor = "current_thread")] -async fn run_router(args: Args) -> anyhow::Result<()> { - let app_listener = UnixListener::bind(&args.app_listen_path)?; - let driver_listener = UnixListener::bind(&args.driver_listen_path)?; +async fn run_router() -> anyhow::Result<()> { + let mut listenfd = ListenFd::from_env(); + + let Some(driver_listener) = listenfd.take_unix_listener(0)? else { + return Err(anyhow!("not activated with driver socket")); + }; + let Some(app_listener) = listenfd.take_unix_listener(1)? else { + return Err(anyhow!("not activated with app socket")); + }; + + let driver_listener = UnixListener::from_std(driver_listener)?; + let app_listener = UnixListener::from_std(app_listener)?; let mut router = Router::<GuestMemoryMmap>::new(InterfaceId::Upstream); base-commit: 04b6183cbbb624996cf848ee248be6dd719ace23 -- 2.51.0

2 9