[PATCH v2 4/4] host/rootfs: Sandbox Cloud Hypervisor

[Demi Marie Obenour <demiobenour@gmail.com>]

It only needs access to a small number of resources.  Unfortunately, it
needs access to /dev/vfio right now.  This should be fixed by using file
descriptor passing instead.

Furthermore, Cloud Hypervisor needs to be able to lock memory.  Running
in a user namespace prevents it from having CAP_IPC_LOCK.  Therefore, it
is necessary to increase RLIMIT_MLOCK before running Cloud Hypervisor.
The s6-softlimit program can only increase the soft limit, not the hard
one.  Therefore, use Busybox sh to increase the hard limit.  Given that
sh must be used anyway, take the opportunity to use shell conditionals
and redirection instead of a few external commands.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
 .../image/etc/udev/rules.d/99-spectrum.rules       |  3 ++
 host/rootfs/image/usr/bin/run-vmm                  | 33 +++++++++++++++++++---
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
index 337bbe47dbbc6f3828722d8244f2689a39f3090f..de0f682aa40f8481dc3c25a90c695e2326536316 100644
--- a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
+++ b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules
@@ -3,3 +3,6 @@
 
 # systemd-udevd unsets PATH, so fix that.
 ACTION!="remove", ENV{PCI_CLASS}=="2????", RUN+="/usr/bin/env PATH=/usr/bin /usr/libexec/net-add"
+
+# make /dev/kvm world-accessible
+KERNEL=="kvm", MODE="0666"
diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm
index ba8b59c2677408acdd01c2eda3cf2dd60992d881..5fb0678b5ca7b6bcf49bf362a9355113892e4030 100755
--- a/host/rootfs/image/usr/bin/run-vmm
+++ b/host/rootfs/image/usr/bin/run-vmm
@@ -49,8 +49,33 @@ background -d {
   ch-remote --api-socket /run/vm/by-id/${router_id}/vmm add-net id=router,vhost_user=on,socket=/run/vm/by-id/${router_id}/router-driver.sock,mac=02:01:00:00:00:01
 }
 unexport !
-fdmove -c 3 0
-redirfd -r 0 /dev/null
+# I am not aware of an execlineb command to increase the hard limit, so do it in sh.
+# Given that sh is in use, do a few things with it that would need external commands otherwise.
+sh -c "exec 3>&0 >/dev/null && ulimit -l unlimited && udevadm wait /dev/kvm && exec \"$""@\"" sh
 
-if { udevadm wait /dev/kvm }
-cloud-hypervisor --api-socket fd=3
+bwrap
+  --unshare-all
+  --unshare-user
+  --dev /dev
+  --dev-bind /dev/kvm /dev/kvm
+  --dev-bind /dev/vfio /dev/vfio
+  --tmpfs /dev/shm
+  --tmpfs /tmp
+  --tmpfs /var/tmp
+  --ro-bind /etc /etc
+  --ro-bind /lib /lib
+  --ro-bind /nix /nix
+  --ro-bind /usr /usr
+  --bind /sys /sys
+  --bind /run /run
+  --proc /proc
+  --remount-ro /proc
+  --ro-bind /dev/null /proc/timer_list
+  --tmpfs /proc/scsi
+  --remount-ro /proc/scsi
+  --ro-bind /dev/null /proc/kcore
+  --ro-bind /dev/null /proc/sysrq-trigger
+  --tmpfs /proc/acpi
+  --remount-ro /proc/acpi
+  --
+  cloud-hypervisor --api-socket fd=3

-- 
2.52.0