From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 5F4B074AF; Tue, 02 Dec 2025 03:47:57 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id D47947443; Tue, 02 Dec 2025 03:47:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yx1-xb12c.google.com (mail-yx1-xb12c.google.com [IPv6:2607:f8b0:4864:20::b12c]) by atuin.qyliss.net (Postfix) with ESMTPS id 5C627743E for ; Tue, 02 Dec 2025 03:47:49 +0000 (UTC) Received: by mail-yx1-xb12c.google.com with SMTP id 956f58d0204a3-63f9beb2730so3963467d50.0 for ; Mon, 01 Dec 2025 19:47:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764647267; x=1765252067; darn=spectrum-os.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=NA9XEouFaXHL8Ni8/9licVIhw/s8EnD//OOpZYIQmqA=; b=CwcwsUmHXfoDPy0zRDXgBUWHtcKtzcfuhFjfxFZ4QTXb3XaQZ1HfMUacwMLJP2Q31X gIIpdtQgGfZEPpmS0+GxrPsgdnFJRDuI/Z1vo/Lk3y1Nkkggh5xH3yarh+QVwYaNPq1p qg2CoKZHN+7zCnSvYNDoQvLZJRBd3qRyabvC99ie2rR/3SoH7LKU60izNfq8rWlLK09T 2MAcQzvHGF2fnTZcVxX1h11ZbHAeKzalgysnxqgWLjJ5i8JT+NN8cwMzYNUfpAS7R94w zVPrx30jXolBuxmL4uRs0qOgdnuOI3oGqVlOHMa/MZVuegZxRjYs3+APDaBO/ODSxGgz xAqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764647267; x=1765252067; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=NA9XEouFaXHL8Ni8/9licVIhw/s8EnD//OOpZYIQmqA=; b=vie38iUTqwCa8+49/de6bdZ8rl4Rm29HZ/XrsMBGHas8Hk7lb8z0sRTAgzI/hY1q7t ZR8vsTcjKyEJ+EG9KyczebMGkSv+4+aHbeEXZYFlav1MchfkGg3bZ0wxGuMNEXcqftDL u5oUp2QeTAEswtCfx5HYfYttxH/1kwTia+wJeXcbDpRFxyjkUtDmV6Hnk9g4V9y/c+lO esiTdvKMy3cMxD3ozlREAzrwngFHjjtD+vXEGa22W4F79ZsIiHcCuAjH/UaH2K2aP0Do tZtnbhpNVrTcipmO9kBkVii3Yb70aHBA8Kho/N3RD6u0H49enw8IRLXVcS4BZabod8PL ujPg== X-Gm-Message-State: AOJu0Ywru+1dNTLBM46yuP5ood2UEj3jowGURc8C9DSTCGZq3tW+ogzb IEB90BbErGKfbt41QlaOORvWXUYRUpqMxpiC4QfoIt8rlC+p6H/yNsgix3kdzQ== X-Gm-Gg: ASbGnctioECy+WikKYcxJZ2qBHGsm/dejyDrcyIJLVyj+JcwidHKhUQqrBzq7nVlysO bytYa6oebsB6775dbvBDYHC3+K1Pkrl7Smd62HIOTYK4/F2kCrub/COvumx3xYU+soQVbpxPPHx c98z/Ua2rQ8DlER4h5+jhXBz6Tfg0gxqIjlpviASQ95FjOKw6wjOOBkOFSf5VI/zhoKMgiQk5yk KmG7GWSg0zFPFquph2OS4GLl+kvwyLReGfWpFSCUB/hVW4xQ3f3AOJYqGd9AFyGpouTX2YFJBwl pJjyl26wkQCXIfmL9QypWVxjZyMvp5KUSjZI+DMsyubdyjqdxSbPe9klYy96FLRmwThVktqvxhC TvGY+qsp9hx2pLEtfhDC308mxnNcr4DQ0eHYZ+Q37nze29oinGvZJnsz7k+a5DBGXEYNuL/71eJ p8lTir+KiEHb0CqzhyRoppvV7W5EH26qBUH6Ss3FcuBQXDnL4QPa+GyUuI0wsKkxUFduiXMRqef AAv6rafsJUylwCehvXopnCdclAqS08BAqU= X-Google-Smtp-Source: AGHT+IEQOplZItzH11BcE8SM0ClYAlKjlUkBXrYB8SqfxnTURy2vWUF+DFhpj5AhREU5uBcE1i2lYg== X-Received: by 2002:a05:690c:7a1:b0:789:507d:6091 with SMTP id 00721157ae682-78ab6f1ab32mr222875927b3.44.1764647266790; Mon, 01 Dec 2025 19:47:46 -0800 (PST) Received: from localhost.localdomain (h96-60-249-169.cncrtn.broadband.dynamic.tds.net. [96.60.249.169]) by smtp.gmail.com with UTF8SMTPSA id 00721157ae682-78ad0d3f5d3sm59205567b3.6.2025.12.01.19.47.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Dec 2025 19:47:46 -0800 (PST) From: Demi Marie Obenour Date: Mon, 01 Dec 2025 22:46:40 -0500 Subject: [PATCH v2 3/4] host/rootfs: Sandbox virtiofsd MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20251201-sandbox-v2-3-9f4e58252c2b@gmail.com> References: <20251201-sandbox-v2-0-9f4e58252c2b@gmail.com> In-Reply-To: <20251201-sandbox-v2-0-9f4e58252c2b@gmail.com> To: Spectrum OS Development X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1764647197; l=1673; i=demiobenour@gmail.com; s=20250729; h=from:subject:message-id; bh=idKWjluLaq7JcKhSn4pplTlKklsRBtv8USlX1mPgJ+w=; b=AOLmkTKw1PE7GUlBgt63ALBmHqbyIuyJiAKpSNdvJ+/3/AQ6T8bN5PsAtMaOeW/xijG4lIYsM oe0cHnnbt3DDahXZCmUeXrRCDtfN+CiT3RGhGHqMkgXU0PBm5vKHPr+ X-Developer-Key: i=demiobenour@gmail.com; a=ed25519; pk=X57Q4/YQDj9t4SBeKaDwvXYKB6quZJVx/DE2Ly2out0= Message-ID-Hash: AGR64L6NZ5RLTIPYXDKN74VT6EGAIDMA X-Message-ID-Hash: AGR64L6NZ5RLTIPYXDKN74VT6EGAIDMA X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Demi Marie Obenour , Alyssa Ross X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: It needs no write access to anything outside of its shared directory, and no network or abstract socket access. Signed-off-by: Demi Marie Obenour --- .../template/data/service/vhost-user-fs/run | 28 +++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run index a9bbd8ea43a8c0a1a664f88b8593f794d07333cc..1a77385fd26726723b00b3e4feec26d08c992579 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run @@ -8,8 +8,30 @@ if { fdmove 1 3 echo } fdmove -c 3 0 redirfd -r 0 /dev/null -export TMPDIR /run - importas -i VM VM nsenter --mount=${VM}/mount -virtiofsd --fd 3 --shared-dir ${VM}/fs + +bwrap + --unshare-all + --unshare-user + --setenv TMPDIR /tmp + --dev /dev + --tmpfs /tmp + --tmpfs /dev/shm + --tmpfs /run + --ro-bind ${VM}/fs ${VM}/fs + --ro-bind /nix /nix + --ro-bind /usr /usr + --ro-bind /lib /lib + --ro-bind /etc /etc + --proc /proc + --remount-ro /proc + --ro-bind /dev/null /proc/timer_list + --tmpfs /proc/scsi + --remount-ro /proc/scsi + --ro-bind /dev/null /proc/kcore + --ro-bind /dev/null /proc/sysrq-trigger + --tmpfs /proc/acpi + --remount-ro /proc/acpi + -- + /usr/bin/virtiofsd --fd 3 --shared-dir ${VM}/fs -- 2.52.0