December 2025 - Spectrum Development

The upcoming nixpkgs staging cycle
by Yureka 15 Dec '25

15 Dec '25

Hi, I attempted running the spectrum release checks on nixpkgs staging commit dc05cdb0ced63fee5124d22a5cc43a0eab3a23bb. I found the following build failures (all from the default glibc/non-cross package set) and reported them upstream: https://github.com/NixOS/nixpkgs/issues/470961 https://github.com/NixOS/nixpkgs/issues/470962 https://github.com/NixOS/nixpkgs/issues/470964 Kind regards, Yureka

3 2

[PATCH] host/roots: Sandbox xdg-desktop-portal-spectrum-host
by Demi Marie Obenour 15 Dec '25

15 Dec '25

It is quite possible that these Landlock rules are unnecessarily permissive, but all of the paths to which read and execute access is granted are part of the root filesystem and therefore assumed to be public knowledge. Removing access from any of them would only increase the risk of accidental breakage in the future, and would not provide any security improvements. seccomp *could* provide some improvements, but the effort needed is too high for now. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- .../template/data/service/xdg-desktop-portal-spectrum-host/run | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run index d2bf78cefc3837b5d5369dbab819606e71bf1fc5..c3d67b6520d490c71bdce0f1056b2960115108b3 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run @@ -12,4 +12,12 @@ s6-ipcserver-socketbinder -a 0700 /run/vm/by-id/${VM}/vsock_219 if { fdmove 1 3 echo } fdclose 3 +unshare -inu -- +setpriv + --landlock-access fs + --landlock-rule path-beneath:read-file,execute:/nix/store + --landlock-rule path-beneath:read-file,execute:/usr/bin + --landlock-rule path-beneath:read-file,execute:/usr/lib + --landlock-rule path-beneath:read-file:/run/vm/by-id/${VM}/portal-bus + -- xdg-desktop-portal-spectrum-host --- base-commit: 59cda41acc455513cf9936e99b8d97647955ac07 change-id: 20251212-sandbox-dbus-portal-4f98ba29c23a -- Sincerely, Demi Marie Obenour (she/her/hers)

4 12

[PATCH v2 1/7] host/rootfs: make fs root directories shared
by Alyssa Ross 14 Dec '25

14 Dec '25

We want every mount under here to show up inside the virtiofsd sandbox. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: no change host/rootfs/image/usr/bin/create-vm-dependencies | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies index 9e123fcf..6bf12d03 100755 --- a/host/rootfs/image/usr/bin/create-vm-dependencies +++ b/host/rootfs/image/usr/bin/create-vm-dependencies @@ -30,8 +30,8 @@ if { # Needs to be shared so that additional mounts under config/ (e.g. from # mount-flatpak) will be propagated into the virtiofsd sandbox. - if { mount --make-shared --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } - if { mount --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --make-shared --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } # Needs to be shared so that when xdg-document-portal mounts its fuse # filesystem at /run/doc/${1}/doc, it will propagate to /run/fs/${1}/doc. base-commit: 227a3ea149281b6dddb0c1ba70008fffb7404c1f -- 2.51.0

3 15

[PATCH] tools/xdg-desktop-portal-spectrum-host: landlock
by Alyssa Ross 14 Dec '25

14 Dec '25

This program doesn't do anything restricted by landlock, so we can just set up a maximally restrictive ruleset and be done with it. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- .../Cargo.lock | 32 +++++++++++++++++++ .../Cargo.toml | 1 + .../src/main.rs | 19 ++++++++++- 3 files changed, 51 insertions(+), 1 deletion(-) diff --git a/tools/xdg-desktop-portal-spectrum-host/Cargo.lock b/tools/xdg-desktop-portal-spectrum-host/Cargo.lock index d09e36ff..147a6b9a 100644 --- a/tools/xdg-desktop-portal-spectrum-host/Cargo.lock +++ b/tools/xdg-desktop-portal-spectrum-host/Cargo.lock @@ -513,6 +513,17 @@ dependencies = [ "hashbrown", ] +[[package]] +name = "landlock" +version = "0.4.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "49fefd6652c57d68aaa32544a4c0e642929725bdc1fd929367cdeb673ab81088" +dependencies = [ + "enumflags2", + "libc", + "thiserror", +] + [[package]] name = "libc" version = "0.2.178" @@ -767,6 +778,26 @@ dependencies = [ "windows-sys", ] +[[package]] +name = "thiserror" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8" +dependencies = [ + "thiserror-impl", +] + +[[package]] +name = "thiserror-impl" +version = "2.0.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + [[package]] name = "tinystr" version = "0.7.6" @@ -988,6 +1019,7 @@ dependencies = [ "async-executor", "async-io", "futures-lite", + "landlock", "percent-encoding", "rustix", "url", diff --git a/tools/xdg-desktop-portal-spectrum-host/Cargo.toml b/tools/xdg-desktop-portal-spectrum-host/Cargo.toml index 96459c82..7b177cbf 100644 --- a/tools/xdg-desktop-portal-spectrum-host/Cargo.toml +++ b/tools/xdg-desktop-portal-spectrum-host/Cargo.toml @@ -10,6 +10,7 @@ edition = "2024" async-executor = { version = "1.12.0", features = ["static"] } async-io = "2.3.2" futures-lite = "2.3.0" +landlock = "0.4.4" percent-encoding = "2.3.1" rustix = "0.38.34" url = "2.5.0" diff --git a/tools/xdg-desktop-portal-spectrum-host/src/main.rs b/tools/xdg-desktop-portal-spectrum-host/src/main.rs index 3fc49cf3..a8672197 100644 --- a/tools/xdg-desktop-portal-spectrum-host/src/main.rs +++ b/tools/xdg-desktop-portal-spectrum-host/src/main.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: EUPL-1.2+ -// SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> +// SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> mod documents; mod file_chooser; @@ -19,6 +19,10 @@ use async_executor::StaticExecutor; use async_io::Async; use futures_lite::prelude::*; use futures_lite::stream::StreamExt; +use landlock::{ + ABI, Access, AccessFs, AccessNet, CompatLevel, Compatible, Ruleset, RulesetAttr, RulesetError, + Scope, +}; use zbus::{AuthMechanism, Connection, MessageStream, connection}; use file_chooser::FileChooser; @@ -208,6 +212,17 @@ fn listening_vsock_path(connection: &UnixListener) -> Result<PathBuf, String> { Ok(OsString::from_vec(listening_addr).into()) } +fn set_up_landlock() -> Result<(), RulesetError> { + Ruleset::default() + .handle_access(AccessFs::from_all(ABI::V6))? + .handle_access(AccessNet::from_all(ABI::V6))? + .scope(Scope::from_all(ABI::V6))? + .create()? + .set_compatibility(CompatLevel::HardRequirement) + .restrict_self()?; + Ok(()) +} + fn read_argv() { let mut args = args_os(); args.next(); @@ -219,6 +234,8 @@ fn read_argv() { } fn run() -> Result<(), String> { + set_up_landlock().map_err(|e| format!("setting up landlock: {e}"))?; + read_argv(); async_io::block_on(EXECUTOR.run(async { base-commit: 073642b88d65fd3d5a10e45226cb8ba580ac7bd3 -- 2.51.0

2 1

[PATCH 1/2] tools: start-vmm: output serial to VM directory
by Alyssa Ross 14 Dec '25

14 Dec '25

When we run the VMM as non-root, it shouldn't be able to create files directly under /run, so this needs to go somewhere else. Really this should probably be going through s6-log, but I think it makes sense to revisit that after we have persistent storage figured out, so that we can get lots out of RAM. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- release/checks/integration/networking.c | 2 +- release/checks/integration/portal.c | 2 +- tools/start-vmm/lib.rs | 2 +- tools/start-vmm/tests/vm_command-basic.rs | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/release/checks/integration/networking.c b/release/checks/integration/networking.c index 078e31fc..c3d873f5 100644 --- a/release/checks/integration/networking.c +++ b/release/checks/integration/networking.c @@ -153,7 +153,7 @@ void test(struct config c) "s6-rc -bu change vmm-env && " "vm-import user /run/mnt/vms && " "vm-start \"$(basename \"$(readlink /run/vm/by-name/user.nc)\")\" && " - "tail -Fc +0 /run/log/current /run/*.log &\n", + "tail -Fc +0 /run/log/current /run/vm/by-id/*/serial &\n", vm_console_writer(vm)) == EOF) { fputs("error writing to console\n", stderr); exit(EXIT_FAILURE); diff --git a/release/checks/integration/portal.c b/release/checks/integration/portal.c index 6ba5654a..9af225e5 100644 --- a/release/checks/integration/portal.c +++ b/release/checks/integration/portal.c @@ -17,7 +17,7 @@ void test(struct config c) "mount \"$(findfs UUID=a7834806-2f82-4faf-8ac4-4f8fd8a474ca)\" /run/mnt && " "s6-rc -bu change vmm-env && " "vm-import user /run/mnt/vms && " - "(tail -Fc +0 /run/*.log &) && " + "(tail -Fc +0 /run/vm/by-id/*/serial &) && " "s6-svc -O /run/vm/by-name/user.portal/service && " "vm-start \"$(basename \"$(readlink /run/vm/by-name/user.portal)\")\" && " "s6-svwait -d /run/vm/by-name/user.portal/service\n", diff --git a/tools/start-vmm/lib.rs b/tools/start-vmm/lib.rs index dfbca8d8..a536f0f6 100644 --- a/tools/start-vmm/lib.rs +++ b/tools/start-vmm/lib.rs @@ -160,7 +160,7 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> { }, serial: ConsoleConfig { mode: "File", - file: Some(format!("/run/{vm_name}.log")), + file: Some(format!("/run/vm/by-id/{vm_name}/serial")), }, vsock: VsockConfig { cid: 3, diff --git a/tools/start-vmm/tests/vm_command-basic.rs b/tools/start-vmm/tests/vm_command-basic.rs index 95c43f86..2e9ad0c7 100644 --- a/tools/start-vmm/tests/vm_command-basic.rs +++ b/tools/start-vmm/tests/vm_command-basic.rs @@ -40,7 +40,7 @@ fn main() -> std::io::Result<()> { assert_eq!(config.memory.size, 0x40000000); assert!(config.memory.shared); assert_eq!(config.serial.mode, "File"); - assert_eq!(config.serial.file.unwrap(), "/run/testvm.log"); + assert_eq!(config.serial.file.unwrap(), "/run/vm/by-id/testvm/serial"); assert_eq!(config.vsock.cid, 3); assert_eq!(config.vsock.socket, "/run/vsock/testvm/vsock"); base-commit: 227a3ea149281b6dddb0c1ba70008fffb7404c1f -- 2.51.0

2 3

[PATCH] host/rootfs: add mount-userdata command
by Alyssa Ross 14 Dec '25

14 Dec '25

We shouldn't leave it to the user to manually mount user data partitions. We want to ensure restrictive mount flags are set, and be able to do other operations around the mounting. It's also nice to have a single place where all user data partitions can be mounted. I've taken inspiration from the FHS in using /media for this. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- .../development/persistent-storage.adoc | 19 ++++++++++----- .../using-spectrum/creating-custom-vms.adoc | 5 ++-- .../using-spectrum/vm-file-access.adoc | 4 ++-- host/rootfs/Makefile | 2 +- host/rootfs/file-list.mk | 1 + host/rootfs/image/etc/fstab | 11 +++++---- host/rootfs/image/usr/bin/mount-userdata | 24 +++++++++++++++++++ 7 files changed, 50 insertions(+), 16 deletions(-) create mode 100755 host/rootfs/image/usr/bin/mount-userdata diff --git a/Documentation/development/persistent-storage.adoc b/Documentation/development/persistent-storage.adoc index 12426b46..c4bcc163 100644 --- a/Documentation/development/persistent-storage.adoc +++ b/Documentation/development/persistent-storage.adoc @@ -2,7 +2,7 @@ :page-parent: Development :page-nav_order: 2 -// SPDX-FileCopyrightText: 2024 Alyssa Ross <hi(a)alyssa.is> +// SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi(a)alyssa.is> // SPDX-License-Identifier: GFDL-1.3-no-invariants-or-later OR CC-BY-SA-4.0 Spectrum's root filesystem is immutable, so if you want to be able to @@ -10,8 +10,15 @@ persist data between sessions, you'll need to create a persistent storage partition. Spectrum comes with `cryptsetup`, and in future is likely to assume that btrfs-specific features are available. -Conventionally, the persistent storage partition is mounted on /ext -after booting. It's not mounted automatically, because generally the -partition should be encrypted, meaning a key has to be supplied to -mount it anyway, and because there might be multiple persistent data -partitions to choose from. +Persistent storage can be mounted as follows: + +[source,shell] +---- +cryptsetup open /dev/sda1 userdata +mount-userdata /dev/mapper/userdata +---- + +It's not mounted automatically, because generally the partition should +be encrypted, meaning a key has to be supplied to mount it anyway, and +because there might be multiple persistent data partitions to choose +from. diff --git a/Documentation/using-spectrum/creating-custom-vms.adoc b/Documentation/using-spectrum/creating-custom-vms.adoc index a397ac50..1eca7f36 100644 --- a/Documentation/using-spectrum/creating-custom-vms.adoc +++ b/Documentation/using-spectrum/creating-custom-vms.adoc @@ -13,8 +13,9 @@ configurations are directories under a dedicated parent directory, and the name of each configuration directory determines the name of the VM. After mounting the persistent storage partition, the configured VMs can be made available by running `vm-import user -/ext/vms`, replacing /ext/vms with the directory containing the VM -definitions. +/media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/vms`, replacing +/media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/vms with the directory +containing the VM definitions. The directory can contain the following files: diff --git a/Documentation/using-spectrum/vm-file-access.adoc b/Documentation/using-spectrum/vm-file-access.adoc index 1b4fe9a5..a079cfe8 100644 --- a/Documentation/using-spectrum/vm-file-access.adoc +++ b/Documentation/using-spectrum/vm-file-access.adoc @@ -48,7 +48,7 @@ can be bind-mounted into it: + [listing] [source,shell] -echo "Hello, world!" > /ext/example.txt +echo "Hello, world!" > /media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/example.txt 2. Create an empty file to bind mount over: + @@ -60,5 +60,5 @@ touch /run/vm/by-name/user.appvm-example/fs/example.txt + [listing] [source,shell] -mount --rbind /ext/example.txt /run/vm/by-name/user.appvm-example/fs/example.txt +mount --rbind /media/4e43cdc2-82b2-4d94-8a90-b6c6189312d2/example.txt /run/vm/by-name/user.appvm-example/fs/example.txt ==== diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index 7bec1259..211fb5dd 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -33,8 +33,8 @@ DIRS = \ etc/s6-linux-init/run-image/user \ etc/s6-linux-init/run-image/vm/by-id \ etc/s6-linux-init/run-image/vm/by-name \ - ext \ home \ + media \ proc \ run \ sys \ diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index f69775d2..6bf40ff8 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -56,6 +56,7 @@ FILES = \ image/etc/xdg/weston/weston.ini \ image/usr/bin/assign-devices \ image/usr/bin/create-vm-dependencies \ + image/usr/bin/mount-userdata \ image/usr/bin/root-terminal \ image/usr/bin/run-appimage \ image/usr/bin/run-flatpak \ diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab index 5c23a374..18bb5e45 100644 --- a/host/rootfs/image/etc/fstab +++ b/host/rootfs/image/etc/fstab @@ -1,7 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 # SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi(a)alyssa.is> -proc /proc proc nosuid,nodev,noexec 0 0 -devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs nosuid,nodev 0 0 -sysfs /sys sysfs nosuid,nodev,noexec 0 0 -tmpfs /tmp tmpfs nosuid,nodev 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +tmpfs /media tmpfs nosuid,nodev,noexec,nosymfollow,mode=755 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +tmpfs /tmp tmpfs nosuid,nodev 0 0 diff --git a/host/rootfs/image/usr/bin/mount-userdata b/host/rootfs/image/usr/bin/mount-userdata new file mode 100755 index 00000000..e4a873c0 --- /dev/null +++ b/host/rootfs/image/usr/bin/mount-userdata @@ -0,0 +1,24 @@ +#!/bin/execlineb -W +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +backtick -D "" uuid { + importas -Siu 1 + blkid -o value -s UUID $1 +} + +multisubstitute { + importas -Siu 0 + importas -Siu 1 + importas -Siu uuid +} + +case $uuid { + "" { + fdmove -c 1 2 + printf "%s: '%s' does not have a UUID\n" $0 $1 + } +} + +if { mount -m -o nosuid,nodev,noexec,nosymfollow -- $1 /media/${uuid} } +printf "%s\n" /media/${uuid} base-commit: 1afc3a7042ee1c40b6d2e564219be31ea8f1017f -- 2.51.0

3 4

[PATCH v3 1/3] tools/router: use socket activation
by Alyssa Ross 14 Dec '25

14 Dec '25

This means we can use readiness notification to wait until the sockets are created without having to add special functionality for that to the router program, and also means we can do extra system-specific setup to the sockets, like changing their owners, outside of the router. Since the socket paths were the only arguments taken by the router, this also lets us drop the clap dependency entirely. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v3: • use anyhow::bail • set sockets to non-blocking in router v2: https://spectrum-os.org/lists/archives/spectrum-devel/20251209110503.674499… host/rootfs/file-list.mk | 1 + .../service/spectrum-router/notification-fd | 1 + .../spectrum-router/notification-fd.license | 2 + .../template/data/service/spectrum-router/run | 21 ++- tools/router/Cargo.lock | 148 ++++++++++++------ tools/router/Cargo.toml | 2 +- tools/router/src/main.rs | 40 +++-- 7 files changed, 141 insertions(+), 74 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce8..5a043b7b 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -28,6 +28,7 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \ + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd new file mode 100644 index 00000000..7ed6ff82 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd @@ -0,0 +1 @@ +5 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license new file mode 100644 index 00000000..0d3d47ca --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index 3ba35def..dc1ef900 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -1,14 +1,30 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> importas -i VM VM +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-driver.sock +fdmove -c 3 0 + +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-app.sock +fdmove -c 4 0 + +# Notify readiness. +if { + fdmove -c 5 1 + echo +} + +redirfd -r 0 /dev/null + bwrap --unshare-all --unshare-user --dev-bind / / --setenv RUST_LOG spectrum-router=debug,info + --setenv LISTEN_FDS 2 --tmpfs /tmp --dev /dev --tmpfs /dev/shm @@ -19,6 +35,7 @@ bwrap --ro-bind /lib /lib --bind /run/vm/by-id/${VM} /run/vm/by-id/${VM} -- + +getpid LISTEN_PID + spectrum-router - --app-listen-path /run/vm/by-id/${VM}/router-app.sock - --driver-listen-path /run/vm/by-id/${VM}/router-driver.sock diff --git a/tools/router/Cargo.lock b/tools/router/Cargo.lock index 60d7657b..d0d105aa 100644 --- a/tools/router/Cargo.lock +++ b/tools/router/Cargo.lock @@ -113,6 +113,12 @@ dependencies = [ "wyz", ] +[[package]] +name = "bumpalo" +version = "3.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43" + [[package]] name = "bytes" version = "1.11.0" @@ -120,44 +126,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3" [[package]] -name = "clap" -version = "4.5.53" +name = "cfg-if" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8" -dependencies = [ - "clap_builder", - "clap_derive", -] - -[[package]] -name = "clap_builder" -version = "4.5.53" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00" -dependencies = [ - "anstream", - "anstyle", - "clap_lex", - "strsim", -] - -[[package]] -name = "clap_derive" -version = "4.5.49" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671" -dependencies = [ - "heck", - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "clap_lex" -version = "0.7.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "colorchoice" @@ -263,12 +235,6 @@ dependencies = [ "slab", ] -[[package]] -name = "heck" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" - [[package]] name = "is_terminal_polyfill" version = "1.70.2" @@ -299,12 +265,33 @@ dependencies = [ "syn", ] +[[package]] +name = "js-sys" +version = "0.3.83" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8" +dependencies = [ + "once_cell", + "wasm-bindgen", +] + [[package]] name = "libc" version = "0.2.177" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" +[[package]] +name = "listenfd" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b87bc54a4629b4294d0b3ef041b64c40c611097a677d9dc07b2c67739fe39dba" +dependencies = [ + "libc", + "uuid", + "winapi", +] + [[package]] name = "log" version = "0.4.28" @@ -328,6 +315,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + [[package]] name = "once_cell_polyfill" version = "1.70.2" @@ -420,6 +413,12 @@ version = "0.8.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58" +[[package]] +name = "rustversion" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" + [[package]] name = "serde_core" version = "1.0.228" @@ -462,9 +461,9 @@ version = "0.1.0" dependencies = [ "anyhow", "arrayvec", - "clap", "env_logger", "futures-util", + "listenfd", "log", "tokio", "tokio-stream", @@ -474,12 +473,6 @@ dependencies = [ "zerocopy", ] -[[package]] -name = "strsim" -version = "0.11.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" - [[package]] name = "syn" version = "2.0.111" @@ -608,6 +601,16 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" +[[package]] +name = "uuid" +version = "1.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + [[package]] name = "vhost-device-net" version = "0.1.1" @@ -666,6 +669,51 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" +[[package]] +name = "wasm-bindgen" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd" +dependencies = [ + "cfg-if", + "once_cell", + "rustversion", + "wasm-bindgen-macro", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-macro" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3" +dependencies = [ + "quote", + "wasm-bindgen-macro-support", +] + +[[package]] +name = "wasm-bindgen-macro-support" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40" +dependencies = [ + "bumpalo", + "proc-macro2", + "quote", + "syn", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-shared" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4" +dependencies = [ + "unicode-ident", +] + [[package]] name = "winapi" version = "0.3.9" diff --git a/tools/router/Cargo.toml b/tools/router/Cargo.toml index 0b969113..cfdf3527 100644 --- a/tools/router/Cargo.toml +++ b/tools/router/Cargo.toml @@ -8,7 +8,6 @@ edition = "2024" [dependencies] anyhow = "1.0.100" -clap = { version = "4.5.45", features = ["derive"] } env_logger = "0.11.8" log = { version = "0.4.27", features = ["release_max_level_debug"] } vhost-device-net = "0.1.0" @@ -19,3 +18,4 @@ tokio-stream = "0.1.17" arrayvec = "0.7.6" vm-memory = "0.16" tokio-util = "0.7.17" +listenfd = "1.0.2" diff --git a/tools/router/src/main.rs b/tools/router/src/main.rs index e3aca65a..3b26ddb0 100644 --- a/tools/router/src/main.rs +++ b/tools/router/src/main.rs @@ -1,47 +1,45 @@ // SPDX-License-Identifier: EUPL-1.2+ // SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> pub(crate) mod packet; pub(crate) mod protocol; mod router; mod upstream; -use std::path::PathBuf; - use packet::*; use router::{InterfaceId, Router}; use upstream::Upstream; -use clap::Parser; +use anyhow::bail; use futures_util::{SinkExt, TryStreamExt}; +use listenfd::ListenFd; use log::{error, info}; use tokio::net::UnixListener; use vhost_device_net::{IncomingPacket, VhostDeviceNet}; use vm_memory::GuestMemoryMmap; -#[derive(Parser, Debug)] -#[command()] //version = None, about = None, long_about = None)] -struct Args { - #[arg(long)] - driver_listen_path: PathBuf, - #[arg(long)] - app_listen_path: PathBuf, -} - fn main() -> anyhow::Result<()> { env_logger::init(); - let args = Args::parse(); - for path in [&args.driver_listen_path, &args.app_listen_path] { - let _ = std::fs::remove_file(path); - } - - run_router(args) + run_router() } #[tokio::main(flavor = "current_thread")] -async fn run_router(args: Args) -> anyhow::Result<()> { - let app_listener = UnixListener::bind(&args.app_listen_path)?; - let driver_listener = UnixListener::bind(&args.driver_listen_path)?; +async fn run_router() -> anyhow::Result<()> { + let mut listenfd = ListenFd::from_env(); + + let Some(driver_listener) = listenfd.take_unix_listener(0)? else { + bail!("not activated with driver socket"); + }; + let Some(app_listener) = listenfd.take_unix_listener(1)? else { + bail!("not activated with app socket"); + }; + + driver_listener.set_nonblocking(true)?; + app_listener.set_nonblocking(true)?; + + let driver_listener = UnixListener::from_std(driver_listener)?; + let app_listener = UnixListener::from_std(app_listener)?; let mut router = Router::<GuestMemoryMmap>::new(InterfaceId::Upstream); -- 2.51.0

2 5

[PATCH 1/4] host/rootfs: make fs root directories shared
by Alyssa Ross 13 Dec '25

13 Dec '25

We want every mount under here to show up inside the virtiofsd sandbox. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/image/usr/bin/create-vm-dependencies | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies index 9e123fcf..6bf12d03 100755 --- a/host/rootfs/image/usr/bin/create-vm-dependencies +++ b/host/rootfs/image/usr/bin/create-vm-dependencies @@ -30,8 +30,8 @@ if { # Needs to be shared so that additional mounts under config/ (e.g. from # mount-flatpak) will be propagated into the virtiofsd sandbox. - if { mount --make-shared --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } - if { mount --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --make-shared --rbind -o ro /run/fs/${1} /run/fs/${1} } + if { mount --rbind -o nofail /proc/self/fd/3/fs /run/fs/${1}/config } # Needs to be shared so that when xdg-document-portal mounts its fuse # filesystem at /run/doc/${1}/doc, it will propagate to /run/fs/${1}/doc. base-commit: ce1cfde4bf845cb1104e0eddc4128a2c3d517fb0 -- 2.51.0

2 5

[PATCH 1/2] img/app: change virtio-fs tag to "host"
by Alyssa Ross 12 Dec '25

12 Dec '25

It doesn't seem likely to me that we'll have multiple virtio-fs devices from the host, so let's use something a bit more clear and precise. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Documentation/using-spectrum/creating-custom-vms.adoc | 2 +- img/app/Makefile | 4 ++-- img/app/image/etc/mdev/virtiofs | 2 +- img/app/scripts/start-virtiofsd.elb | 2 +- release/checks/wayland/default.nix | 4 ++-- tools/start-vmm/lib.rs | 2 +- tools/start-vmm/tests/vm_command-basic.rs | 2 +- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Documentation/using-spectrum/creating-custom-vms.adoc b/Documentation/using-spectrum/creating-custom-vms.adoc index a397ac50..8d915e1a 100644 --- a/Documentation/using-spectrum/creating-custom-vms.adoc +++ b/Documentation/using-spectrum/creating-custom-vms.adoc @@ -91,7 +91,7 @@ should configure `eth0` with the IPv4 address `100.64.165.70` (because === Filesystem Every VM has a virtio-fs device that exposes the /run/vm/by-id/_VM -ID_/fs directory on the host, with the tag "virtiofs0". The VM cannot +ID_/fs directory on the host, with the tag "host". The VM cannot write directly into that directory, but it's possible to create a subdirectory on the host and bind mount a directory from a writeable filesystem into it to provide the VM with access to shared storage. diff --git a/img/app/Makefile b/img/app/Makefile index 7354f892..69c85bba 100644 --- a/img/app/Makefile +++ b/img/app/Makefile @@ -99,7 +99,7 @@ run-qemu: $(imgdir)/appvm/blk/root.img start-vhost-user-net start-virtiofsd -netdev vhost-user,id=net0,chardev=vhost-user-net \ -device virtio-net,netdev=net0,mac=02:00:00:00:00:01 \ -chardev socket,id=virtiofsd,path=build/virtiofsd.sock \ - -device vhost-user-fs-pci,chardev=virtiofsd,tag=virtiofs0 \ + -device vhost-user-fs-pci,chardev=virtiofsd,tag=host \ -device virtio-gpu-rutabaga-pci,cross-domain=on,hostmem=8G \ -audio driver=pipewire,model=virtio \ -object memory-backend-memfd,id=mem,size=256M,share=on \ @@ -117,7 +117,7 @@ run-cloud-hypervisor: $(imgdir)/appvm/blk/root.img start-vhost-user-gpu start-vh --api-socket path=build/vmm.sock \ --memory size=1G,shared=on \ --disk path=$(imgdir)/appvm/blk/root.img,readonly=on \ - --fs tag=virtiofs0,socket=build/virtiofsd.sock \ + --fs tag=host,socket=build/virtiofsd.sock \ --gpu socket=build/vhost-user-gpu.sock \ --vsock cid=3,socket=build/vsock.sock \ --net mac=02:00:00:00:00:01,vhost_user=on,socket=build/vhost-user-net.sock \ diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs index b6e505bc..bda77483 100755 --- a/img/app/image/etc/mdev/virtiofs +++ b/img/app/image/etc/mdev/virtiofs @@ -7,6 +7,6 @@ background { # virtiofs filesystems, so we only supported a single, hardcoded # filesystem tag for now. if { mkdir -p /run/virtiofs/virtiofs0 } - if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 } + if { mount -t virtiofs -o nodev host /run/virtiofs/virtiofs0 } /etc/mdev/listen virtiofs0 } diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb index fa3a234e..9efb436b 100755 --- a/img/app/scripts/start-virtiofsd.elb +++ b/img/app/scripts/start-virtiofsd.elb @@ -11,5 +11,5 @@ background { if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config } unshare --map-user 1000 --map-group 1000 importas -SsD virtiofsd VIRTIOFSD - $VIRTIOFSD --fd 0 --shared-dir build/fs --tag virtiofs0 + $VIRTIOFSD --fd 0 --shared-dir build/fs --tag host } diff --git a/release/checks/wayland/default.nix b/release/checks/wayland/default.nix index a053e605..55c7d6d1 100644 --- a/release/checks/wayland/default.nix +++ b/release/checks/wayland/default.nix @@ -32,7 +32,7 @@ testers.nixosTest ({ lib, pkgs, ... }: { systemd.services.cloud-hypervisor = { after = [ "crosvm-gpu.service" "weston.service" ]; requires = [ "crosvm-gpu.service" "weston.service" ]; - serviceConfig.ExecStart = "${lib.getExe pkgs.cloud-hypervisor} --memory shared=on --disk path=${appvm}/lib/spectrum/img/appvm/blk/root.img,readonly=on --cmdline \"console=ttyS0 root=PARTLABEL=root\" --fs socket=/run/virtiofsd.sock,tag=virtiofs0 --gpu socket=/run/crosvm-gpu.sock --vsock cid=3,socket=/run/vsock.sock --serial tty --console null --kernel ${appvm}/lib/spectrum/img/appvm/vmlinux"; + serviceConfig.ExecStart = "${lib.getExe pkgs.cloud-hypervisor} --memory shared=on --disk path=${appvm}/lib/spectrum/img/appvm/blk/root.img,readonly=on --cmdline \"console=ttyS0 root=PARTLABEL=root\" --fs socket=/run/virtiofsd.sock,tag=host --gpu socket=/run/crosvm-gpu.sock --vsock cid=3,socket=/run/vsock.sock --serial tty --console null --kernel ${appvm}/lib/spectrum/img/appvm/vmlinux"; }; systemd.services.crosvm = { @@ -79,7 +79,7 @@ testers.nixosTest ({ lib, pkgs, ... }: { }; systemd.services.virtiofsd = { - serviceConfig.ExecStart = "${lib.getExe pkgs.virtiofsd} --fd 3 --shared-dir /shared --tag virtiofs0"; + serviceConfig.ExecStart = "${lib.getExe pkgs.virtiofsd} --fd 3 --shared-dir /shared --tag host"; serviceConfig.Restart = "on-success"; requires = [ "shared-config.mount" ]; after = [ "shared-config.mount" ]; diff --git a/tools/start-vmm/lib.rs b/tools/start-vmm/lib.rs index b44e0375..4b2aedda 100644 --- a/tools/start-vmm/lib.rs +++ b/tools/start-vmm/lib.rs @@ -81,7 +81,7 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> { Err(e) => return Err(format!("reading directory {blk_dir:?}: {e}")), }, fs: [FsConfig { - tag: "virtiofs0", + tag: "host", socket: format!( "/run/service/vm-services/instance/{vm_name}/data/service/vhost-user-fs/env/virtiofsd.sock" ), diff --git a/tools/start-vmm/tests/vm_command-basic.rs b/tools/start-vmm/tests/vm_command-basic.rs index 866a6e19..533e2d2d 100644 --- a/tools/start-vmm/tests/vm_command-basic.rs +++ b/tools/start-vmm/tests/vm_command-basic.rs @@ -28,7 +28,7 @@ fn main() -> std::io::Result<()> { assert!(disk1.readonly); assert_eq!(config.fs.len(), 1); let fs1 = &config.fs[0]; - assert_eq!(fs1.tag, "virtiofs0"); + assert_eq!(fs1.tag, "host"); let expected = "/run/service/vm-services/instance/testvm/data/service/vhost-user-fs/env/virtiofsd.sock"; assert_eq!(fs1.socket, expected); base-commit: 814a589b2b0fb4eeed06e1a1a9ce536f6b5ee91d -- 2.51.0

1 1

[PATCH v2 1/8] host/rootfs: create dbus socket externally
by Alyssa Ross 12 Dec '25

12 Dec '25

This is the first step towards running dbus as non-root. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- v2: no change .../template/data/service/dbus/notification-fd | 2 +- .../data/service/dbus/notification-fd.license | 2 +- .../vm-services/template/data/service/dbus/run | 13 +++++++++++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd index 00750edc..b8626c4c 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd @@ -1 +1 @@ -3 +4 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license index 5a406331..0d3d47ca 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license @@ -1,2 +1,2 @@ SPDX-License-Identifier: CC0-1.0 -SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run index 40b75355..365e1697 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run @@ -4,10 +4,19 @@ importas -i VM VM +s6-ipcserver-socketbinder -B /run/vm/by-id/${VM}/portal-bus + +fdmove -c 3 0 +redirfd -r 0 /dev/null + nsenter --mount=/run/vm/by-id/${VM}/mount unshare --cgroup --ipc --net --uts + +export LISTEN_FDS 1 +getpid LISTEN_PID + dbus-daemon --config-file /usr/share/dbus-1/session.conf - --print-address 3 - --address unix:path=/run/vm/by-id/${VM}/portal-bus + --print-address 4 + --address systemd: base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f -- 2.51.0

2 8