From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 71264255; Fri, 10 Jul 2026 13:34:21 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 5B3867BE; Thu, 09 Jul 2026 23:48:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Flag: YES X-Spam-Level: *** X-Spam-Status: Yes, score=3.9 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,UNWANTED_LANGUAGE_BODY autolearn=no autolearn_force=no version=4.0.1 X-Spam-Report: * 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record * -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily * valid * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's * domain * 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider * [demiobenour(at)gmail.com] * 4.0 UNWANTED_LANGUAGE_BODY BODY: Message written in an undesired * language * [Languages detected: ro] * -0.0 DMARC_PASS DMARC pass policy * -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no * trust * [2607:f8b0:4864:20:0:0:0:112d listed in] [list.dnswl.org] Received: from mail-yw1-x112d.google.com (mail-yw1-x112d.google.com [IPv6:2607:f8b0:4864:20::112d]) by atuin.qyliss.net (Postfix) with ESMTPS id 482F37BA for ; Thu, 09 Jul 2026 23:48:13 +0000 (UTC) Received: by mail-yw1-x112d.google.com with SMTP id 00721157ae682-80d33d13a23so4679127b3.1 for ; Thu, 09 Jul 2026 16:48:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783640892; x=1784245692; darn=spectrum-os.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=nhsmNvwzPTMhxF/7YuSbcxHruaPf3S7JAtVAIrImXW8=; b=WstXDvq7QxTYsiW5ltWhLez/XmD/gFkCAPhe8sCGXPGMeqTtAVRSUdPsJTM2767WBd EVf2FXhAEoPFxBK5TWu64o4/yj8yUsdyUbnJ94RxDrrjv6Qru19aVG8L8SnVA3g1gFtB SEeVt4+zev7Wud/DldMvFsN5tRvk/CRT1hX9Z7J/f78BYCCCJBN20Y172eZYtzKzkNJU 294EgwX/LeUWNhRI7/p4wgoYIZmJlkUrDjM9S+KLMDMsttvlkMTUpCNGqHqAwCOB9W0k cYf5FTenmghH/8IbGbh1bO13R0hoJbnzVd/ewBRlBsu7ng7L/N+9m4C4QMSPVnPW9b+R XZlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783640892; x=1784245692; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=nhsmNvwzPTMhxF/7YuSbcxHruaPf3S7JAtVAIrImXW8=; b=bF+xJlretmy4tbuCVvQLkbL48dkoSWJ2D8UB0X5d2HgYeQWhsj2GHdRO6NVngLoR56 HqYyILcKhFfG5GqqoW0Y1761ArB7D2Rh+eqpH8ccKg5p7xEj8bHVo3dGAxNhfX3/y3YH gXMsNoHWpPsHWtCZKRl4kM7WXHdYxZP3hootfg+8vgtQ1zP4SD7e5XWBRT4QLnRhRTKz D9PLzL5vUk1RmKrDC/sDAbNN5dbL8MKUxlIzDyAJrWICD8EZLEkttCQ629xozkTkHqKY Z7Azo1mqhkDhE6NDIFW0u5C/TmPndGTCwBu1khnFHTp4XikynlnD6tAJIrgoaGNtxZEe 6WHg== X-Gm-Message-State: AOJu0YzcN3cfcSL60dB3aKS57sbzjC8XzKuOalO6uYrdLX9uZe3cJFR1 aw2Tu+eDxzphgarLv+i5qgsw4HJRJJqe3n3L8/zmHq+/CxMl4wOHFj/NiWH/NA== X-Gm-Gg: AfdE7cmPJ+Awv+4hq8M4ik0RK1f/OOyeODQrJ5JeW3yebcwt3Jkyt8fT/dEIdqPmjPV 3bhKkl0PEE4sXhAQbY1Nau2bhR/At+9jm0iGnK5+tshlOGkGlTnWQ/M8LjwU75Kcy3gehkGeOGh TBdZbvD7/7hKTyTbo3Zafucn4tO1t8w8VueQ0IMNUCl3m6sn8Yl77ZWV2NdDeV0JNZmweY79CrR q1i71reeOkAck2G6Y2mY/89iaFZ1kI6/j8G3O4wQeuZAm8KyAdR+6xZrhjc3ivwKkXLMCAXMJJs inOmfSfRjWZZh+3jpPgaesqToNqnDdgAp24i/cnZA1rMv6QeWSep+Rdq3M7ywjOUEU9+eRrdKVV jQTlBcEF2ecWTUaosA28ZUpuS4/HExHM+ELZg+b6QGcoOzhMX8R4sKF3MNtmctDRPMYT0E7+nbM 0qvwc0xfkQVFeKJmKdoHFBQ2smJw== X-Received: by 2002:a05:690c:4d85:b0:81e:6a77:a5ea with SMTP id 00721157ae682-81e6a77a6demr45622257b3.39.1783640891712; Thu, 09 Jul 2026 16:48:11 -0700 (PDT) Received: from localhost.localdomain ([185.98.168.14]) by smtp.gmail.com with UTF8SMTPSA id 00721157ae682-81e6be904a4sm32149167b3.7.2026.07.09.16.48.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Jul 2026 16:48:10 -0700 (PDT) From: Demi Marie Obenour Date: Thu, 09 Jul 2026 19:46:57 -0400 Subject: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260709-s6-pid-namespaces-v1-1-61a56abd1e7c@gmail.com> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/yXMTQqDMBBA4avIrDsQYxmxVyld5GeqIzQNmVYE8 e7Gdvkt3ttAuQgr3JoNCi+i8k4V7aWBMLk0MkqsBmssmd4MqIRZIib3Ys0usOK182Qp0mCCh9r lwk9Zf8/742/9+pnD5xzBvh+HMLfCdQAAAA== X-Change-ID: 20260709-s6-pid-namespaces-43b626d690cb To: Spectrum OS Development X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1783640817; l=4695; i=demiobenour@gmail.com; s=20250729; h=from:subject:message-id; bh=H8L2Ml9zg9TPkxwAjCh/DIE+OA7TCbd6VFO/Eqf9Q7U=; b=E+LL4tHS8LDCIjG5e2NDw0ze2rmBvffraa4LnU+lXEOikZM+oZu3OkuJl7Dpy9+aoOU80xd2e WCRkM8WXio+BTgFxNAvRCUm3tbLGp0AdaC/dPXhHjUCwRIDTAhKjCEe X-Developer-Key: i=demiobenour@gmail.com; a=ed25519; pk=X57Q4/YQDj9t4SBeKaDwvXYKB6quZJVx/DE2Ly2out0= X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Hits: header-match-devel.spectrum-os.org-4 X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3 Message-ID-Hash: FUMCPEDJXWJIUOZB65MYIL6JFJ3HIMBH X-Message-ID-Hash: FUMCPEDJXWJIUOZB65MYIL6JFJ3HIMBH X-Mailman-Approved-At: Fri, 10 Jul 2026 13:34:19 +0000 CC: Alyssa Ross , Demi Marie Obenour X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: s6-supervise can do so directly with less overhead. Signed-off-by: Demi Marie Obenour --- host/rootfs/file-list.mk | 2 ++ .../template/data/service/spectrum-router/flag-newpidns | 0 .../service/vm-services/template/data/service/spectrum-router/run | 5 ++++- .../vm-services/template/data/service/vhost-user-gpu/flag-newpidns | 0 .../service/vm-services/template/data/service/vhost-user-gpu/run | 7 ++++--- 5 files changed, 10 insertions(+), 4 deletions(-) diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk index 3899d620717fc97f42e669e5313c4100dcf5b1cd..951cb2e9f0af05839ef5e9c0b5384c13e56622ff 100644 --- a/host/rootfs/file-list.mk +++ b/host/rootfs/file-list.mk @@ -30,10 +30,12 @@ FILES = \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \ + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \ + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/notification-fd \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run \ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/notification-fd \ diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run index 3de58c27facc78c48176d8f9a6dd1827ac926f1a..ce84ed951de1a179d1430faae412fe4c1a2fb1f1 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run @@ -25,7 +25,10 @@ if { s6-setuidgid router bwrap - --unshare-all + --unshare-net + --unshare-ipc + --unshare-uts + --unshare-cgroup --unshare-user --dev-bind / / --setenv RUST_LOG spectrum-router=debug,info diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755 --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland s6-ipcserverd -1c 1 bwrap - --unshare-all - # --unshare-all only implies --unshare-user-try. - # Make this more than a "try". + --unshare-net + --unshare-ipc + --unshare-uts + --unshare-cgroup --unshare-user --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY --ro-bind /usr /usr --- base-commit: 89f8c9238616b43e48b21e2eade41e061b006cd8 change-id: 20260709-s6-pid-namespaces-43b626d690cb -- Sincerely, Demi Marie Obenour (she/her/hers)