Re: [PATCH v3 2/5] host/rootfs: Sandbox router

Alyssa Ross
2025-12-03T16:11:44Z

[-- Attachment #1: Type: text/plain, Size: 1781 bytes --]

Yureka <yuka@yuka.dev> writes:

> On 12/3/25 16:54, Demi Marie Obenour wrote:
>> This needs very little access to the system.
>>
>> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
>> ---
>> .../template/data/service/spectrum-router/run | 19 ++++++++++++++++---
>> 1 file changed, 16 insertions(+), 3 deletions(-)
>>
>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
>> index 7b3e3db3b109ba1c8d195c7c47d50d0cfbc30bd5..ef68cd638c092b53cc714a5d65bbfa3b49585346 100755
>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
>> @@ -4,6 +4,19 @@
>>
>> importas -i VM VM
>>
>> -export RUST_LOG spectrum-router=debug,info
>> -spectrum-router --app-listen-path ${VM}/router-app.sock --driver-listen-path ${VM}/router-driver.sock
>> -
>> +bwrap
>> + --unshare-all
>> + --unshare-user
>> + --dev-bind / /
>> + --setenv RUST_LOG spectrum-router=debug,info
>> + --tmpfs /tmp
>> + --dev /dev
>> + --tmpfs /dev/shm
>> + --ro-bind /nix /nix
>> + --ro-bind /etc /etc
>> + --tmpfs /run
> This won't work. The router sets up unix sockets in /run which are
> accessed by the vmm.
>> + --ro-bind /usr /usr
>> + --ro-bind /lib /lib
>> + --bind $VM $VM

Doesn't this line cover the sockets, or are there more outside of this
directory?

>> + --
>> + spectrum-router --app-listen-path ${VM}/router-app.sock --driver-listen-path ${VM}/router-driver.sock

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]