[PATCH v2 3/3] host/rootfs: run router as non-root

[Alyssa Ross <hi@alyssa.is>]

Signed-off-by: Alyssa Ross <hi@alyssa.is>
Message-ID: <20251209003813.553461-3-hi@alyssa.is>
---
v2: no change

 host/rootfs/image/etc/group                                   | 1 +
 host/rootfs/image/etc/passwd                                  | 1 +
 .../vm-services/template/data/service/spectrum-router/run     | 4 +++-
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/host/rootfs/image/etc/group b/host/rootfs/image/etc/group
index e3ade468..299ea68a 100644
--- a/host/rootfs/image/etc/group
+++ b/host/rootfs/image/etc/group
@@ -13,3 +13,4 @@ disk:x:11:
 cdrom:x:12:
 tape:x:13:
 kvm:x:14:
+router:x:15:router
diff --git a/host/rootfs/image/etc/passwd b/host/rootfs/image/etc/passwd
index 29f3b252..8c579ce8 100644
--- a/host/rootfs/image/etc/passwd
+++ b/host/rootfs/image/etc/passwd
@@ -1 +1,2 @@
 root:x:0:0:System administrator:/:/bin/sh
+router:x:15:15::/:/bin/nologin
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
index ec26b76f..2c6626e3 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
@@ -11,13 +11,15 @@ fdmove -c 3 0
 s6-ipcserver-socketbinder -a 0770 /run/router/${VM}
 fdmove -c 4 0
 
+redirfd -r 0 /dev/null
+
 # Notify readiness.
 if {
   fdmove -c 5 1
   echo
 }
 
-redirfd -r 0 /dev/null
+s6-setuidgid router
 
 bwrap
   --unshare-all
-- 
2.51.0