Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace

[Demi Marie Obenour <demiobenour@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 5602 bytes --]

On 7/10/26 10:39, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> s6-supervise can do so directly with less overhead.
>>
>> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
>> ---
>>  host/rootfs/file-list.mk                                           | 2 ++
>>  .../template/data/service/spectrum-router/flag-newpidns            | 0
>>  .../service/vm-services/template/data/service/spectrum-router/run  | 5 ++++-
>>  .../vm-services/template/data/service/vhost-user-gpu/flag-newpidns | 0
>>  .../service/vm-services/template/data/service/vhost-user-gpu/run   | 7 ++++---
>>  5 files changed, 10 insertions(+), 4 deletions(-)
> 
> I guess this isn't done for run-vmm because it might not be run through s6?

Exactly!

>> diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk
>> index 3899d620717fc97f42e669e5313c4100dcf5b1cd..951cb2e9f0af05839ef5e9c0b5384c13e56622ff 100644
>> --- a/host/rootfs/file-list.mk
>> +++ b/host/rootfs/file-list.mk
>> @@ -30,10 +30,12 @@ FILES = \
>>  	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \
>>  	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \
>>  	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \
>> +	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns \
>>  	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \
>>  	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \
>>  	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \
>>  	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \
>> +	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns \
>>  	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/notification-fd \
>>  	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run \
>>  	image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/notification-fd \
>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
>> index 3de58c27facc78c48176d8f9a6dd1827ac926f1a..ce84ed951de1a179d1430faae412fe4c1a2fb1f1 100755
>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
>> @@ -25,7 +25,10 @@ if {
>>  s6-setuidgid router
>>  
>>  bwrap
>> -  --unshare-all
>> +  --unshare-net
>> +  --unshare-ipc
>> +  --unshare-uts
>> +  --unshare-cgroup
>>    --unshare-user
>>    --dev-bind / /
>>    --setenv RUST_LOG spectrum-router=debug,info
>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755
>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland
>>  s6-ipcserverd -1c 1
>>  
>>  bwrap
>> -  --unshare-all
>> -  # --unshare-all only implies --unshare-user-try.
>> -  # Make this more than a "try".
>> +  --unshare-net
>> +  --unshare-ipc
>> +  --unshare-uts
>> +  --unshare-cgroup
>>    --unshare-user
>>    --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
>>    --ro-bind /usr /usr
> 
> There's a subtle behaviour change here.  The pid namespace is reused
> between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay
> running and wait for the next connection, then respawn crosvm.  It's
> done this way because crosvm has made the unusual decision to support
> being started on a connected socket, rather than a listening socket like
> one might expect.  Is that okay?  I'd guess yes, but I want to check
> with you!

It's less robust than I would like, but there is no reason one cannot
have both s6-supervise and bubblewrap create PID namespaces.  That's
the approach I would go with.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]