[PATCH v2 3/6] host/rootfs: create a per-VM mount namespace

[Alyssa Ross <hi@alyssa.is>]

This will solve the problem of mounts for VMs being very annoying to
clean up, as evidenced in run-appimage.  It was looking to be even
worse for Flatpak.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
v2: Fix spectrum-update by unsharing with slave propagation instead of
    private and entering the namespace before setting up mounts.
v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251201044534.977524-3-hi@alyssa.is/

 .../template/data/service/dbus/run            |  2 ++
 .../template/data/service/vhost-user-fs/run   |  6 +----
 .../image/usr/bin/create-vm-dependencies      | 26 ++++++++++++++++---
 host/rootfs/image/usr/bin/run-appimage        | 25 +++++++++---------
 host/rootfs/image/usr/bin/spectrum-update     |  3 +++
 5 files changed, 40 insertions(+), 22 deletions(-)

diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
index 351fc68..9b23192 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
@@ -4,6 +4,8 @@
 
 importas -i VM VM
 
+nsenter --mount=${VM}/mount
+
 dbus-daemon
   --config-file /usr/share/dbus-1/session.conf
   --print-address 3
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
index 5d5ad7d..a9bbd8e 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
@@ -10,10 +10,6 @@ redirfd -r 0 /dev/null
 
 export TMPDIR /run
 
-# The VM should not be able to write directly into a tmpfs, but there
-# can be writable block-based bind mounted subdirectories.
-unshare -m --propagation slave
 importas -i VM VM
-if { mount --rbind -o ro ${VM}/fs ${VM}/fs }
-
+nsenter --mount=${VM}/mount
 virtiofsd --fd 3 --shared-dir ${VM}/fs
diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies
index f3a1b69..8fb9f3a 100755
--- a/host/rootfs/image/usr/bin/create-vm-dependencies
+++ b/host/rootfs/image/usr/bin/create-vm-dependencies
@@ -1,11 +1,29 @@
 #!/bin/execlineb -S1
 # SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2024 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi@alyssa.is>
 
-if { mount -m --rbind -o nofail /run/vm/by-id/${1}/config/fs /run/vm/by-id/${1}/fs/config }
+if { touch /run/vm/by-id/${1}/mount }
+if { mount --make-private --bind /run/vm/by-id/${1}/mount /run/vm/by-id/${1}/mount }
 
-if { mkdir -p /run/vm/by-id/${1}/doc-run/doc /run/vm/by-id/${1}/fs/doc }
-if { mount --rbind /run/vm/by-id/${1}/doc-run/doc /run/vm/by-id/${1}/fs/doc }
+if {
+  unshare --propagation=slave --mount=/run/vm/by-id/${1}/mount
+
+  if {
+    mkdir -p
+      /run/vm/by-id/${1}/doc-run/doc
+      /run/vm/by-id/${1}/fs/config
+      /run/vm/by-id/${1}/fs/doc
+  }
+
+  if { mount --make-shared --rbind /run/vm/by-id/${1} /run/vm/by-id/${1} }
+
+  # The VM should not be able to write directly into a tmpfs, and the host
+  # should be able to assume there are no untrusted symlinks there, but there
+  # can be writable block-based bind mounted subdirectories.
+  if { mount --rbind -o nofail /run/vm/by-id/${1}/config/fs /run/vm/by-id/${1}/fs/config }
+  if { mount --rbind -o ro /run/vm/by-id/${1}/fs /run/vm/by-id/${1}/fs }
+  mount --rbind /run/vm/by-id/${1}/doc-run/doc /run/vm/by-id/${1}/fs/doc
+}
 
 if { s6-instance-create /run/service/vm-services $1 }
 elglob -0 services /run/service/vm-services/instance/${1}/services/*
diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage
index 6ccc61f..f2fe7bc 100755
--- a/host/rootfs/image/usr/bin/run-appimage
+++ b/host/rootfs/image/usr/bin/run-appimage
@@ -1,14 +1,12 @@
 #!/bin/execlineb -S1
 # SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2024 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi@alyssa.is>
 
 backtick -E dir { mktemp -d /run/vm/by-id/XXXXXX }
 backtick -E id { basename -- $dir }
 
 if { mkdir -p /run/configs/${id}/fs }
-if { redirfd -w 1 /run/configs/${id}/fs/type echo appimage }
-if { touch /run/configs/${id}/fs/run }
-if { mount --rbind $1 /run/configs/${id}/fs/run }
+
 if {
   ln -s /usr/lib/spectrum/img/appvm/blk /usr/lib/spectrum/img/appvm/vmlinux
     /run/configs/${id}
@@ -18,6 +16,14 @@ if { ln -s /run/configs/${id} ${dir}/config }
 
 if { create-vm-dependencies $id }
 
+if {
+  nsenter --mount=${dir}/mount
+  cd ${dir}/fs/config
+  if { redirfd -w 1 type echo appimage }
+  if { touch run }
+  mount --bind $1 run
+}
+
 piperw 4 3
 background {
   fdclose 3
@@ -34,13 +40,6 @@ fdclose 3
 
 if { s6-instance-delete /run/service/vm-services $id }
 
-if {
-  forx -E mount {
-    /run/configs/${id}/fs/run
-    ${dir}/fs/config
-    ${dir}/fs/doc
-  }
-  umount $mount
-}
-
+if { umount ${dir}/mount } # mount namespace
+if { umount ${dir}/mount } # private bind mount
 rm -r $dir /run/configs/${id}
diff --git a/host/rootfs/image/usr/bin/spectrum-update b/host/rootfs/image/usr/bin/spectrum-update
index bf5b0b0..b1517a6 100755
--- a/host/rootfs/image/usr/bin/spectrum-update
+++ b/host/rootfs/image/usr/bin/spectrum-update
@@ -50,6 +50,9 @@ foreground {
     cp -- /etc/systemd/import-pubring.gpg /run/vm/by-id/${update_vm_id}/fs/etc/systemd
   }
 
+  nsenter --mount=/run/vm/by-id/${update_vm_id}/mount
+  cd $1
+
   # If the directory is already mounted, unmount it.  This prevents a
   # confusing error from mount.
   foreground { redirfd -w 2 /dev/null umount -- /run/vm/by-id/${update_vm_id}/fs/updates }
-- 
2.51.0