From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 58075A49C; Thu, 25 Jun 2026 20:21:15 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 98991A491; Thu, 25 Jun 2026 20:21:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-43172.protonmail.ch (mail-43172.protonmail.ch [185.70.43.172]) by atuin.qyliss.net (Postfix) with ESMTPS id AA422A459 for ; Thu, 25 Jun 2026 20:21:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=colbyt.com; s=protonmail; t=1782418870; x=1782678070; bh=eAWRAuOxfldX/Stpd7Gf175E8xRAj9Zgh8KE7ew6TFk=; h=From:To:Cc:Subject:Date:Message-ID:From:To:Cc:Date:Subject: Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=kjh4Qk16qdsjhUH5+ydPUlDZmrPO8F2UbP4afeSUmK6Sq9p//v5zxQIMakKceiJjF HbliAPHA9MQYfQSWUC5xTgSI/vk/q5uXsRIVlZem84KOoKY1mPuwQN2hNLgnXAzK6l mPtK9QA0jFkdOu5JaUJFcLN7bcFPXd6BDVZPdta9N/tjpik/gWZRUqdL9tp78SIGgJ tMN7vQO/uIs50hD0paImasbBiWNhWbHSwKswEi8HMTDcRsCzHXTQ4KwRoEZhivXq2B PYEabvsC8/XlYrNWiPGwn2p0WHG4MCGVGyqfC+oBEGR5u177aFDMnX6TS5BpQ7wdYX 3IC3fVePaW+Cw== X-Pm-Submission-Id: 4gmVYw1ySHz1DFGF From: colbyt To: devel@spectrum-os.org Subject: [PATCH 0/5] vm: boot sub-VMs from dm-verity roots and enable IPE Date: Thu, 25 Jun 2026 13:20:08 -0700 Message-ID: <20260625202013.1417254-1-colby@colbyt.com> X-Mailer: git-send-email 2.54.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: BELDQGNQ637KGUJIXN2TMDL3ETXEEQKQ X-Message-ID-Hash: BELDQGNQ637KGUJIXN2TMDL3ETXEEQKQ X-MailFrom: colby@colbyt.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: colbyt X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This series changes the app VM and net VM root images to boot through dm-verity, then enables IPE kernel support for the sub-VMs and the Spectrum host rootfs. Each sub-VM disk now has a verity metadata partition and an EROFS root partition. The build installs the root hash next to the disk image, and the VM boot paths pass that hash to a shared initramfs. The initramfs uses the hash to find both partitions, opens /dev/mapper/root-verity, and switches into it read-only. The last two patches only enable kernel support for IPE. They do not install an IPE policy. With the existing generated kernel config, enabling SECURITY_IPE also enables the dm-verity root-hash provider, so later policy work can match files from verified roots. This is based on current main and does not depend on the Cloud Hypervisor v52 series. If the v52 series lands first, the only expected overlap is the crosvm run target context in patch 3. Tested: - nix-build tools -A tests.tests -o /tmp/spectrum-ipe-standalone-tools-tests --no-build-output - nix-build vm/sys/net -o /tmp/spectrum-ipe-standalone-netvm --no-build-output - nix-build img/app -o /tmp/spectrum-ipe-standalone-appvm --no-build-output - built app VM, net VM, and host kernel configfiles and confirmed: CONFIG_SECURITY_IPE=y CONFIG_IPE_PROP_DM_VERITY=y CONFIG_DM_VERITY=m CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf" - booted the net VM root image with QEMU and confirmed: LSM: initializing lsm=capability,landlock,yama,ipe,bpf device-mapper: verity: sha256 using "sha256-lib" erofs (device dm-0): mounted s6-linux-init version 1.1.3.0 colbyt (5): vm: generate dm-verity metadata for sub-VM roots vm: add shared initramfs for verified roots vm: boot sub-VMs through verified roots vm: enable IPE in sub-VM kernels host/rootfs: enable IPE in the host kernel host/rootfs/default.nix | 6 +- img/app/Makefile | 41 ++++++-- img/app/default.nix | 14 ++- pkgs/default.nix | 1 + tools/start-vmm/ch.rs | 3 +- tools/start-vmm/lib.rs | 15 ++- tools/start-vmm/tests/vm_command-basic.rs | 18 +++- vm-lib/make-vm.nix | 2 + vm/initramfs/Makefile | 37 +++++++ vm/initramfs/default.nix | 113 ++++++++++++++++++++++ vm/initramfs/etc/fstab | 5 + vm/initramfs/etc/getuuids | 18 ++++ vm/initramfs/etc/init | 58 +++++++++++ vm/initramfs/etc/mdev.conf | 4 + vm/initramfs/etc/probe | 17 ++++ vm/sys/net/Makefile | 41 ++++++-- vm/sys/net/default.nix | 14 ++- 17 files changed, 380 insertions(+), 27 deletions(-) create mode 100644 vm/initramfs/Makefile create mode 100644 vm/initramfs/default.nix create mode 100644 vm/initramfs/etc/fstab create mode 100755 vm/initramfs/etc/getuuids create mode 100755 vm/initramfs/etc/init create mode 100644 vm/initramfs/etc/mdev.conf create mode 100755 vm/initramfs/etc/probe -- 2.54.0