[PATCH v3 2/3] host/rootfs: put router app sockets in own dir

[Alyssa Ross <hi@alyssa.is>]

When we have different Cloud Hypervisor instances running as different
users, it makes sense not to permit them to see into each other's
/run/vm directories.  That means we'll need somewhere else to store
router app sockets, which should be accessible by VMs other than the
driver VM associated with the router.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
v3: no change

 host/rootfs/Makefile                               |  1 +
 .../template/data/service/spectrum-router/run      |  2 +-
 tools/start-vmm/lib.rs                             | 14 ++++++++++++--
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index 7bec1259..831fdc10 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -14,6 +14,7 @@ DIRS = \
 	dev \
 	etc/s6-linux-init/env \
 	etc/s6-linux-init/run-image/configs \
+	etc/s6-linux-init/run-image/router \
 	etc/s6-linux-init/run-image/sd-notify-wrapper \
 	etc/s6-linux-init/run-image/service/serial-getty/instance \
 	etc/s6-linux-init/run-image/service/serial-getty/instances \
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
index dc1ef900..ec26b76f 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
@@ -8,7 +8,7 @@ importas -i VM VM
 s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-driver.sock
 fdmove -c 3 0
 
-s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-app.sock
+s6-ipcserver-socketbinder -a 0770 /run/router/${VM}
 fdmove -c 4 0
 
 # Notify readiness.
diff --git a/tools/start-vmm/lib.rs b/tools/start-vmm/lib.rs
index b44e0375..2ee87bd9 100644
--- a/tools/start-vmm/lib.rs
+++ b/tools/start-vmm/lib.rs
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: EUPL-1.2+
-// SPDX-FileCopyrightText: 2022-2024 Alyssa Ross <hi@alyssa.is>
+// SPDX-FileCopyrightText: 2022-2025 Alyssa Ross <hi@alyssa.is>
 // SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>
 
 mod ch;
@@ -117,6 +117,16 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> {
                         ));
                     }
 
+                    let provider_path = Path::new("/run/vm/by-name").join(&provider_name);
+                    let provider_target = provider_path
+                        .read_link()
+                        .map_err(|e| format!("dereferencing {provider_path:?}: {e}"))?;
+                    let provider_id = provider_target
+                        .file_name()
+                        .ok_or_else(|| format!("{provider_path:?} target has no file name"))?
+                        .to_str()
+                        .ok_or_else(|| format!("{provider_target:?} has non-UTF-8 basename"))?;
+
                     let mut hasher = std::hash::DefaultHasher::new();
                     vm_name.hash(&mut hasher);
                     let id_hashed = hasher.finish();
@@ -132,7 +142,7 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> {
 
                     Ok(NetConfig {
                         vhost_user: true,
-                        vhost_socket: format!("/run/vm/by-name/{provider_name}/router-app.sock"),
+                        vhost_socket: format!("/run/router/{provider_id}"),
                         id: provider_name,
                         mac,
                     })
-- 
2.51.0