- Spectrum Development - spectrum-os.org

[REGRESSION] Networking for Firefox broken on second VM run
by Alyssa Ross 09 Dec '25

09 Dec '25

Since we introduced the userspace router, if I start the Firefox VM, quit Firefox, wait for the VM to shut down, and then start it again, networking no longer works, and I see repeating log lines like this: 2025-12-09 09:13:29.147240893 [2025-12-09T09:13:29Z WARN spectrum_router::router] interface App(0) has been blocked for 1 sec, dropping packet Full reproduction steps: 1. cd host/rootfs 2. nix-shell --run 'make clean && make run' 3. Start Firefox VM with vm-start 4. See that networking works 5. Quit Firefox and wait a few seconds for VM to stop 6. Start Firefox VM with vm-start again 7. No more networking, and log lines like the above

1 2

[PATCH] img/app: Delete dependency on nonexistent nftables service
by Demi Marie Obenour 09 Dec '25

09 Dec '25

This file was not included in the application image. Fixes: dcee941 ("vm/sys/net: integrate xdp-forwarder") Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables | 0 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables b/img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables deleted file mode 100644 index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..0000000000000000000000000000000000000000 --- base-commit: 44f32b7a4b3cfbb4046447318e6753dd0eb71add change-id: 20251201-fix-file-list-3fdfd53bd150 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 2

[PATCH] vm/sys/net: start nftables service
by Yureka Lilian 09 Dec '25

09 Dec '25

This was supposed to be here all along to ensure the net-vm does not create any traffic on any interfaces except for the xdp-forwarder setup. Fixes: dcee941 ("vm/sys/net: integrate xdp-forwarder") Signed-off-by: Yureka Lilian <yureka(a)cyberchaos.dev> --- vm/sys/net/file-list.mk | 1 + vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables | 0 2 files changed, 1 insertion(+) create mode 100644 vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables diff --git a/vm/sys/net/file-list.mk b/vm/sys/net/file-list.mk index 7cc3520..dfea2a8 100644 --- a/vm/sys/net/file-list.mk +++ b/vm/sys/net/file-list.mk @@ -26,6 +26,7 @@ S6_RC_FILES = \ image/etc/s6-rc/mdevd-coldplug/dependencies.d/mdevd \ image/etc/s6-rc/mdevd-coldplug/type \ image/etc/s6-rc/mdevd-coldplug/up \ + image/etc/s6-rc/mdevd/dependencies.d/nftables \ image/etc/s6-rc/mdevd/notification-fd \ image/etc/s6-rc/mdevd/run \ image/etc/s6-rc/mdevd/type \ diff --git a/vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables b/vm/sys/net/image/etc/s6-rc/mdevd/dependencies.d/nftables new file mode 100644 index 0000000..e69de29 -- 2.51.2

3 2

[PATCH] host/rootfs: Set no_new_privs in PID 1
by Demi Marie Obenour 08 Dec '25

08 Dec '25

This prevents any program on the host from gaining privileges via execve(), ever. There are currently no such programs on the host so this should be a no-op for now. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/image/etc/init | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/host/rootfs/image/etc/init b/host/rootfs/image/etc/init index 4085fa55545e7309004967e443e47fc2b82b0663..e9938acec866045962a8ead096d199cbd3792469 100755 --- a/host/rootfs/image/etc/init +++ b/host/rootfs/image/etc/init @@ -2,4 +2,4 @@ # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2022 Alyssa Ross <hi(a)alyssa.is> -/bin/s6-linux-init -c /etc/s6-linux-init -s /run/param -- $@ +/usr/bin/setpriv --no-new-privs -- /bin/s6-linux-init -c /etc/s6-linux-init -s /run/param -- $@ --- base-commit: 92e219e7c08c479d216a46d2736ea9d229ff034d change-id: 20251205-no-new-privs-2f22088c0736 -- Sincerely, Demi Marie Obenour (she/her/hers)

3 2

[PATCH] vm/app/systemd-sysupdate: fix mounting overlay
by Alyssa Ross 08 Dec '25

08 Dec '25

This assumed it would be run as root, so has been broken since we stopped running application scripts as root inside img/app VMs. Reported-by: Johannes Süllner <johannes.suellner(a)mailbox.org> Link: https://matrix.to/#/!xSysqhzbOZImdvGpix:fairydust.space/$9psDI3BIP00EIzW-qO… Fixes: 8bfcbf9 ("img/app: run applications as non-root") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- vm/app/systemd-sysupdate/download-update | 1 + 1 file changed, 1 insertion(+) diff --git a/vm/app/systemd-sysupdate/download-update b/vm/app/systemd-sysupdate/download-update index eada41c..335e389 100755 --- a/vm/app/systemd-sysupdate/download-update +++ b/vm/app/systemd-sysupdate/download-update @@ -3,6 +3,7 @@ # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> export LC_ALL C export LANGUAGE C +unshare -rUm if { mount -toverlay -olowerdir=/run/virtiofs/virtiofs0/etc:/etc -- overlay /etc } backtick tmpdir { mktemp -d /tmp/sysupdate-XXXXXX } # Not a useless use of cat: if there are NUL bytes in the URL base-commit: 9f33ec29d39df59589ed7c1b85d54e116e135df8 -- 2.51.0

2 6

[REGRESSION] VMs can't be rebooted
by Alyssa Ross 07 Dec '25

07 Dec '25

Since a655117 ("tools: start-vmm: enable Cloud Hypervisor landlock"), it's not possible to reboot a VM: ~ # ch-remote --api-socket /run/vm/by-id/dLPcEC/vmm reboot [2025-12-07T13:04:25Z ERROR cloud_hypervisor] Fatal error: HttpApiClient(ServerResponse(InternalServerError, Some("[\"Error from API\",\"The VM could not reboot\",\"Error creating console devices\",\"Error creating console device\",\"Permission denied (os error 13)\"]"))) Error: ch-remote exited with the following chain of errors: 0: http client error 1: Server responded with InternalServerError 2: Error from API 3: The VM could not reboot 4: Error creating console devices 5: Error creating console device 6: Permission denied (os error 13) I've opened an upstream bug reported about this: https://github.com/cloud-hypervisor/cloud-hypervisor/issues/7547

1 0

[PATCH] release/live: fix Makefile dependency being missing in Nix shell
by Johannes Süllner 06 Dec '25

06 Dec '25

In commit a6d872ae, a Btrfs userdata partition was added to the live VM that can be startet with `make run`. The Makefile creates this partition and therefor requires `btrfs-progs`. --- release/live/shell.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/release/live/shell.nix b/release/live/shell.nix index e542793..a52c9b1 100644 --- a/release/live/shell.nix +++ b/release/live/shell.nix @@ -2,7 +2,7 @@ # SPDX-FileCopyrightText: 2021-2024 Alyssa Ross <hi(a)alyssa.is> import ../../lib/call-package.nix ( -{ callSpectrumPackage, config, stdenv, qemu_kvm }: +{ callSpectrumPackage, config, stdenv, btrfs-progs, qemu_kvm }: let efi = callSpectrumPackage ../../host/efi.nix {}; @@ -11,7 +11,7 @@ in (callSpectrumPackage ./. {}).overrideAttrs ( { nativeBuildInputs ? [], env ? {}, ... }: { - nativeBuildInputs = nativeBuildInputs ++ [ qemu_kvm ]; + nativeBuildInputs = nativeBuildInputs ++ [ btrfs-progs qemu_kvm ]; env = env // { OVMF_CODE = "${qemu_kvm}/share/qemu/edk2-${stdenv.hostPlatform.qemuArch}-code.fd"; -- 2.51.2

3 3

Test for portals passes even when file portal is broken
by Demi Marie Obenour 06 Dec '25

06 Dec '25

While trying to sandbox the file chooser portal, I broke it. This caused files not to be saved, resulting in silent data loss. Unfortunately, the integration test still passed. Is this a bug in the test? Is there a better alternative to manual testing? -- Sincerely, Demi Marie Obenour (she/her/hers)

3 10

[PATCH] host/rootfs: create groups assumed by udev
by Alyssa Ross 05 Dec '25

05 Dec '25

We don't really care about these groups, but if they don't exist, udev will also not apply the "other" modes from rules, leaving e.g. /dev/kvm root-only when it should be globally read/write. tty is set to 5, conforming with the systemd convention. Link: https://systemd.io/UIDS-GIDS/ Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Demi, this should avoid the need to add a udev rule for /dev/kvm. host/rootfs/image/etc/group | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group index 18acc30..e3ade46 100644 --- a/host/rootfs/image/etc/group +++ b/host/rootfs/image/etc/group @@ -1 +1,15 @@ root:x:0:root +clock:x:1: +dialout:x:2: +kmem:x:3: +input:x:4: +tty:x:5: +video:x:6: +render:x:7: +sgx:x:8: +audio:x:9: +lp:x:10: +disk:x:11: +cdrom:x:12: +tape:x:13: +kvm:x:14: base-commit: a13d3403c1ddbb8dbbbdb05416350b2846162ed1 -- 2.51.0

3 4

[PATCH] host/rootfs: Add scripts to access a VM by name
by Demi Marie Obenour 05 Dec '25

05 Dec '25

This is much more convenient than having to find a VM's ID. In the future, the programs that take a VM ID should be the suffixed ones, but this change avoids having to change any tests and so is simpler. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- host/rootfs/file-list.mk | 3 +++ host/rootfs/image/usr/bin/vm-console-by-name | 9 +++++++++ host/rootfs/image/usr/bin/vm-start-by-name | 9 +++++++++ host/rootfs/image/usr/bin/vm-stop-by-name | 9 +++++++++ 4 files changed, 30 insertions(+) diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index df22bce87f4685eda26382b4e0b0b6fd21025c7a..fd21034320a3de6f96a8eb229214b041612709e8 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -59,9 +59,12 @@ FILES = \ image/usr/bin/run-vmm \ image/usr/bin/spectrum-update \ image/usr/bin/vm-console \ + image/usr/bin/vm-console-by-name \ image/usr/bin/vm-import \ image/usr/bin/vm-start \ + image/usr/bin/vm-start-by-name \ image/usr/bin/vm-stop \ + image/usr/bin/vm-stop-by-name \ image/usr/bin/xdg-open \ image/usr/libexec/net-add \ image/usr/share/dbus-1/services/org.freedesktop.portal.Documents.service diff --git a/host/rootfs/image/usr/bin/vm-console-by-name b/host/rootfs/image/usr/bin/vm-console-by-name new file mode 100755 index 0000000000000000000000000000000000000000..a302b463ef1bd2c9ae180b6b2b9eae45a26856d6 --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-console-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-console $vm_id diff --git a/host/rootfs/image/usr/bin/vm-start-by-name b/host/rootfs/image/usr/bin/vm-start-by-name new file mode 100755 index 0000000000000000000000000000000000000000..438a4a4610ddc9dea3394503e8d5e635468fbddd --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-start-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-start $vm_id diff --git a/host/rootfs/image/usr/bin/vm-stop-by-name b/host/rootfs/image/usr/bin/vm-stop-by-name new file mode 100755 index 0000000000000000000000000000000000000000..07ca686b5ace86aceb0fdc0f9ace8ff3859f2b37 --- /dev/null +++ b/host/rootfs/image/usr/bin/vm-stop-by-name @@ -0,0 +1,9 @@ +#!/bin/execlineb -WS1 +# SPDX-License-Identifier: EUPL-1.2+ +# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour(a)gmail.com> +# SPDX-FileCopyrightText: 2022-2023, 2025 Alyssa Ross <hi(a)alyssa.is> +backtick -E vm_id { + backtick -E id_path { readlink /run/vm/by-name/${1} } + basename -- $id_path +} +vm-stop $vm_id --- base-commit: a13d3403c1ddbb8dbbbdb05416350b2846162ed1 change-id: 20251201-vm-ops-by-name-6a5cb600f726 -- Sincerely, Demi Marie Obenour (she/her/hers)

1 0