On 6/20/26 15:46, Alyssa Ross wrote:
> cloud-hypervisor was being run with its own /dev/pts, so vm-console
> couldn't find the VM PTY to open it.  Furthermore, for Cloud
> Hypervisor to actually use the global /dev/pts now that it runs as
> non-root, it needs to be able to open /dev/pts/ptmx.  ptmxmode=666
> matches how systemd mounts /dev/pts.
> 
> Fixes: 6138e44a ("host/rootfs: run Cloud Hypervisor as non-root")
> Fixes: ec47d362 ("host/rootfs: Sandbox Cloud Hypervisor")
> Signed-off-by: Alyssa Ross <hi@alyssa.is>
> ---
> Posting to the list in particular to give a chance to anybody who
> wants to tell me the sandboxing should be done a different way.
> 
>  host/rootfs/image/etc/fstab       | 2 +-
>  host/rootfs/image/usr/bin/run-vmm | 1 +
>  2 files changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab
> index 18bb5e45..4d52a1da 100644
> --- a/host/rootfs/image/etc/fstab
> +++ b/host/rootfs/image/etc/fstab
> @@ -1,7 +1,7 @@
>  # SPDX-License-Identifier: CC0-1.0
>  # SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
>  proc	/proc		proc	nosuid,nodev,noexec				0	0
> -devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620			0	0
> +devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620,ptmxmode=666	0	0
>  tmpfs	/dev/shm	tmpfs	nosuid,nodev					0	0
>  tmpfs	/media		tmpfs	nosuid,nodev,noexec,nosymfollow,mode=755	0	0
>  sysfs	/sys		sysfs	nosuid,nodev,noexec				0	0
> diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm
> index 94199434..6967dc55 100755
> --- a/host/rootfs/image/usr/bin/run-vmm
> +++ b/host/rootfs/image/usr/bin/run-vmm
> @@ -93,6 +93,7 @@ bwrap
>    --unshare-user
>    --dev /dev
>    --dev-bind /dev/kvm /dev/kvm
> +  --dev-bind /dev/pts /dev/pts
>    --dev-bind /dev/vfio /dev/vfio
>    --tmpfs /dev/shm
>    --tmpfs /tmp
> 
> base-commit: 57bf21eaf65ca5a42d18999ba65f96dcd338113c

My understanding is that the only reason to use an actual PTY is
to forward dimension changes. Do we really need this, given that
vm-console is only for debugging?  As long as the VM has xterm-resize
installed, it's possible to sync the dimensions manually.  I'd prefer
to lose dimension change forwarding instead of weakening the sandbox.

This is worse, but it's manageable.  I worked in a Qubes VM for quite
a while this way, as I was writing a replacement for the GUI daemon
and so the in-VM GUI was not available when the custom code was not
running (or not working).

A better (and, hopefully, straightforward) solution would be to
carry dimension information in-band using specific escape sequences.
This could either be supported natively in terminal emulators, or
could implemented by a simple proxy otherwise.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)