When we have different Cloud Hypervisor instances running as different users, it makes sense not to permit them to see into each other's /run/vm directories. That means we'll need somewhere else to store router app sockets, which should be accessible by VMs other than the driver VM associated with the router. Signed-off-by: Alyssa Ross <hi@alyssa.is> --- v3: no change host/rootfs/Makefile | 1 + .../template/data/service/spectrum-router/run | 2 +- tools/start-vmm/lib.rs | 14 ++++++++++++-- 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile index 7bec1259..831fdc10 100644 --- a/host/rootfs/Makefile +++ b/host/rootfs/Makefile @@ -14,6 +14,7 @@ DIRS = \ dev \ etc/s6-linux-init/env \ etc/s6-linux-init/run-image/configs \ + etc/s6-linux-init/run-image/router \ etc/s6-linux-init/run-image/sd-notify-wrapper \ etc/s6-linux-init/run-image/service/serial-getty/instance \ etc/s6-linux-init/run-image/service/serial-getty/instances \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index dc1ef900..ec26b76f 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -8,7 +8,7 @@ importas -i VM VM s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-driver.sock fdmove -c 3 0 -s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-app.sock +s6-ipcserver-socketbinder -a 0770 /run/router/${VM} fdmove -c 4 0 # Notify readiness. diff --git a/tools/start-vmm/lib.rs b/tools/start-vmm/lib.rs index b44e0375..2ee87bd9 100644 --- a/tools/start-vmm/lib.rs +++ b/tools/start-vmm/lib.rs @@ -1,5 +1,5 @@ // SPDX-License-Identifier: EUPL-1.2+ -// SPDX-FileCopyrightText: 2022-2024 Alyssa Ross <hi@alyssa.is> +// SPDX-FileCopyrightText: 2022-2025 Alyssa Ross <hi@alyssa.is> // SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev> mod ch; @@ -117,6 +117,16 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> { )); } + let provider_path = Path::new("/run/vm/by-name").join(&provider_name); + let provider_target = provider_path + .read_link() + .map_err(|e| format!("dereferencing {provider_path:?}: {e}"))?; + let provider_id = provider_target + .file_name() + .ok_or_else(|| format!("{provider_path:?} target has no file name"))? + .to_str() + .ok_or_else(|| format!("{provider_target:?} has non-UTF-8 basename"))?; + let mut hasher = std::hash::DefaultHasher::new(); vm_name.hash(&mut hasher); let id_hashed = hasher.finish(); @@ -132,7 +142,7 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> { Ok(NetConfig { vhost_user: true, - vhost_socket: format!("/run/vm/by-name/{provider_name}/router-app.sock"), + vhost_socket: format!("/run/router/{provider_id}"), id: provider_name, mac, }) -- 2.51.0