[PATCH v2 5/8] host/rootfs: create a per-VM user namespace

[Alyssa Ross <hi@alyssa.is>]

The document portal has to be root to mount its fuse filesystem.  This
needs to be a shared namespace because virtiofsd needs to be in the
same mount namespace as the document portal so that it sees the fuse
filesystem, so we create a per-VM persistent user namespace.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
v2: put nsfs bind mounts into a shared directory, to make unmounting nicer.
v1: https://spectrum-os.org/lists/archives/spectrum-devel/20251210124757.1080443-5-hi@alyssa.is/

 .../vm-services/template/data/service/dbus/run      |  2 +-
 .../template/data/service/vhost-user-fs/run         |  2 +-
 host/rootfs/image/usr/bin/create-vm-dependencies    | 13 +++++++++----
 host/rootfs/image/usr/bin/run-appimage              |  5 ++---
 host/rootfs/image/usr/bin/run-flatpak               |  5 ++---
 host/rootfs/image/usr/bin/spectrum-update           |  2 +-
 6 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
index 20f1daff..f4c78f71 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
@@ -15,7 +15,7 @@ fdmove -c 3 0
 redirfd -r 0 /dev/null
 
 getcwd -E dir
-nsenter --mount=/run/vm/by-id/${VM}/mount
+nsenter --mount=/run/vm/by-id/${VM}/ns/mnt
 
 unshare --cgroup --ipc --net --uts
 
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
index 79830a00..1936175e 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
@@ -12,7 +12,7 @@ export TMPDIR /run
 
 importas -i VM VM
 
-nsenter --mount=/run/vm/by-id/${VM}/mount
+nsenter --mount=/run/vm/by-id/${VM}/ns/mnt
 unshare -U --map-user 1000 --map-group 1000 --uts --ipc --cgroup
 
 virtiofsd --fd 3 --shared-dir /run/vm/by-id/${VM}/fs
diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies
index d4a10ab4..34dace4b 100755
--- a/host/rootfs/image/usr/bin/create-vm-dependencies
+++ b/host/rootfs/image/usr/bin/create-vm-dependencies
@@ -2,18 +2,23 @@
 # SPDX-License-Identifier: EUPL-1.2+
 # SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi@alyssa.is>
 
-if { touch /run/vm/by-id/${1}/mount }
-if { mount --make-private --bind /run/vm/by-id/${1}/mount /run/vm/by-id/${1}/mount }
-
 if {
   mkdir -p
     /run/vm/by-id/${1}/doc-run/doc
     /run/vm/by-id/${1}/fs/config
     /run/vm/by-id/${1}/fs/doc
+    /run/vm/by-id/${1}/ns
 }
 
+if { mount --make-private --rbind /run/vm/by-id/${1}/ns /run/vm/by-id/${1}/ns }
+if { touch /run/vm/by-id/${1}/ns/mnt /run/vm/by-id/${1}/ns/user }
+
 if {
-  unshare --propagation=slave --mount=/run/vm/by-id/${1}/mount
+  unshare --propagation=slave
+    --map-users all
+    --map-groups all
+    --mount=/run/vm/by-id/${1}/ns/mnt
+    --user=/run/vm/by-id/${1}/ns/user
 
   if { mount --make-shared --rbind /run/vm/by-id/${1} /run/vm/by-id/${1} }
 
diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage
index 47cab4c5..44a683c3 100755
--- a/host/rootfs/image/usr/bin/run-appimage
+++ b/host/rootfs/image/usr/bin/run-appimage
@@ -19,7 +19,7 @@ if { ln -s /run/configs/${id} ${dir}/config }
 if { create-vm-dependencies $id }
 
 if {
-  nsenter --mount=${dir}/mount
+  nsenter --mount=${dir}/ns/mnt
   cd ${dir}/fs/config
   if { redirfd -w 1 type echo appimage }
   if { touch run }
@@ -42,6 +42,5 @@ fdclose 3
 
 if { s6-instance-delete /run/service/vm-services $id }
 
-if { umount ${dir}/mount } # mount namespace
-if { umount ${dir}/mount } # private bind mount
+if { umount -R ${dir}/ns }
 rm -r $dir /run/configs/${id}
diff --git a/host/rootfs/image/usr/bin/run-flatpak b/host/rootfs/image/usr/bin/run-flatpak
index bb366735..07cfc262 100755
--- a/host/rootfs/image/usr/bin/run-flatpak
+++ b/host/rootfs/image/usr/bin/run-flatpak
@@ -22,7 +22,7 @@ if {
   if { create-vm-dependencies $id }
 
   if {
-    nsenter --mount=${dir}/mount
+    nsenter --mount=${dir}/ns/mnt
     cd ${dir}/fs/config
     if { redirfd -w 1 type echo flatpak }
     mount-flatpak $@
@@ -44,6 +44,5 @@ if {
 
 if { s6-instance-delete -- /run/service/vm-services $id }
 
-if { umount ${dir}/mount } # mount namespace
-if { umount ${dir}/mount } # private bind mount
+if { umount -R ${dir}/ns }
 rm -r $dir /run/configs/${id}
diff --git a/host/rootfs/image/usr/bin/spectrum-update b/host/rootfs/image/usr/bin/spectrum-update
index b1517a6c..be99c9da 100755
--- a/host/rootfs/image/usr/bin/spectrum-update
+++ b/host/rootfs/image/usr/bin/spectrum-update
@@ -50,7 +50,7 @@ foreground {
     cp -- /etc/systemd/import-pubring.gpg /run/vm/by-id/${update_vm_id}/fs/etc/systemd
   }
 
-  nsenter --mount=/run/vm/by-id/${update_vm_id}/mount
+  nsenter --mount=/run/vm/by-id/${update_vm_id}/ns/mnt
   cd $1
 
   # If the directory is already mounted, unmount it.  This prevents a
-- 
2.51.0