December 2025 - Spectrum Development

[PATCH 1/8] host/rootfs: create dbus socket externally
by Alyssa Ross 12 Dec '25

12 Dec '25

This is the first step towards running dbus as non-root. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- .../template/data/service/dbus/notification-fd | 2 +- .../data/service/dbus/notification-fd.license | 2 +- .../vm-services/template/data/service/dbus/run | 13 +++++++++++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd index 00750edc..b8626c4c 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd @@ -1 +1 @@ -3 +4 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license index 5a406331..0d3d47ca 100644 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd.license @@ -1,2 +1,2 @@ SPDX-License-Identifier: CC0-1.0 -SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run index 40b75355..365e1697 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run @@ -4,10 +4,19 @@ importas -i VM VM +s6-ipcserver-socketbinder -B /run/vm/by-id/${VM}/portal-bus + +fdmove -c 3 0 +redirfd -r 0 /dev/null + nsenter --mount=/run/vm/by-id/${VM}/mount unshare --cgroup --ipc --net --uts + +export LISTEN_FDS 1 +getpid LISTEN_PID + dbus-daemon --config-file /usr/share/dbus-1/session.conf - --print-address 3 - --address unix:path=/run/vm/by-id/${VM}/portal-bus + --print-address 4 + --address systemd: -- 2.51.0

2 20

[PATCH] Set restrictive mount options
by Alyssa Ross 11 Dec '25

11 Dec '25

These are mostly copied from systemd, so should be pretty safe in terms of compatibility. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/initramfs/etc/fstab | 8 ++++---- host/initramfs/etc/init | 2 +- host/rootfs/image/etc/fstab | 12 ++++++------ img/app/image/etc/fstab | 12 ++++++------ img/app/image/etc/mdev/virtiofs | 2 +- img/app/image/etc/s6-rc/app/run | 4 ++-- img/app/scripts/start-virtiofsd.elb | 2 +- vm/app/systemd-sysupdate/download-update | 2 +- vm/sys/net/image/etc/fstab | 12 ++++++------ 9 files changed, 28 insertions(+), 28 deletions(-) diff --git a/host/initramfs/etc/fstab b/host/initramfs/etc/fstab index 3dfb05ab..9f43a1a9 100644 --- a/host/initramfs/etc/fstab +++ b/host/initramfs/etc/fstab @@ -1,5 +1,5 @@ # SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi(a)alyssa.is> -devtmpfs /dev devtmpfs defaults 0 0 -proc /proc proc defaults 0 0 -sysfs /sys sysfs defaults 0 0 +# SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi(a)alyssa.is> +devtmpfs /dev devtmpfs nosuid 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 diff --git a/host/initramfs/etc/init b/host/initramfs/etc/init index 71948874..723d2e1b 100755 --- a/host/initramfs/etc/init +++ b/host/initramfs/etc/init @@ -42,7 +42,7 @@ if { background { rm /dev/rootfs /dev/verity } -if { mount /dev/mapper/root-verity /mnt/root } +if { mount -o nosuid,nodev /dev/mapper/root-verity /mnt/root } wait { $mdevd_pid } if { mount --move /proc /mnt/root/proc } diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab index 6230d910..5c23a374 100644 --- a/host/rootfs/image/etc/fstab +++ b/host/rootfs/image/etc/fstab @@ -1,7 +1,7 @@ # SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> -proc /proc proc defaults 0 0 -devpts /dev/pts devpts gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs defaults 0 0 -sysfs /sys sysfs defaults 0 0 -tmpfs /tmp tmpfs defaults 0 0 +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi(a)alyssa.is> +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +tmpfs /tmp tmpfs nosuid,nodev 0 0 diff --git a/img/app/image/etc/fstab b/img/app/image/etc/fstab index 2dd1f4d8..5f78ab87 100644 --- a/img/app/image/etc/fstab +++ b/img/app/image/etc/fstab @@ -1,8 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 # SPDX-FileCopyrightText: 2020-2022, 2025 Alyssa Ross <hi(a)alyssa.is> -proc /proc proc defaults 0 0 -devpts /dev/pts devpts gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs defaults 0 0 -sysfs /sys sysfs defaults 0 0 -tmpfs /tmp tmpfs defaults 0 0 -tmpfs /home/user tmpfs mode=0700,uid=1000,gid=1000 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +tmpfs /tmp tmpfs nosuid,nodev 0 0 +tmpfs /home/user tmpfs nodev,mode=0700,uid=1000,gid=1000 0 0 diff --git a/img/app/image/etc/mdev/virtiofs b/img/app/image/etc/mdev/virtiofs index c1fd2834..b6e505bc 100755 --- a/img/app/image/etc/mdev/virtiofs +++ b/img/app/image/etc/mdev/virtiofs @@ -7,6 +7,6 @@ background { # virtiofs filesystems, so we only supported a single, hardcoded # filesystem tag for now. if { mkdir -p /run/virtiofs/virtiofs0 } - if { mount -t virtiofs virtiofs0 /run/virtiofs/virtiofs0 } + if { mount -t virtiofs -o nodev virtiofs0 /run/virtiofs/virtiofs0 } /etc/mdev/listen virtiofs0 } diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/app/run index 0ba1f374..997897de 100755 --- a/img/app/image/etc/s6-rc/app/run +++ b/img/app/image/etc/s6-rc/app/run @@ -17,7 +17,7 @@ foreground { if { modprobe loop } if { backtick -E offset { /run/virtiofs/virtiofs0/config/run --appimage-offset } - mount -o offset=${offset} /run/virtiofs/virtiofs0/config/run /mnt + mount -o offset=${offset},nodev /run/virtiofs/virtiofs0/config/run /mnt } s6-setuidgid user export APPIMAGE /run/virtiofs/virtiofs0/config/run @@ -42,7 +42,7 @@ foreground { nix { if { mount -t overlay - -o ro,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store + -o ro,nosuid,nodev,lowerdir=/nix/store:/run/virtiofs/virtiofs0/config/nix/store store /nix/store } diff --git a/img/app/scripts/start-virtiofsd.elb b/img/app/scripts/start-virtiofsd.elb index e4d265f0..cedce9ae 100755 --- a/img/app/scripts/start-virtiofsd.elb +++ b/img/app/scripts/start-virtiofsd.elb @@ -6,7 +6,7 @@ s6-ipcserver-socketbinder -B build/virtiofsd.sock background { if { mkdir -p build/fs } unshare -rUm - if { mount -t tmpfs fs build/fs } + if { mount -t tmpfs -o nosuid,nodev fs build/fs } if { mkdir build/fs/config } if { importas -Si CONFIG mount --rbind -- ${CONFIG}/fs build/fs/config } importas -SsD virtiofsd VIRTIOFSD diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update index facf7f52..b397f238 100755 --- a/vm/app/systemd-sysupdate/download-update +++ b/vm/app/systemd-sysupdate/download-update @@ -5,7 +5,7 @@ export LC_ALL C export LANGUAGE C unshare -mr -if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } +if { mount -toverlay -o nosuid,nodev,lowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX } # Not a useless use of cat: if there are NUL bytes in the URL # busybox's awk might misbehave. diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab index a0b62fa5..4c240544 100644 --- a/vm/sys/net/image/etc/fstab +++ b/vm/sys/net/image/etc/fstab @@ -1,8 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 -# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi(a)alyssa.is> # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> -proc /proc proc defaults 0 0 -devpts /dev/pts devpts gid=5,mode=620 0 0 -tmpfs /dev/shm tmpfs defaults 0 0 -sysfs /sys sysfs defaults 0 0 -bpffs /sys/fs/bpf bpf defaults 0 0 +proc /proc proc nosuid,nodev,noexec 0 0 +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 +tmpfs /dev/shm tmpfs nosuid,nodev 0 0 +sysfs /sys sysfs nosuid,nodev,noexec 0 0 +bpffs /sys/fs/bpf bpf nosuid,nodev,noexec,mode=700 0 0 base-commit: e32cdde75ef9ec554c1c40bba7f4a75dcaaa779f -- 2.51.0

3 4

[PATCH 1/2] host/rootfs: add root-terminal s6-sudod service
by Alyssa Ross 10 Dec '25

10 Dec '25

This will be needed as an interim measure to allow Weston itself to be run as non-root, without the user losing access to root entirely in the graphical environment. Currently, only root can access this service, so it's redundant, but we can later make the socket accessible to Weston's user. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/file-list.mk | 3 +++ .../service/root-terminal/notification-fd | 1 + .../service/root-terminal/notification-fd.license | 2 ++ .../run-image/service/root-terminal/run | 15 +++++++++++++++ host/rootfs/image/etc/xdg/weston/weston.ini | 4 ++-- host/rootfs/image/usr/bin/root-terminal | 5 +++++ 6 files changed, 28 insertions(+), 2 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license create mode 100755 host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run create mode 100755 host/rootfs/image/usr/bin/root-terminal diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index 6ab78e6b..f69775d2 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -15,6 +15,8 @@ FILES = \ image/etc/s6-linux-init/run-image/service/getty-tty2/run \ image/etc/s6-linux-init/run-image/service/getty-tty3/run \ image/etc/s6-linux-init/run-image/service/getty-tty4/run \ + image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd \ + image/etc/s6-linux-init/run-image/service/root-terminal/run \ image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd \ image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/run \ image/etc/s6-linux-init/run-image/service/s6-svscan-log/notification-fd \ @@ -54,6 +56,7 @@ FILES = \ image/etc/xdg/weston/weston.ini \ image/usr/bin/assign-devices \ image/usr/bin/create-vm-dependencies \ + image/usr/bin/root-terminal \ image/usr/bin/run-appimage \ image/usr/bin/run-flatpak \ image/usr/bin/run-vmm \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd new file mode 100644 index 00000000..00750edc --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd @@ -0,0 +1 @@ +3 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license new file mode 100644 index 00000000..0d3d47ca --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run new file mode 100755 index 00000000..67ccfb45 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run @@ -0,0 +1,15 @@ +#!/bin/execlineb -PW +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +s6-ipcserver-socketbinder -a 0700 /run/root-terminal + +fdmove 1 3 +s6-ipcserverd -1P + +exec -c +/bin/export PATH /usr/bin +/bin/export WAYLAND_DISPLAY "" +s6-sudod +cd / +weston-terminal diff --git a/host/rootfs/image/etc/xdg/weston/weston.ini b/host/rootfs/image/etc/xdg/weston/weston.ini index a1f630cf..a4763c6d 100644 --- a/host/rootfs/image/etc/xdg/weston/weston.ini +++ b/host/rootfs/image/etc/xdg/weston/weston.ini @@ -6,8 +6,8 @@ path=/etc/xdg/weston/autolaunch [launcher] icon=/usr/share/weston/icon_terminal.png -displayname=Terminal -path=/bin/weston-terminal +displayname=Root Terminal +path=/bin/root-terminal [launcher] icon=/usr/share/icons/hicolor/20x20/apps/com.system76.CosmicFiles.png diff --git a/host/rootfs/image/usr/bin/root-terminal b/host/rootfs/image/usr/bin/root-terminal new file mode 100755 index 00000000..4f2874d1 --- /dev/null +++ b/host/rootfs/image/usr/bin/root-terminal @@ -0,0 +1,5 @@ +#!/bin/execlineb -Ws0 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> + +s6-sudo -- /run/root-terminal $@ -- 2.51.0

3 7

[PATCH 1/2] host/rootfs: atomically delete VM directories
by Alyssa Ross 10 Dec '25

10 Dec '25

Create a hidden empty directory, swap it with the original one, then remove both. Teach lsvm to ignore both hidden and empty directories, and now we no longer have a race where lsvm would get confused if a VM directory was in the process of being recursively removed when it looked at it. Fixes: b51a97f ("host/rootfs: add run-appimage program") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/image/usr/bin/run-appimage | 7 ++++++- host/rootfs/image/usr/bin/run-flatpak | 7 ++++++- tools/lsvm.rs | 19 ++++++++++++++----- 3 files changed, 26 insertions(+), 7 deletions(-) diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage index 36f57b85..d61a79c6 100755 --- a/host/rootfs/image/usr/bin/run-appimage +++ b/host/rootfs/image/usr/bin/run-appimage @@ -43,4 +43,9 @@ if { s6-instance-delete /run/service/vm-services $id } if { umount ${dir}/mount } # mount namespace if { umount ${dir}/mount } # private bind mount -rm -r $dir /run/configs/${id} + +# Atomically swap the VM directory with an empty one, which will be ignored by +# lsvm, then remove it, so we never have half a VM directory. +if { mkdir /run/vm/by-id/.${id} } +if { exch /run/vm/by-id/.${id} $dir } +background { rm -rf /run/vm/by-id/.${id} $dir } diff --git a/host/rootfs/image/usr/bin/run-flatpak b/host/rootfs/image/usr/bin/run-flatpak index 2ef20433..6be21075 100755 --- a/host/rootfs/image/usr/bin/run-flatpak +++ b/host/rootfs/image/usr/bin/run-flatpak @@ -45,4 +45,9 @@ if { s6-instance-delete -- /run/service/vm-services $id } if { umount ${dir}/mount } # mount namespace if { umount ${dir}/mount } # private bind mount -rm -r $dir /run/configs/${id} + +# Atomically swap the VM directory with an empty one, which will be ignored by +# lsvm, then remove it, so we never have half a VM directory. +if { mkdir /run/vm/by-id/.${id} } +if { exch /run/vm/by-id/.${id} $dir } +background { rm -rf /run/vm/by-id/.${id} $dir } diff --git a/tools/lsvm.rs b/tools/lsvm.rs index 8f98e4f6..5d67ac6f 100644 --- a/tools/lsvm.rs +++ b/tools/lsvm.rs @@ -81,12 +81,21 @@ fn run() -> Result<(), String> { for entry in read_dir("/run/vm/by-id").map_err(|e| format!("reading /run/vm/by-id: {e}"))? { let entry = entry.map_err(|e| format!("iterating /run/vm/by-id: {e}"))?; - if entry - .file_type() - .map_err(|e| format!("getting type of {:?}: {e}", entry.path()))? - .is_dir() + if !entry.file_name().as_bytes().starts_with(b".") + && entry + .file_type() + .map_err(|e| format!("getting type of {:?}: {e}", entry.path()))? + .is_dir() { - names.insert(entry.file_name(), Vec::new()); + let path = entry.path(); + if path + .read_dir() + .map_err(|e| format!("reading {path:?}: {e}"))? + .next() + .is_some() + { + names.insert(entry.file_name(), Vec::new()); + } } } -- 2.51.0

1 1

[PATCH v2 1/6] host/rootfs: make passwd and group links into /run
by Alyssa Ross 09 Dec '25

09 Dec '25

This will allow us to give shadow's useradd /run as a prefix, and have it be able to add users at runtime. Reviewed-by: Demi Marie Obenour <demiobenour(a)gmail.com> Signed-off-by: Alyssa Ross <hi(a)alyssa.is> Message-ID: <20251209085628.603316-1-hi(a)alyssa.is> --- v2: use relative paths for symlink targets v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251209085628.603316… host/rootfs/file-list.mk | 6 ++++-- host/rootfs/image/etc/group | 16 +--------------- host/rootfs/image/etc/passwd | 2 +- .../etc/{ => s6-linux-init/run-image/etc}/group | 0 .../run-image/etc}/group.license | 0 .../etc/{ => s6-linux-init/run-image/etc}/passwd | 0 .../run-image/etc}/passwd.license | 0 7 files changed, 6 insertions(+), 18 deletions(-) mode change 100644 => 120000 host/rootfs/image/etc/group mode change 100644 => 120000 host/rootfs/image/etc/passwd copy host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/group (100%) rename host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/group.license (100%) copy host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/passwd (100%) rename host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/passwd.license (100%) diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce8..6ab78e6b 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -4,13 +4,13 @@ FILES = \ image/etc/fonts/fonts.conf \ image/etc/fstab \ - image/etc/group \ image/etc/init \ image/etc/login \ image/etc/parse-devname \ - image/etc/passwd \ image/etc/s6-linux-init/env/WAYLAND_DISPLAY \ image/etc/s6-linux-init/env/XDG_RUNTIME_DIR \ + image/etc/s6-linux-init/run-image/etc/group \ + image/etc/s6-linux-init/run-image/etc/passwd \ image/etc/s6-linux-init/run-image/service/getty-tty1/run \ image/etc/s6-linux-init/run-image/service/getty-tty2/run \ image/etc/s6-linux-init/run-image/service/getty-tty3/run \ @@ -68,6 +68,8 @@ FILES = \ LINKS = \ image/bin \ + image/etc/group \ + image/etc/passwd \ image/etc/s6-linux-init/run-image/opengl-driver \ image/etc/s6-linux-init/run-image/service/vmm/template/run \ image/lib \ diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group deleted file mode 100644 index e3ade468..00000000 --- a/host/rootfs/image/etc/group +++ /dev/null @@ -1,15 +0,0 @@ -root:x:0:root -clock:x:1: -dialout:x:2: -kmem:x:3: -input:x:4: -tty:x:5: -video:x:6: -render:x:7: -sgx:x:8: -audio:x:9: -lp:x:10: -disk:x:11: -cdrom:x:12: -tape:x:13: -kvm:x:14: diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group new file mode 120000 index 00000000..8dba62ad --- /dev/null +++ b/host/rootfs/image/etc/group @@ -0,0 +1 @@ +../run/etc/group \ No newline at end of file diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd deleted file mode 100644 index 29f3b252..00000000 --- a/host/rootfs/image/etc/passwd +++ /dev/null @@ -1 +0,0 @@ -root:x:0:0:System administrator:/:/bin/sh diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd new file mode 120000 index 00000000..1429c284 --- /dev/null +++ b/host/rootfs/image/etc/passwd @@ -0,0 +1 @@ +../run/etc/passwd \ No newline at end of file diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group similarity index 100% copy from host/rootfs/image/etc/group copy to host/rootfs/image/etc/s6-linux-init/run-image/etc/group diff --git a/host/rootfs/image/etc/group.license b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group.license similarity index 100% rename from host/rootfs/image/etc/group.license rename to host/rootfs/image/etc/s6-linux-init/run-image/etc/group.license diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd similarity index 100% copy from host/rootfs/image/etc/passwd copy to host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd diff --git a/host/rootfs/image/etc/passwd.license b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd.license similarity index 100% rename from host/rootfs/image/etc/passwd.license rename to host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd.license -- 2.51.0

2 11

[PATCH 1/3] tools/router: use socket activation
by Alyssa Ross 09 Dec '25

09 Dec '25

This means we can use readiness notification to wait until the sockets are created without having to add special functionality for that to the router program, and also means we can do extra system-specific setup to the sockets, like changing their owners, outside of the router. Since the socket paths were the only arguments taken by the router, this also lets us drop the clap dependency entirely. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/file-list.mk | 1 + .../service/spectrum-router/notification-fd | 1 + .../spectrum-router/notification-fd.license | 2 + .../template/data/service/spectrum-router/run | 19 +++ tools/router/Cargo.lock | 148 ++++++++++++------ tools/router/Cargo.toml | 2 +- tools/router/src/main.rs | 37 ++--- 7 files changed, 138 insertions(+), 72 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce..5a043b7 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -28,6 +28,7 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \ + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd new file mode 100644 index 0000000..7ed6ff8 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd @@ -0,0 +1 @@ +5 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license new file mode 100644 index 0000000..0d3d47c --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index 3ba35de..61375ca 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -1,14 +1,30 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> importas -i VM VM +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-driver.sock +fdmove -c 3 0 + +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-app.sock +fdmove -c 4 0 + +# Notify readiness. +if { + fdmove -c 5 1 + echo +} + +redirfd -r 0 /dev/null + bwrap --unshare-all --unshare-user --dev-bind / / --setenv RUST_LOG spectrum-router=debug,info + --setenv LISTEN_FDS 2 --tmpfs /tmp --dev /dev --tmpfs /dev/shm @@ -19,6 +35,9 @@ bwrap --ro-bind /lib /lib --bind /run/vm/by-id/${VM} /run/vm/by-id/${VM} -- + +getpid LISTEN_PID + spectrum-router --app-listen-path /run/vm/by-id/${VM}/router-app.sock --driver-listen-path /run/vm/by-id/${VM}/router-driver.sock diff --git a/tools/router/Cargo.lock b/tools/router/Cargo.lock index 60d7657..d0d105a 100644 --- a/tools/router/Cargo.lock +++ b/tools/router/Cargo.lock @@ -113,6 +113,12 @@ dependencies = [ "wyz", ] +[[package]] +name = "bumpalo" +version = "3.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43" + [[package]] name = "bytes" version = "1.11.0" @@ -120,44 +126,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3" [[package]] -name = "clap" -version = "4.5.53" +name = "cfg-if" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8" -dependencies = [ - "clap_builder", - "clap_derive", -] - -[[package]] -name = "clap_builder" -version = "4.5.53" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00" -dependencies = [ - "anstream", - "anstyle", - "clap_lex", - "strsim", -] - -[[package]] -name = "clap_derive" -version = "4.5.49" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671" -dependencies = [ - "heck", - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "clap_lex" -version = "0.7.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "colorchoice" @@ -263,12 +235,6 @@ dependencies = [ "slab", ] -[[package]] -name = "heck" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" - [[package]] name = "is_terminal_polyfill" version = "1.70.2" @@ -299,12 +265,33 @@ dependencies = [ "syn", ] +[[package]] +name = "js-sys" +version = "0.3.83" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8" +dependencies = [ + "once_cell", + "wasm-bindgen", +] + [[package]] name = "libc" version = "0.2.177" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" +[[package]] +name = "listenfd" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b87bc54a4629b4294d0b3ef041b64c40c611097a677d9dc07b2c67739fe39dba" +dependencies = [ + "libc", + "uuid", + "winapi", +] + [[package]] name = "log" version = "0.4.28" @@ -328,6 +315,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + [[package]] name = "once_cell_polyfill" version = "1.70.2" @@ -420,6 +413,12 @@ version = "0.8.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58" +[[package]] +name = "rustversion" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" + [[package]] name = "serde_core" version = "1.0.228" @@ -462,9 +461,9 @@ version = "0.1.0" dependencies = [ "anyhow", "arrayvec", - "clap", "env_logger", "futures-util", + "listenfd", "log", "tokio", "tokio-stream", @@ -474,12 +473,6 @@ dependencies = [ "zerocopy", ] -[[package]] -name = "strsim" -version = "0.11.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" - [[package]] name = "syn" version = "2.0.111" @@ -608,6 +601,16 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" +[[package]] +name = "uuid" +version = "1.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + [[package]] name = "vhost-device-net" version = "0.1.1" @@ -666,6 +669,51 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" +[[package]] +name = "wasm-bindgen" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd" +dependencies = [ + "cfg-if", + "once_cell", + "rustversion", + "wasm-bindgen-macro", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-macro" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3" +dependencies = [ + "quote", + "wasm-bindgen-macro-support", +] + +[[package]] +name = "wasm-bindgen-macro-support" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40" +dependencies = [ + "bumpalo", + "proc-macro2", + "quote", + "syn", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-shared" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4" +dependencies = [ + "unicode-ident", +] + [[package]] name = "winapi" version = "0.3.9" diff --git a/tools/router/Cargo.toml b/tools/router/Cargo.toml index 0b96911..cfdf352 100644 --- a/tools/router/Cargo.toml +++ b/tools/router/Cargo.toml @@ -8,7 +8,6 @@ edition = "2024" [dependencies] anyhow = "1.0.100" -clap = { version = "4.5.45", features = ["derive"] } env_logger = "0.11.8" log = { version = "0.4.27", features = ["release_max_level_debug"] } vhost-device-net = "0.1.0" @@ -19,3 +18,4 @@ tokio-stream = "0.1.17" arrayvec = "0.7.6" vm-memory = "0.16" tokio-util = "0.7.17" +listenfd = "1.0.2" diff --git a/tools/router/src/main.rs b/tools/router/src/main.rs index e3aca65..a96d511 100644 --- a/tools/router/src/main.rs +++ b/tools/router/src/main.rs @@ -1,47 +1,42 @@ // SPDX-License-Identifier: EUPL-1.2+ // SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> pub(crate) mod packet; pub(crate) mod protocol; mod router; mod upstream; -use std::path::PathBuf; - use packet::*; use router::{InterfaceId, Router}; use upstream::Upstream; -use clap::Parser; +use anyhow::anyhow; use futures_util::{SinkExt, TryStreamExt}; +use listenfd::ListenFd; use log::{error, info}; use tokio::net::UnixListener; use vhost_device_net::{IncomingPacket, VhostDeviceNet}; use vm_memory::GuestMemoryMmap; -#[derive(Parser, Debug)] -#[command()] //version = None, about = None, long_about = None)] -struct Args { - #[arg(long)] - driver_listen_path: PathBuf, - #[arg(long)] - app_listen_path: PathBuf, -} - fn main() -> anyhow::Result<()> { env_logger::init(); - let args = Args::parse(); - for path in [&args.driver_listen_path, &args.app_listen_path] { - let _ = std::fs::remove_file(path); - } - - run_router(args) + run_router() } #[tokio::main(flavor = "current_thread")] -async fn run_router(args: Args) -> anyhow::Result<()> { - let app_listener = UnixListener::bind(&args.app_listen_path)?; - let driver_listener = UnixListener::bind(&args.driver_listen_path)?; +async fn run_router() -> anyhow::Result<()> { + let mut listenfd = ListenFd::from_env(); + + let Some(driver_listener) = listenfd.take_unix_listener(0)? else { + return Err(anyhow!("not activated with driver socket")); + }; + let Some(app_listener) = listenfd.take_unix_listener(1)? else { + return Err(anyhow!("not activated with app socket")); + }; + + let driver_listener = UnixListener::from_std(driver_listener)?; + let app_listener = UnixListener::from_std(app_listener)?; let mut router = Router::<GuestMemoryMmap>::new(InterfaceId::Upstream); base-commit: 04b6183cbbb624996cf848ee248be6dd719ace23 -- 2.51.0

2 9

[PATCH] host/rootfs: Sandbox crosvm
by Demi Marie Obenour 09 Dec '25

09 Dec '25

This means that a breach of crosvm is not guaranteed to be fatal. The Wayland socket is still only accessible by root, so crosvm must run as root. The known container escape via /proc/self/exe is blocked by bwrap being on a read-only filesystem. Container escapes via /proc are blocked by remounting /proc read-only. Crosvm does not have CAP_SYS_ADMIN so it cannot change mounts. The two remaining steps are: - Run crosvm as an unprivileged user. - Enable seccomp to block most system calls. The latter should be done from within crosvm itself. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/default.nix | 6 +++--- .../template/data/service/vhost-user-gpu/run | 17 ++++++++++++++++- 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index b441a517f3bbb78f84d8566ca6dfd9181d0302be..81e12b6c2e98ca789d2d14e56dd2b7175296c1e8 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -10,7 +10,7 @@ pkgsMusl.callPackage ( { spectrum-host-tools , lib, stdenvNoCC, nixos, runCommand, writeClosure, erofs-utils, s6-rc -, busybox, cloud-hypervisor, cosmic-files, crosvm, cryptsetup +, bubblewrap, busybox, cloud-hypervisor, cosmic-files, crosvm, cryptsetup , dejavu_fonts, dbus, execline, foot, fuse3, iproute2, inotify-tools , jq, kmod, mdevd, mesa, s6, s6-linux-init, socat, systemd , util-linuxMinimal, virtiofsd, westonLite, xdg-desktop-portal @@ -25,8 +25,8 @@ let trivial; packages = [ - btrfs-progs cloud-hypervisor cosmic-files crosvm cryptsetup dbus - execline fuse3 inotify-tools iproute2 jq kmod mdevd s6 s6-linux-init + bubblewrap btrfs-progs cloud-hypervisor cosmic-files crosvm cryptsetup + dbus execline fuse3 inotify-tools iproute2 jq kmod mdevd s6 s6-linux-init s6-rc socat spectrum-host-tools util-linuxMinimal virtiofsd xdg-desktop-portal-spectrum-host diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run index 0b4f6a00bc7aed0e721454d584d3bcd47fb18e2a..4838199a859cfadb45c23fb314f4651c6a6b3041 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run @@ -1,10 +1,25 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> s6-ipcserver -1a 0700 -C 1 -b 1 env/crosvm.sock -crosvm --no-syslog device gpu +bwrap + --unshare-all + --unshare-user + --bind /run/user/0/wayland-1 /run/user/0/wayland-1 + --ro-bind /usr /usr + --ro-bind /lib /lib + --tmpfs /tmp + --dev /dev + --tmpfs /dev/shm + --ro-bind /nix /nix + --disable-userns + --proc /proc + --remount-ro /proc + -- + crosvm --no-syslog device gpu --fd 0 --wayland-sock /run/user/0/wayland-1 --params "{\"context-types\":\"cross-domain\"}" --- base-commit: 965f5706764edb1b4fea147683b5ab803dd6df5e change-id: 20251129-sandbox-5a42a6a41b59 -- Sincerely, Demi Marie Obenour (she/her/hers)

4 36

[PATCH v2 1/3] tools/router: use socket activation
by Alyssa Ross 09 Dec '25

09 Dec '25

This means we can use readiness notification to wait until the sockets are created without having to add special functionality for that to the router program, and also means we can do extra system-specific setup to the sockets, like changing their owners, outside of the router. Since the socket paths were the only arguments taken by the router, this also lets us drop the clap dependency entirely. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> Message-ID: <20251209003813.553461-1-hi(a)alyssa.is> --- v2: stop passing obsolete arguments to router v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251209003813.553461… host/rootfs/file-list.mk | 1 + .../service/spectrum-router/notification-fd | 1 + .../spectrum-router/notification-fd.license | 2 + .../template/data/service/spectrum-router/run | 21 ++- tools/router/Cargo.lock | 148 ++++++++++++------ tools/router/Cargo.toml | 2 +- tools/router/src/main.rs | 37 ++--- 7 files changed, 138 insertions(+), 74 deletions(-) create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd create mode 100644 host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce8..5a043b7b 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -28,6 +28,7 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \ + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd new file mode 100644 index 00000000..7ed6ff82 --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd @@ -0,0 +1 @@ +5 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license new file mode 100644 index 00000000..0d3d47ca --- /dev/null +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd.license @@ -0,0 +1,2 @@ +SPDX-License-Identifier: CC0-1.0 +SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index 3ba35def..dc1ef900 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -1,14 +1,30 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> importas -i VM VM +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-driver.sock +fdmove -c 3 0 + +s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-app.sock +fdmove -c 4 0 + +# Notify readiness. +if { + fdmove -c 5 1 + echo +} + +redirfd -r 0 /dev/null + bwrap --unshare-all --unshare-user --dev-bind / / --setenv RUST_LOG spectrum-router=debug,info + --setenv LISTEN_FDS 2 --tmpfs /tmp --dev /dev --tmpfs /dev/shm @@ -19,6 +35,7 @@ bwrap --ro-bind /lib /lib --bind /run/vm/by-id/${VM} /run/vm/by-id/${VM} -- + +getpid LISTEN_PID + spectrum-router - --app-listen-path /run/vm/by-id/${VM}/router-app.sock - --driver-listen-path /run/vm/by-id/${VM}/router-driver.sock diff --git a/tools/router/Cargo.lock b/tools/router/Cargo.lock index 60d7657b..d0d105aa 100644 --- a/tools/router/Cargo.lock +++ b/tools/router/Cargo.lock @@ -113,6 +113,12 @@ dependencies = [ "wyz", ] +[[package]] +name = "bumpalo" +version = "3.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43" + [[package]] name = "bytes" version = "1.11.0" @@ -120,44 +126,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3" [[package]] -name = "clap" -version = "4.5.53" +name = "cfg-if" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8" -dependencies = [ - "clap_builder", - "clap_derive", -] - -[[package]] -name = "clap_builder" -version = "4.5.53" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00" -dependencies = [ - "anstream", - "anstyle", - "clap_lex", - "strsim", -] - -[[package]] -name = "clap_derive" -version = "4.5.49" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671" -dependencies = [ - "heck", - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "clap_lex" -version = "0.7.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "colorchoice" @@ -263,12 +235,6 @@ dependencies = [ "slab", ] -[[package]] -name = "heck" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" - [[package]] name = "is_terminal_polyfill" version = "1.70.2" @@ -299,12 +265,33 @@ dependencies = [ "syn", ] +[[package]] +name = "js-sys" +version = "0.3.83" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8" +dependencies = [ + "once_cell", + "wasm-bindgen", +] + [[package]] name = "libc" version = "0.2.177" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976" +[[package]] +name = "listenfd" +version = "1.0.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b87bc54a4629b4294d0b3ef041b64c40c611097a677d9dc07b2c67739fe39dba" +dependencies = [ + "libc", + "uuid", + "winapi", +] + [[package]] name = "log" version = "0.4.28" @@ -328,6 +315,12 @@ dependencies = [ "windows-sys 0.61.2", ] +[[package]] +name = "once_cell" +version = "1.21.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" + [[package]] name = "once_cell_polyfill" version = "1.70.2" @@ -420,6 +413,12 @@ version = "0.8.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58" +[[package]] +name = "rustversion" +version = "1.0.22" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" + [[package]] name = "serde_core" version = "1.0.228" @@ -462,9 +461,9 @@ version = "0.1.0" dependencies = [ "anyhow", "arrayvec", - "clap", "env_logger", "futures-util", + "listenfd", "log", "tokio", "tokio-stream", @@ -474,12 +473,6 @@ dependencies = [ "zerocopy", ] -[[package]] -name = "strsim" -version = "0.11.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" - [[package]] name = "syn" version = "2.0.111" @@ -608,6 +601,16 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" +[[package]] +name = "uuid" +version = "1.19.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a" +dependencies = [ + "js-sys", + "wasm-bindgen", +] + [[package]] name = "vhost-device-net" version = "0.1.1" @@ -666,6 +669,51 @@ version = "0.11.1+wasi-snapshot-preview1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" +[[package]] +name = "wasm-bindgen" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd" +dependencies = [ + "cfg-if", + "once_cell", + "rustversion", + "wasm-bindgen-macro", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-macro" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3" +dependencies = [ + "quote", + "wasm-bindgen-macro-support", +] + +[[package]] +name = "wasm-bindgen-macro-support" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40" +dependencies = [ + "bumpalo", + "proc-macro2", + "quote", + "syn", + "wasm-bindgen-shared", +] + +[[package]] +name = "wasm-bindgen-shared" +version = "0.2.106" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4" +dependencies = [ + "unicode-ident", +] + [[package]] name = "winapi" version = "0.3.9" diff --git a/tools/router/Cargo.toml b/tools/router/Cargo.toml index 0b969113..cfdf3527 100644 --- a/tools/router/Cargo.toml +++ b/tools/router/Cargo.toml @@ -8,7 +8,6 @@ edition = "2024" [dependencies] anyhow = "1.0.100" -clap = { version = "4.5.45", features = ["derive"] } env_logger = "0.11.8" log = { version = "0.4.27", features = ["release_max_level_debug"] } vhost-device-net = "0.1.0" @@ -19,3 +18,4 @@ tokio-stream = "0.1.17" arrayvec = "0.7.6" vm-memory = "0.16" tokio-util = "0.7.17" +listenfd = "1.0.2" diff --git a/tools/router/src/main.rs b/tools/router/src/main.rs index e3aca65a..a96d5114 100644 --- a/tools/router/src/main.rs +++ b/tools/router/src/main.rs @@ -1,47 +1,42 @@ // SPDX-License-Identifier: EUPL-1.2+ // SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka(a)cyberchaos.dev> +// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> pub(crate) mod packet; pub(crate) mod protocol; mod router; mod upstream; -use std::path::PathBuf; - use packet::*; use router::{InterfaceId, Router}; use upstream::Upstream; -use clap::Parser; +use anyhow::anyhow; use futures_util::{SinkExt, TryStreamExt}; +use listenfd::ListenFd; use log::{error, info}; use tokio::net::UnixListener; use vhost_device_net::{IncomingPacket, VhostDeviceNet}; use vm_memory::GuestMemoryMmap; -#[derive(Parser, Debug)] -#[command()] //version = None, about = None, long_about = None)] -struct Args { - #[arg(long)] - driver_listen_path: PathBuf, - #[arg(long)] - app_listen_path: PathBuf, -} - fn main() -> anyhow::Result<()> { env_logger::init(); - let args = Args::parse(); - for path in [&args.driver_listen_path, &args.app_listen_path] { - let _ = std::fs::remove_file(path); - } - - run_router(args) + run_router() } #[tokio::main(flavor = "current_thread")] -async fn run_router(args: Args) -> anyhow::Result<()> { - let app_listener = UnixListener::bind(&args.app_listen_path)?; - let driver_listener = UnixListener::bind(&args.driver_listen_path)?; +async fn run_router() -> anyhow::Result<()> { + let mut listenfd = ListenFd::from_env(); + + let Some(driver_listener) = listenfd.take_unix_listener(0)? else { + return Err(anyhow!("not activated with driver socket")); + }; + let Some(app_listener) = listenfd.take_unix_listener(1)? else { + return Err(anyhow!("not activated with app socket")); + }; + + let driver_listener = UnixListener::from_std(driver_listener)?; + let app_listener = UnixListener::from_std(app_listener)?; let mut router = Router::<GuestMemoryMmap>::new(InterfaceId::Upstream); -- 2.51.0

2 3

[PATCH 1/5] host/rootfs: make passwd and group links into /run
by Alyssa Ross 09 Dec '25

09 Dec '25

This will allow us to give shadow's useradd /run as a prefix, and have it be able to add users at runtime. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- host/rootfs/file-list.mk | 6 ++++-- host/rootfs/image/etc/group | 16 +--------------- host/rootfs/image/etc/passwd | 2 +- .../etc/{ => s6-linux-init/run-image/etc}/group | 0 .../run-image/etc}/group.license | 0 .../etc/{ => s6-linux-init/run-image/etc}/passwd | 0 .../run-image/etc}/passwd.license | 0 7 files changed, 6 insertions(+), 18 deletions(-) mode change 100644 => 120000 host/rootfs/image/etc/group mode change 100644 => 120000 host/rootfs/image/etc/passwd copy host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/group (100%) rename host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/group.license (100%) copy host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/passwd (100%) rename host/rootfs/image/etc/{ => s6-linux-init/run-image/etc}/passwd.license (100%) diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce..6ab78e6 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -4,13 +4,13 @@ FILES = \ image/etc/fonts/fonts.conf \ image/etc/fstab \ - image/etc/group \ image/etc/init \ image/etc/login \ image/etc/parse-devname \ - image/etc/passwd \ image/etc/s6-linux-init/env/WAYLAND_DISPLAY \ image/etc/s6-linux-init/env/XDG_RUNTIME_DIR \ + image/etc/s6-linux-init/run-image/etc/group \ + image/etc/s6-linux-init/run-image/etc/passwd \ image/etc/s6-linux-init/run-image/service/getty-tty1/run \ image/etc/s6-linux-init/run-image/service/getty-tty2/run \ image/etc/s6-linux-init/run-image/service/getty-tty3/run \ @@ -68,6 +68,8 @@ FILES = \ LINKS = \ image/bin \ + image/etc/group \ + image/etc/passwd \ image/etc/s6-linux-init/run-image/opengl-driver \ image/etc/s6-linux-init/run-image/service/vmm/template/run \ image/lib \ diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group deleted file mode 100644 index e3ade46..0000000 --- a/host/rootfs/image/etc/group +++ /dev/null @@ -1,15 +0,0 @@ -root:x:0:root -clock:x:1: -dialout:x:2: -kmem:x:3: -input:x:4: -tty:x:5: -video:x:6: -render:x:7: -sgx:x:8: -audio:x:9: -lp:x:10: -disk:x:11: -cdrom:x:12: -tape:x:13: -kvm:x:14: diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group new file mode 120000 index 0000000..a9b248e --- /dev/null +++ b/host/rootfs/image/etc/group @@ -0,0 +1 @@ +/run/etc/group \ No newline at end of file diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd deleted file mode 100644 index 29f3b25..0000000 --- a/host/rootfs/image/etc/passwd +++ /dev/null @@ -1 +0,0 @@ -root:x:0:0:System administrator:/:/bin/sh diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd new file mode 120000 index 0000000..889bb76 --- /dev/null +++ b/host/rootfs/image/etc/passwd @@ -0,0 +1 @@ +/run/etc/passwd \ No newline at end of file diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group similarity index 100% copy from host/rootfs/image/etc/group copy to host/rootfs/image/etc/s6-linux-init/run-image/etc/group diff --git a/host/rootfs/image/etc/group.license b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group.license similarity index 100% rename from host/rootfs/image/etc/group.license rename to host/rootfs/image/etc/s6-linux-init/run-image/etc/group.license diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd similarity index 100% copy from host/rootfs/image/etc/passwd copy to host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd diff --git a/host/rootfs/image/etc/passwd.license b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd.license similarity index 100% rename from host/rootfs/image/etc/passwd.license rename to host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd.license base-commit: d0efa283216ebc503b4b715c051518ae7dbd8409 -- 2.51.0

2 14

[PATCH] host/rootfs: Sandbox Cloud Hypervisor
by Demi Marie Obenour 09 Dec '25

09 Dec '25

It only needs access to a small number of resources. Unfortunately, it needs access to /dev/vfio right now. This should be fixed by using file descriptor passing instead. Also, Cloud Hypervisor should not run as root. Cloud Hypervisor needs to be able to lock memory. Running in a user namespace prevents it from using CAP_IPC_LOCK. Therefore, it is necessary to increase RLIMIT_MLOCK before running Cloud Hypervisor. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/usr/bin/run-vmm | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm index ba8b59c2677408acdd01c2eda3cf2dd60992d881..24c3d607bfcf6fea6196b61d2941141486d33fd6 100755 --- a/host/rootfs/image/usr/bin/run-vmm +++ b/host/rootfs/image/usr/bin/run-vmm @@ -52,5 +52,36 @@ unexport ! fdmove -c 3 0 redirfd -r 0 /dev/null +s6-softlimit -H -l 18446744073709551615 if { udevadm wait /dev/kvm } -cloud-hypervisor --api-socket fd=3 +bwrap + --unshare-all + --unshare-user + --dev /dev + --dev-bind /dev/kvm /dev/kvm + --dev-bind /dev/vfio /dev/vfio + --tmpfs /dev/shm + --tmpfs /tmp + --tmpfs /var/tmp + --ro-bind /etc /etc + --ro-bind /lib /lib + --ro-bind /nix /nix + --ro-bind /usr /usr + --ro-bind /sys /sys + --bind /run /run + --proc /proc + --ro-bind /proc/sys /proc/sys + --tmpfs /proc/scsi + --remount-ro /proc/scsi + --tmpfs /proc/acpi + --remount-ro /proc/acpi + --tmpfs /proc/fs + --remount-ro /proc/fs + --tmpfs /proc/irq + --remount-ro /proc/irq + --ro-bind /dev/null /proc/timer_list + --ro-bind /dev/null /proc/kcore + --ro-bind /dev/null /proc/kallsyms + --ro-bind /dev/null /proc/sysrq-trigger + -- + cloud-hypervisor --api-socket fd=3 --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251206-b4-sandbox-9be7e5ed9926 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 5