[PATCH 2/2] host/rootfs: run Cloud Hypervisor as non-root

[Alyssa Ross <hi@alyssa.is>]

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
 host/rootfs/Makefile                          |  1 +
 .../etc/s6-linux-init/run-image/etc/group     |  1 +
 .../template/data/service/spectrum-router/run |  3 ++
 .../template/data/service/vhost-user-fs/run   |  3 ++
 .../template/data/service/vhost-user-gpu/run  |  2 ++
 .../xdg-desktop-portal-spectrum-host/run      |  2 +-
 host/rootfs/image/usr/bin/assign-devices      | 29 +++++++++++++++++--
 host/rootfs/image/usr/bin/run-appimage        |  3 ++
 host/rootfs/image/usr/bin/run-flatpak         |  3 ++
 host/rootfs/image/usr/bin/run-vmm             |  4 +++
 host/rootfs/image/usr/bin/vm-import           |  3 ++
 11 files changed, 51 insertions(+), 3 deletions(-)

diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index 00036ccd..4ee145d5 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -35,6 +35,7 @@ DIRS = \
 	etc/s6-linux-init/run-image/user \
 	etc/s6-linux-init/run-image/vm/by-id \
 	etc/s6-linux-init/run-image/vm/by-name \
+	etc/s6-linux-init/run-image/vsock \
 	home \
 	media \
 	proc \
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/etc/group b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group
index 86243847..48c576da 100644
--- a/host/rootfs/image/etc/s6-linux-init/run-image/etc/group
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/etc/group
@@ -15,4 +15,5 @@ tape:x:13:
 kvm:x:14:
 wayland:x:15:wayland
 router:x:16:router
+vmm:x:17:
 fs:x:1000:
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
index 2c6626e3..73959602 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
@@ -13,6 +13,9 @@ fdmove -c 4 0
 
 redirfd -r 0 /dev/null
 
+if { chown -- vmm-${VM} /run/vm/by-id/${VM}/router-driver.sock }
+if { chgrp -- vmm /run/router/${VM} }
+
 # Notify readiness.
 if {
   fdmove -c 5 1
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
index aa2b8cc1..b6bbc2d6 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
@@ -4,6 +4,9 @@
 
 s6-ipcserver-socketbinder -a 0700 -B env/virtiofsd.sock
 
+importas -i VM VM
+if { chown vmm-${VM} env/virtiofsd.sock }
+
 if { fdmove 1 3 echo }
 fdmove -c 3 0
 redirfd -r 0 /dev/null
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
index 1341691b..b1f9bac0 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
@@ -10,6 +10,8 @@ multisubstitute {
   importas -Si WAYLAND_DISPLAY
 }
 
+if { chown vmm-${VM} env/crosvm.sock }
+
 s6-envuidgid gpu-${VM}
 s6-applyuidgid -UzG 15 # wayland
 s6-ipcserverd -1c 1
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run
index 42c29b3b..caa1ee7a 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/run
@@ -6,8 +6,8 @@ importas -i VM VM
 
 export DBUS_SESSION_BUS_ADDRESS unix:path=/run/portal-bus/${VM}
 
-if { mkdir -p /run/vsock/${VM} }
 s6-ipcserver-socketbinder -a 0700 /run/vsock/${VM}/vsock_219
+if { chown -- vmm-${VM}: /run/vsock/${VM}/vsock_219 }
 
 # Notify readiness.
 if { fdmove 1 3 echo }
diff --git a/host/rootfs/image/usr/bin/assign-devices b/host/rootfs/image/usr/bin/assign-devices
index 58dd3cc0..3dae3b35 100755
--- a/host/rootfs/image/usr/bin/assign-devices
+++ b/host/rootfs/image/usr/bin/assign-devices
@@ -2,12 +2,37 @@
 # SPDX-License-Identifier: EUPL-1.2+
 # SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
 
+backtick id {
+  backtick -E path { readlink -- /run/vm/by-name/sys.netvm }
+  basename -- $path
+}
+
 elglob -0 devices /sys/bus/pci/drivers/vfio-pci/????:??:??.?
-forx -pE device { $devices }
+forx -p device { $devices }
+
+if {
+  backtick iommu_group {
+    backtick -E iommu_group_path {
+      importas -Siu device
+      readlink -- ${device}/iommu_group
+    }
+    basename -- $iommu_group_path
+  }
+  multisubstitute {
+    importas -Siu id
+    importas -Siu iommu_group
+  }
+  chown -- vmm-${id} /dev/vfio/${iommu_group}
+}
+
+multisubstitute {
+  importas -Siu id
+  importas -Siu device
+}
 
 # This script is designed to be re-entrant and called multiple times.
 # This means we expect to sometimes get an error due to the device
 # already having been added.  If there's a different error,
 # cloud-hypervisor will probably log it itself anyway.
 redirfd -w 2 /dev/null
-ch-remote --api-socket /run/vm/by-name/sys.netvm/vmm add-device path=${device}
+ch-remote --api-socket /run/vm/by-id/${id}/vmm add-device path=${device}
diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage
index b9464f8b..a36d2c17 100755
--- a/host/rootfs/image/usr/bin/run-appimage
+++ b/host/rootfs/image/usr/bin/run-appimage
@@ -11,7 +11,10 @@ if {
   importas -Siu id
 
   if { useradd -P /run -Urd / -s /bin/nologin gpu-${id} }
+  if { useradd -P /run -Urd / -s /bin/nologin -G tty,vmm vmm-${id} }
   if { useradd -P /run -Urd / -s /bin/nologin xdp-spectrum-${id} }
+  if { mkdir /run/vsock/${id} }
+  if { chown vmm-${id} /run/vm/by-id/${id} /run/vsock/${id} }
 
   if { install -do fs /run/configs/${id}/fs }
 
diff --git a/host/rootfs/image/usr/bin/run-flatpak b/host/rootfs/image/usr/bin/run-flatpak
index 2d3e7ea0..be715538 100755
--- a/host/rootfs/image/usr/bin/run-flatpak
+++ b/host/rootfs/image/usr/bin/run-flatpak
@@ -11,7 +11,10 @@ if {
   importas -Siu id
 
   if { useradd -P /run -Urd / -s /bin/nologin gpu-${id} }
+  if { useradd -P /run -Urd / -s /bin/nologin -G tty,vmm vmm-${id} }
   if { useradd -P /run -Urd / -s /bin/nologin xdp-spectrum-${id} }
+  if { mkdir /run/vsock/${id} }
+  if { chown vmm-${id} /run/vm/by-id/${id} /run/vsock/${id} }
 
   if { install -do fs /run/configs/${id}/fs }
 
diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm
index 7c2b9af5..a07a1271 100755
--- a/host/rootfs/image/usr/bin/run-vmm
+++ b/host/rootfs/image/usr/bin/run-vmm
@@ -54,6 +54,9 @@ redirfd -r 0 /dev/null
 
 s6-softlimit -H -l 18446744073709551615
 if { udevadm wait /dev/kvm }
+
+s6-envuidgid vmm-${1}
+s6-applyuidgid -Uz
 bwrap
   --unshare-all
   --unshare-user
@@ -84,4 +87,5 @@ bwrap
   --ro-bind /dev/null /proc/kallsyms
   --ro-bind /dev/null /proc/sysrq-trigger
   --
+
 cloud-hypervisor --api-socket fd=3
diff --git a/host/rootfs/image/usr/bin/vm-import b/host/rootfs/image/usr/bin/vm-import
index 014eab87..22cfa376 100755
--- a/host/rootfs/image/usr/bin/vm-import
+++ b/host/rootfs/image/usr/bin/vm-import
@@ -12,7 +12,10 @@ backtick -E id {
   basename -- $dir
 }
 if { useradd -P /run -Urd / -s /bin/nologin gpu-${id} }
+if { useradd -P /run -Urd / -s /bin/nologin -G tty,vmm vmm-${id} }
 if { useradd -P /run -Urd / -s /bin/nologin xdp-spectrum-${id} }
+if { mkdir /run/vsock/${id} }
+if { chown vmm-${id} /run/vm/by-id/${id} /run/vsock/${id} }
 
 if { ln -s -- /run/vm/by-id/${id} /run/vm/by-name/${1}.${name} }
 if { ln -s -- ${2}/${name} /run/vm/by-id/${id}/config }
-- 
2.51.0