[PATCH v3 1/5] host/rootfs: Sandbox crosvm

Demi Marie Obenour
2025-12-03T15:55:54Z

This means that a breach of crosvm is not guaranteed to be fatal.

The Wayland socket is still only accessible by root, so crosvm must run
as root. The known container escape via /proc/self/exe is blocked by
bwrap being on a read-only filesystem. Container escapes via /proc are
blocked by remounting /proc read-only. Crosvm does not have
CAP_SYS_ADMIN so it cannot change mounts.

The two remaining steps are:

- Run crosvm as an unprivileged user.
- Enable seccomp to block most system calls.

The latter should be done from within crosvm itself.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
host/rootfs/default.nix | 4 +--
.../template/data/service/vhost-user-gpu/run | 29 ++++++++++++++++++++++
2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
index ca2084f26d58be5e0e1695634e125032c50f82b2..4716bb7298515b2940cad09bb55e42c196ce7ebc 100644
--- a/host/rootfs/default.nix
+++ b/host/rootfs/default.nix
@@ -10,7 +10,7 @@ pkgsMusl.callPackage (

{ spectrum-host-tools, spectrum-router
, lib, stdenvNoCC, nixos, runCommand, writeClosure, erofs-utils, s6-rc
-, btrfs-progs, busybox, cloud-hypervisor, cosmic-files, crosvm
+, btrfs-progs, bubblewrap, busybox, cloud-hypervisor, cosmic-files, crosvm
, cryptsetup, dejavu_fonts, dbus, execline, foot, fuse3, iproute2
, inotify-tools, jq, kmod, mdevd, mesa, mount-flatpak, s6
, s6-linux-init, socat, systemd, util-linuxMinimal, virtiofsd
@@ -25,7 +25,7 @@ let
trivial;

packages = [
- btrfs-progs cloud-hypervisor cosmic-files crosvm cryptsetup dbus
+ btrfs-progs bubblewrap cloud-hypervisor cosmic-files crosvm cryptsetup dbus
execline fuse3 inotify-tools iproute2 jq kmod mdevd mount-flatpak s6
s6-linux-init s6-rc socat spectrum-host-tools spectrum-router
util-linuxMinimal virtiofsd xdg-desktop-portal-spectrum-host
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
index 0b4f6a00bc7aed0e721454d584d3bcd47fb18e2a..19d5a61388e6f49c7f722814d6de47227b02da01 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
@@ -1,9 +1,38 @@
#!/bin/execlineb -P
# SPDX-License-Identifier: EUPL-1.2+
# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>

s6-ipcserver -1a 0700 -C 1 -b 1 env/crosvm.sock

+bwrap
+ --unshare-all
+ # --unshare-all only implies --unshare-user-try.
+ # Make this more than a "try".
+ --unshare-user
+ --bind /run/user/0/wayland-1 /run/user/0/wayland-1
+ --ro-bind /usr /usr
+ --ro-bind /lib /lib
+ --tmpfs /tmp
+ --dev /dev
+ --tmpfs /dev/shm
+ --ro-bind /nix /nix
+ --disable-userns
+ --proc /proc
+ --ro-bind /proc/sys /proc/sys
+ --tmpfs /proc/scsi
+ --remount-ro /proc/scsi
+ --tmpfs /proc/acpi
+ --remount-ro /proc/acpi
+ --tmpfs /proc/fs
+ --remount-ro /proc/fs
+ --tmpfs /proc/irq
+ --remount-ro /proc/irq
+ --ro-bind /dev/null /proc/timer_list
+ --ro-bind /dev/null /proc/kcore
+ --ro-bind /dev/null /proc/kallsyms
+ --ro-bind /dev/null /proc/sysrq-trigger
+ --
crosvm --no-syslog device gpu
--fd 0
--wayland-sock /run/user/0/wayland-1

--
2.52.0