- Spectrum Development - spectrum-os.org

[PATCH] host/rootfs: Set no_new_privs in PID 1
by Demi Marie Obenour 08 Dec '25

08 Dec '25

This prevents any program on the host from gaining privileges via execve(), ever. There are currently no such programs on the host so this should be a no-op for now. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/etc/init | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host/rootfs/image/etc/init b/host/rootfs/image/etc/init index 4085fa55545e7309004967e443e47fc2b82b0663..e9938acec866045962a8ead096d199cbd3792469 100755 --- a/host/rootfs/image/etc/init +++ b/host/rootfs/image/etc/init @@ -2,4 +2,4 @@ # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> -/bin/s6-linux-init -c /etc/s6-linux-init -s /run/param -- $@ +/usr/bin/setpriv --no-new-privs -- /bin/s6-linux-init -c /etc/s6-linux-init -s /run/param -- $@ --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251205-no-new-privs-2f22088c0736 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 2

[PATCH] vm/app/systemd-sysupdate: fix mounting overlay
by Alyssa Ross 08 Dec '25

08 Dec '25

This assumed it would be run as root, so has been broken since we stopped running application scripts as root inside img/app VMs. Reported-by: Johannes Süllner <johannes.suellner(a)mailbox.org> Link: https://matrix.to/#/!xSysqhzbOZImdvGpix:fairydust.space/$9psDI3BIP00EIzW-qO… Fixes: 8bfcbf9 ("img/app: run applications as non-root") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- vm/app/systemd-sysupdate/download-update | 1 + 1 file changed, 1 insertion(+) diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update index eada41c..335e389 100755 --- a/vm/app/systemd-sysupdate/download-update +++ b/vm/app/systemd-sysupdate/download-update @@ -3,6 +3,7 @@ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> export LC_ALL C export LANGUAGE C +unshare -rUm if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX } # Not a useless use of cat: if there are NUL bytes in the URL base-commit: 9f33ec29d39df59589ed7c1b85d54e116e135df8 -- 2.51.0

2 6

[REGRESSION] VMs can't be rebooted
by Alyssa Ross 07 Dec '25

07 Dec '25

Since a655117 ("tools: start-vmm: enable Cloud Hypervisor landlock"), it's not possible to reboot a VM: ~ # ch-remote --api-socket /run/vm/by-id/dLPcEC/vmm reboot [2025-12-07T13:04:25Z ERROR cloud_hypervisor] Fatal error: HttpApiClient(ServerResponse(InternalServerError, Some("[\"Error from API\",\"The VM could not reboot\",\"Error creating console devices\",\"Error creating console device\",\"Permission denied (os error 13)\"]"))) Error: ch-remote exited with the following chain of errors: 0: http client error 1: Server responded with InternalServerError 2: Error from API 3: The VM could not reboot 4: Error creating console devices 5: Error creating console device 6: Permission denied (os error 13) I've opened an upstream bug reported about this: https://github.com/cloud-hypervisor/cloud-hypervisor/issues/7547

1 0

[PATCH] release/live: fix Makefile dependency being missing in Nix shell
by Johannes Süllner 06 Dec '25

06 Dec '25

In commit a6d872ae, a Btrfs userdata partition was added to the live VM that can be startet with `make run`. The Makefile creates this partition and therefor requires `btrfs-progs`. --- release/live/shell.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/release/live/shell.nix b/release/live/shell.nix index e542793..a52c9b1 100644 --- a/release/live/shell.nix +++ b/release/live/shell.nix @@ -2,7 +2,7 @@ # SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi(a)alyssa.is> import ../../lib/call-package.nix ( -{ callSpectrumPackage, config, stdenv, qemu_kvm }: +{ callSpectrumPackage, config, stdenv, btrfs-progs, qemu_kvm }: let efi = callSpectrumPackage ../../host/efi.nix {}; @@ -11,7 +11,7 @@ in (callSpectrumPackage ./. {}).overrideAttrs ( { nativeBuildInputs ? [], env ? {}, ... }: { - nativeBuildInputs = nativeBuildInputs ++ [ qemu_kvm ]; + nativeBuildInputs = nativeBuildInputs ++ [ btrfs-progs qemu_kvm ]; env = env // { OVMF_CODE = "${qemu_kvm}/share/qemu/edk2-${stdenv.hostPlatform.qemuArch}-code.fd"; -- 2.51.2

3 3

Test for portals passes even when file portal is broken
by Demi Marie Obenour 06 Dec '25

06 Dec '25

While trying to sandbox the file chooser portal, I broke it. This caused files not to be saved, resulting in silent data loss. Unfortunately, the integration test still passed. Is this a bug in the test? Is there a better alternative to manual testing? -- Sincerely, Demi Marie Obenour (she/her/hers)

3 10

[PATCH] host/rootfs: create groups assumed by udev
by Alyssa Ross 05 Dec '25

05 Dec '25

We don't really care about these groups, but if they don't exist, udev will also not apply the "other" modes from rules, leaving e.g. /dev/kvm root-only when it should be globally read/write. tty is set to 5, conforming with the systemd convention. Link: https://systemd.io/UIDS-GIDS/ Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Demi, this should avoid the need to add a udev rule for /dev/kvm. host/rootfs/image/etc/group | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group index 18acc30..e3ade46 100644 --- a/host/rootfs/image/etc/group +++ b/host/rootfs/image/etc/group @@ -1 +1,15 @@ root:x:0:root +clock:x:1: +dialout:x:2: +kmem:x:3: +input:x:4: +tty:x:5: +video:x:6: +render:x:7: +sgx:x:8: +audio:x:9: +lp:x:10: +disk:x:11: +cdrom:x:12: +tape:x:13: +kvm:x:14: base-commit: a13d3403c1ddbb8dbbbdb05416350b2846162ed1 -- 2.51.0

3 4

[PATCH 01/13] pkgs: gtk3: backport fix for unset XDG_RUNTIME_DIR
by Alyssa Ross 02 Dec '25

02 Dec '25

As part of running services as different users we'll be giving services dedicated places to put their sockets, rather than a single shared directory they all need to be able to write to. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- pkgs/gtk3/default.nix | 13 +++++++++++++ pkgs/overlay.nix | 2 ++ 2 files changed, 15 insertions(+) create mode 100644 pkgs/gtk3/default.nix diff --git a/pkgs/gtk3/default.nix b/pkgs/gtk3/default.nix new file mode 100644 index 0000000..72445c9 --- /dev/null +++ b/pkgs/gtk3/default.nix @@ -0,0 +1,13 @@ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +# SPDX-License-Identifier: MIT + +import ../../lib/overlay-package.nix [ "gtk3" ] ({ final, super }: + +super.gtk3.overrideAttrs ({ patches ? [], ... }: { + patches = patches ++ [ + (final.fetchpatch { + url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/8569e206badbee1b27ff0e27316391b…"; + hash = "sha256-OdBhCGtz+3HS8LRhp+GCj3dL4pntybiI9b3A3kc5+OY="; + }) + ]; +})) diff --git a/pkgs/overlay.nix b/pkgs/overlay.nix index 0ca196c..0910bf3 100644 --- a/pkgs/overlay.nix +++ b/pkgs/overlay.nix @@ -4,5 +4,7 @@ (final: super: { cloud-hypervisor = import ./cloud-hypervisor { inherit final super; }; + gtk3 = import ./gtk3 { inherit final super; }; + skawarePackages = import ./skaware-packages { inherit final super; }; }) base-commit: c43e5c63a028994d5f66a15db19f415bf3cb7736 -- 2.51.0

3 30

[PATCH] host/rootfs: Add scripts to access a VM by name
by Demi Marie Obenour 01 Dec '25

01 Dec '25

This is much more convenient than having to find a VM's ID. In the future, the programs that take a VM ID should be the suffixed ones, but this change avoids having to change any tests and so is simpler. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/file-list.mk | 3 +++ host/rootfs/image/usr/bin/vm-console-by-name | 9 +++++++++ host/rootfs/image/usr/bin/vm-start-by-name | 9 +++++++++ host/rootfs/image/usr/bin/vm-stop-by-name | 9 +++++++++ 4 files changed, 30 insertions(+) diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce87f4685eda26382b4e0b0b6fd21025c7a..fd21034320a3de6f96a8eb229214b041612709e8 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -59,9 +59,12 @@ FILES = \ image/usr/bin/run-vmm \ image/usr/bin/spectrum-update \ image/usr/bin/vm-console \ + image/usr/bin/vm-console-by-name \ image/usr/bin/vm-import \ image/usr/bin/vm-start \ + image/usr/bin/vm-start-by-name \ image/usr/bin/vm-stop \ + image/usr/bin/vm-stop-by-name \ image/usr/bin/xdg-open \ image/usr/libexec/net-add \ image/usr/share/dbus-1/services/org.freedesktop.portal.Documents.service diff --git a/host/rootfs/image/usr/bin/vm-console-by-name b/host/rootfs/image/usr/bin/vm-console-by-name new file mode 100755 index 0000000000000000000000000000000000000000..a302b463ef1bd2c9ae180b6b2b9eae45a26856d6 --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-console-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-console $vm_id diff --git a/host/rootfs/image/usr/bin/vm-start-by-name b/host/rootfs/image/usr/bin/vm-start-by-name new file mode 100755 index 0000000000000000000000000000000000000000..438a4a4610ddc9dea3394503e8d5e635468fbddd --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-start-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-start $vm_id diff --git a/host/rootfs/image/usr/bin/vm-stop-by-name b/host/rootfs/image/usr/bin/vm-stop-by-name new file mode 100755 index 0000000000000000000000000000000000000000..07ca686b5ace86aceb0fdc0f9ace8ff3859f2b37 --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-stop-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-stop $vm_id --- base-commit: 44f32b7a4b3cfbb4046447318e6753dd0eb71add change-id: 20251201-vm-ops-by-name-6a5cb600f726 -- Sincerely, Demi Marie Obenour (she/her/hers)

1 0

[PATCH v2 1/6] img/app: install fuse3 globally
by Alyssa Ross 01 Dec '25

01 Dec '25

AppImage (and in-development Flatpak) VMs complain about this being absent and portals don't work without it, even though Nix VMs work fine. I suppose it's a packaging difference. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: no change v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251201044534.977524… img/app/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/img/app/default.nix b/img/app/default.nix index 6490ac2..1eb3c9b 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -65,6 +65,7 @@ let pkgs.cacert pkgs.dejavu_fonts pkgs.execline + pkgs.fuse3 pkgs.kmod pkgs.mdevd pkgs.pipewire base-commit: a6d872aea26311a590e90dc08d59105a2165d80b -- 2.51.0

3 13

[PATCH 1/5] img/app: install fuse3 globally
by Alyssa Ross 01 Dec '25

01 Dec '25

AppImage (and in-development Flatpak) VMs complain about this being absent and portals don't work without it, even though Nix VMs work fine. I suppose it's a packaging difference. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- img/app/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/img/app/default.nix b/img/app/default.nix index 6490ac2..1eb3c9b 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -65,6 +65,7 @@ let pkgs.cacert pkgs.dejavu_fonts pkgs.execline + pkgs.fuse3 pkgs.kmod pkgs.mdevd pkgs.pipewire base-commit: cf131bd816a34095af34345f0e5f148c47268a04 -- 2.51.0

2 10