[PATCH 3/3] host/rootfs: run router as non-root

Alyssa Ross
2025-12-09T00:38:46Z

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
host/rootfs/image/etc/group | 1 +
host/rootfs/image/etc/passwd | 1 +
.../vm-services/template/data/service/spectrum-router/run | 4 +++-
3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group
index e3ade46..299ea68 100644
--- a/host/rootfs/image/etc/group
+++ b/host/rootfs/image/etc/group
@@ -13,3 +13,4 @@ disk:x:11:
cdrom:x:12:
tape:x:13:
kvm:x:14:
+router:x:15:router
diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd
index 29f3b25..8c579ce 100644
--- a/host/rootfs/image/etc/passwd
+++ b/host/rootfs/image/etc/passwd
@@ -1 +1,2 @@
root:x:0:0:System administrator:/:/bin/sh
+router:x:15:15::/:/bin/nologin
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
index c79747c..f160816 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
@@ -11,13 +11,15 @@ fdmove -c 3 0
s6-ipcserver-socketbinder -a 0770 /run/router/${VM}
fdmove -c 4 0

+redirfd -r 0 /dev/null
+
# Notify readiness.
if {
fdmove -c 5 1
echo
}

-redirfd -r 0 /dev/null
+s6-setuidgid router

bwrap
--unshare-all
--
2.51.0