On 7/10/26 10:39, Alyssa Ross wrote: > Demi Marie Obenour writes: > >> s6-supervise can do so directly with less overhead. >> >> Signed-off-by: Demi Marie Obenour >> --- >> host/rootfs/file-list.mk | 2 ++ >> .../template/data/service/spectrum-router/flag-newpidns | 0 >> .../service/vm-services/template/data/service/spectrum-router/run | 5 ++++- >> .../vm-services/template/data/service/vhost-user-gpu/flag-newpidns | 0 >> .../service/vm-services/template/data/service/vhost-user-gpu/run | 7 ++++--- >> 5 files changed, 10 insertions(+), 4 deletions(-) > > I guess this isn't done for run-vmm because it might not be run through s6? Exactly! >> diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk >> index 3899d620717fc97f42e669e5313c4100dcf5b1cd..951cb2e9f0af05839ef5e9c0b5384c13e56622ff 100644 >> --- a/host/rootfs/file-list.mk >> +++ b/host/rootfs/file-list.mk >> @@ -30,10 +30,12 @@ FILES = \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \ >> + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \ >> + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/notification-fd \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/notification-fd \ >> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns >> new file mode 100644 >> index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 >> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run >> index 3de58c27facc78c48176d8f9a6dd1827ac926f1a..ce84ed951de1a179d1430faae412fe4c1a2fb1f1 100755 >> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run >> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run >> @@ -25,7 +25,10 @@ if { >> s6-setuidgid router >> >> bwrap >> - --unshare-all >> + --unshare-net >> + --unshare-ipc >> + --unshare-uts >> + --unshare-cgroup >> --unshare-user >> --dev-bind / / >> --setenv RUST_LOG spectrum-router=debug,info >> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns >> new file mode 100644 >> index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 >> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run >> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755 >> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run >> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run >> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland >> s6-ipcserverd -1c 1 >> >> bwrap >> - --unshare-all >> - # --unshare-all only implies --unshare-user-try. >> - # Make this more than a "try". >> + --unshare-net >> + --unshare-ipc >> + --unshare-uts >> + --unshare-cgroup >> --unshare-user >> --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY >> --ro-bind /usr /usr > > There's a subtle behaviour change here. The pid namespace is reused > between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay > running and wait for the next connection, then respawn crosvm. It's > done this way because crosvm has made the unusual decision to support > being started on a connected socket, rather than a listening socket like > one might expect. Is that okay? I'd guess yes, but I want to check > with you! It's less robust than I would like, but there is no reason one cannot have both s6-supervise and bubblewrap create PID namespaces. That's the approach I would go with. -- Sincerely, Demi Marie Obenour (she/her/hers)