[PATCH 7/8] host/rootfs: move fs directory out of VM directory

[Alyssa Ross <hi@alyssa.is>]

This will enable running virtiofsd as a user that does not have access
to VM directories.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
 .../template/data/service/vhost-user-fs/run        |  2 +-
 host/rootfs/image/usr/bin/create-vm-dependencies   | 12 +++++-------
 host/rootfs/image/usr/bin/run-appimage             |  2 +-
 host/rootfs/image/usr/bin/run-flatpak              |  2 +-
 host/rootfs/image/usr/bin/spectrum-update          | 14 +++++++-------
 5 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
index 79830a00..116570c3 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
@@ -15,4 +15,4 @@ importas -i VM VM
 nsenter --mount=/run/vm/by-id/${VM}/mount
 unshare -U --map-user 1000 --map-group 1000 --uts --ipc --cgroup
 
-virtiofsd --fd 3 --shared-dir /run/vm/by-id/${VM}/fs
+virtiofsd --fd 3 --shared-dir /run/fs/${VM}
diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies
index 98f10489..344e7778 100755
--- a/host/rootfs/image/usr/bin/create-vm-dependencies
+++ b/host/rootfs/image/usr/bin/create-vm-dependencies
@@ -9,8 +9,8 @@ if { mount --make-private --bind /run/vm/by-id/${1}/user /run/vm/by-id/${1}/user
 if {
   mkdir -p
     /run/doc/${1}/doc
-    /run/vm/by-id/${1}/fs/config
-    /run/vm/by-id/${1}/fs/doc
+    /run/fs/${1}/config
+    /run/fs/${1}/doc
 }
 
 if {
@@ -20,16 +20,14 @@ if {
     --mount=/run/vm/by-id/${1}/mount
     --user=/run/vm/by-id/${1}/user
 
-  if { mount --make-shared --rbind /run/vm/by-id/${1} /run/vm/by-id/${1} }
-
   # The VM should not be able to write directly into a tmpfs, and the host
   # should be able to assume there are no untrusted symlinks there, but there
   # can be writable block-based bind mounted subdirectories.
-  if { mount --rbind -o nofail /run/vm/by-id/${1}/config/fs /run/vm/by-id/${1}/fs/config }
-  if { mount --rbind -o ro /run/vm/by-id/${1}/fs /run/vm/by-id/${1}/fs }
+  if { mount --make-shared --rbind -o nofail /run/vm/by-id/${1}/config/fs /run/fs/${1}/config }
+  if { mount --rbind -o ro /run/fs/${1} /run/fs/${1} }
 
   if { mount --make-shared --rbind /run/doc/${1} /run/doc/${1} }
-  mount --rbind /run/doc/${1}/doc /run/vm/by-id/${1}/fs/doc
+  mount --rbind /run/doc/${1}/doc /run/fs/${1}/doc
 }
 
 if { s6-instance-create /run/service/vm-services $1 }
diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage
index 5e8e29fa..f0fe8311 100755
--- a/host/rootfs/image/usr/bin/run-appimage
+++ b/host/rootfs/image/usr/bin/run-appimage
@@ -20,7 +20,7 @@ if { create-vm-dependencies $id }
 
 if {
   nsenter --mount=${dir}/mount
-  cd ${dir}/fs/config
+  cd /run/fs/${id}/config
   if { redirfd -w 1 type echo appimage }
   if { touch run }
   mount --bind $1 run
diff --git a/host/rootfs/image/usr/bin/run-flatpak b/host/rootfs/image/usr/bin/run-flatpak
index 86ccc12a..f9179819 100755
--- a/host/rootfs/image/usr/bin/run-flatpak
+++ b/host/rootfs/image/usr/bin/run-flatpak
@@ -23,7 +23,7 @@ if {
 
   if {
     nsenter --mount=${dir}/mount
-    cd ${dir}/fs/config
+    cd /run/fs/${id}/config
     if { redirfd -w 1 type echo flatpak }
     mount-flatpak $@
   }
diff --git a/host/rootfs/image/usr/bin/spectrum-update b/host/rootfs/image/usr/bin/spectrum-update
index b1517a6c..10a9f197 100755
--- a/host/rootfs/image/usr/bin/spectrum-update
+++ b/host/rootfs/image/usr/bin/spectrum-update
@@ -43,11 +43,11 @@ foreground {
   # mounts instead of rm -rf.  Once this code is in a separate mount
   # namespace, the copies should be replaced by bind mounts.
   if {
-    if { rm -rf -- /run/vm/by-id/${update_vm_id}/fs/etc }
+    if { rm -rf -- /run/fs/${update_vm_id}/etc }
     umask 022
-    if { mkdir -p -- /run/vm/by-id/${update_vm_id}/fs/updates /run/vm/by-id/${update_vm_id}/fs/etc/systemd }
-    if { cp -R -- /etc/vm-sysupdate.d /etc/update-url /run/vm/by-id/${update_vm_id}/fs/etc }
-    cp -- /etc/systemd/import-pubring.gpg /run/vm/by-id/${update_vm_id}/fs/etc/systemd
+    if { mkdir -p -- /run/fs/${update_vm_id}/updates /run/fs/${update_vm_id}/etc/systemd }
+    if { cp -R -- /etc/vm-sysupdate.d /etc/update-url /run/fs/${update_vm_id}/etc }
+    cp -- /etc/systemd/import-pubring.gpg /run/fs/${update_vm_id}/etc/systemd
   }
 
   nsenter --mount=/run/vm/by-id/${update_vm_id}/mount
@@ -55,10 +55,10 @@ foreground {
 
   # If the directory is already mounted, unmount it.  This prevents a
   # confusing error from mount.
-  foreground { redirfd -w 2 /dev/null umount -- /run/vm/by-id/${update_vm_id}/fs/updates }
+  foreground { redirfd -w 2 /dev/null umount -- /run/fs/${update_vm_id}/updates }
 
   # Share the update directory with the VM.
-  if { mount --bind -- shared /run/vm/by-id/${update_vm_id}/fs/updates }
+  if { mount --bind -- shared /run/fs/${update_vm_id}/updates }
 
   # Start the update VM.
   if { vm-start $update_vm_id }
@@ -69,7 +69,7 @@ foreground {
   if { s6-svwait -D /run/service/vmm/instance/${update_vm_id} }
 
   # Remove the bind mount.
-  if { umount -- /run/vm/by-id/${update_vm_id}/fs/updates }
+  if { umount -- /run/fs/${update_vm_id}/updates }
 
   # Ensure that the VM cannot change the directory
   # while systemd-sysupdate is using it.
-- 
2.51.0