From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 4F6B19A6; Fri, 10 Jul 2026 17:09:39 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id CE289A0B; Fri, 10 Jul 2026 17:09:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yw1-x112c.google.com (mail-yw1-x112c.google.com [IPv6:2607:f8b0:4864:20::112c]) by atuin.qyliss.net (Postfix) with ESMTPS id 8D2F7A09 for ; Fri, 10 Jul 2026 17:09:34 +0000 (UTC) Received: by mail-yw1-x112c.google.com with SMTP id 00721157ae682-80e24970f1dso8976127b3.0 for ; Fri, 10 Jul 2026 10:09:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783703372; x=1784308172; darn=spectrum-os.org; h=content-type:in-reply-to:autocrypt:from:content-language:references :cc:to:subject:user-agent:mime-version:date:message-id:from:to:cc :subject:date:message-id:reply-to:content-type; bh=3SC9F/Gky61Cad/V7BiLEMEIfQF+9xz3FR1ak4qsc8E=; b=X4Bly8d90SOBnQgvyG9kHB9TO8N//A+i/5qwuJy0D3E0xudFqAU84RcZAl+c2bAHda vzUuKwlwjDcIXCZnpaxBOJzXja1Y5wXcitxzl93M/PSJXFcFgVtLA6iiNEzBmPYSjefh pwbT71Yd5wRZxQzUOYghbkillAS0r4gp0cxCBwAqb6oon3VYcxlGwjbUAR7dQZjp25Nn SRTByy5mawwVv/BAreuEjde3LlSEnkvXq8UOjQGy79YbzwAeDZb5T7BW/Lp03PIZLBMe XsY5qekvZqkJOixSmiRub8LK5dUNyJjuNYe35UzhPOVNtdv+XUSc/vYpCoahXh4X+8ZT XGaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783703372; x=1784308172; h=content-type:in-reply-to:autocrypt:from:content-language:references :cc:to:subject:user-agent:mime-version:date:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=3SC9F/Gky61Cad/V7BiLEMEIfQF+9xz3FR1ak4qsc8E=; b=m22tLR8ovlKKNJVHe1uymHtbnv/JNEZdsxKGpU2U1jubQVg01CcOgIAGbfLeuLl1g/ g4LYcMpOXmkLTyPXGvPPxt6rC8BdQFudpAQ60o81YZbz0c1fytNGAQ1Fka7Jb+BiF09Y 6yHd6UqOYUXl8uprhikLnqXuB2mIUOe3jFAd9nldXd2S7n853zInLTSVdhyW2Jy3GgCn 6U7NaXI8Q0S0b2MTtd0ayhskNnQqSbBI1X9tD1ILj9uZpfqur4sx99CgET82B8QnZA3b iYOzV5LOvBKU+5IIl3X/TD4syCE9uRVqeDms+D8PA05Qbs3BDpX4KaKdlF5fOBvuz78i GfGg== X-Gm-Message-State: AOJu0YwY0LOMb8/PGJKI6mHE7p6D23u/I8gpH4hlx4om0sCbKbKOTUtu iw+tu+ydzUh1Va9VCiClg0RLA2cCPYUpBbhSvHbwofUNgf2oIk0da0gzwky3JA== X-Gm-Gg: AfdE7cnZlG6GyqAvdMljcM6ByZ81LLLv3mzHGyed1GP29SNqI55gF+93sb7lCnhkSjW xqIwporBpsTX7x1hZvngLldMqKYfmZtKLfnJgES+cKY/KffwM61X9Wxqm6vOe5IOHpH4ubkRSsf uhc04W0P0MaqddIdPlaXxd3ml1D+Y7YFWLOu+4BOOOQEwWyLWM5Ep80Pd3xsdC+utLjap0wof93 KyuNavMFB3+O3OSh8nyJV9cZhycEhOisgC9Q3oy8M3dwTaCQYFbLO8rF4vJBB4UbN4XTXLUl0PB WSrxBjsI2kgX6CGNbOQRVQLyL/V70JOwKoS9GIlyb2KvNb3eRxMIJqz4jKg1hWJypCo5pt1vp7G jz6tB6o9YR+CAh1GiDf7uCGt7QPoyOko/70dyoZYn9WiQoFt9rp0rnne0miO6UVLMYfWgmIzz9b NhJayLgGTgjTV0z0Y= X-Received: by 2002:a05:690c:4b0a:b0:809:28e1:d50c with SMTP id 00721157ae682-81dbeb675afmr102771727b3.26.1783703372198; Fri, 10 Jul 2026 10:09:32 -0700 (PDT) Received: from [10.138.10.6] ([185.98.168.14]) by smtp.gmail.com with ESMTPSA id 00721157ae682-81e6befb688sm50874647b3.14.2026.07.10.10.09.30 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 10 Jul 2026 10:09:30 -0700 (PDT) Message-ID: <47d40c5e-ef44-4101-857e-3f656f1d14bf@gmail.com> Date: Fri, 10 Jul 2026 13:09:15 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace To: Alyssa Ross References: <20260709-s6-pid-namespaces-v1-1-61a56abd1e7c@gmail.com> <87ldbiaoyh.fsf@alyssa.is> Content-Language: en-US From: Demi Marie Obenour Autocrypt: addr=demiobenour@gmail.com; keydata= xsFNBFp+A0oBEADffj6anl9/BHhUSxGTICeVl2tob7hPDdhHNgPR4C8xlYt5q49yB+l2nipd aq+4Gk6FZfqC825TKl7eRpUjMriwle4r3R0ydSIGcy4M6eb0IcxmuPYfbWpr/si88QKgyGSV Z7GeNW1UnzTdhYHuFlk8dBSmB1fzhEYEk0RcJqg4AKoq6/3/UorR+FaSuVwT7rqzGrTlscnT DlPWgRzrQ3jssesI7sZLm82E3pJSgaUoCdCOlL7MMPCJwI8JpPlBedRpe9tfVyfu3euTPLPx wcV3L/cfWPGSL4PofBtB8NUU6QwYiQ9Hzx4xOyn67zW73/G0Q2vPPRst8LBDqlxLjbtx/WLR 6h3nBc3eyuZ+q62HS1pJ5EvUT1vjyJ1ySrqtUXWQ4XlZyoEFUfpJxJoN0A9HCxmHGVckzTRl 5FMWo8TCniHynNXsBtDQbabt7aNEOaAJdE7to0AH3T/Bvwzcp0ZJtBk0EM6YeMLtotUut7h2 Bkg1b//r6bTBswMBXVJ5H44Qf0+eKeUg7whSC9qpYOzzrm7+0r9F5u3qF8ZTx55TJc2g656C 9a1P1MYVysLvkLvS4H+crmxA/i08Tc1h+x9RRvqba4lSzZ6/Tmt60DPM5Sc4R0nSm9BBff0N m0bSNRS8InXdO1Aq3362QKX2NOwcL5YaStwODNyZUqF7izjK4QARAQABzTxEZW1pIE1hcmll IE9iZW5vdXIgKGxvdmVyIG9mIGNvZGluZykgPGRlbWlvYmVub3VyQGdtYWlsLmNvbT7CwXgE EwECACIFAlp+A0oCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJELKItV//nCLBhr8Q AK/xrb4wyi71xII2hkFBpT59ObLN+32FQT7R3lbZRjVFjc6yMUjOb1H/hJVxx+yo5gsSj5LS 9AwggioUSrcUKldfA/PKKai2mzTlUDxTcF3vKx6iMXKA6AqwAw4B57ZEJoMM6egm57TV19kz PMc879NV2nc6+elaKl+/kbVeD3qvBuEwsTe2Do3HAAdrfUG/j9erwIk6gha/Hp9yZlCnPTX+ VK+xifQqt8RtMqS5R/S8z0msJMI/ajNU03kFjOpqrYziv6OZLJ5cuKb3bZU5aoaRQRDzkFIR 6aqtFLTohTo20QywXwRa39uFaOT/0YMpNyel0kdOszFOykTEGI2u+kja35g9TkH90kkBTG+a EWttIht0Hy6YFmwjcAxisSakBuHnHuMSOiyRQLu43ej2+mDWgItLZ48Mu0C3IG1seeQDjEYP tqvyZ6bGkf2Vj+L6wLoLLIhRZxQOedqArIk/Sb2SzQYuxN44IDRt+3ZcDqsPppoKcxSyd1Ny 2tpvjYJXlfKmOYLhTWs8nwlAlSHX/c/jz/ywwf7eSvGknToo1Y0VpRtoxMaKW1nvH0OeCSVJ itfRP7YbiRVc2aNqWPCSgtqHAuVraBRbAFLKh9d2rKFB3BmynTUpc1BQLJP8+D5oNyb8Ts4x Xd3iV/uD8JLGJfYZIR7oGWFLP4uZ3tkneDfYzsFNBFp+A0oBEAC9ynZI9LU+uJkMeEJeJyQ/ 8VFkCJQPQZEsIGzOTlPnwvVna0AS86n2Z+rK7R/usYs5iJCZ55/JISWd8xD57ue0eB47bcJv VqGlObI2DEG8TwaW0O0duRhDgzMEL4t1KdRAepIESBEA/iPpI4gfUbVEIEQuqdqQyO4GAe+M kD0Hy5JH/0qgFmbaSegNTdQg5iqYjRZ3ttiswalql1/iSyv1WYeC1OAs+2BLOAT2NEggSiVO txEfgewsQtCWi8H1SoirakIfo45Hz0tk/Ad9ZWh2PvOGt97Ka85o4TLJxgJJqGEnqcFUZnJJ riwoaRIS8N2C8/nEM53jb1sH0gYddMU3QxY7dYNLIUrRKQeNkF30dK7V6JRH7pleRlf+wQcN fRAIUrNlatj9TxwivQrKnC9aIFFHEy/0mAgtrQShcMRmMgVlRoOA5B8RTulRLCmkafvwuhs6 dCxN0GNAORIVVFxjx9Vn7OqYPgwiofZ6SbEl0hgPyWBQvE85klFLZLoj7p+joDY1XNQztmfA rnJ9x+YV4igjWImINAZSlmEcYtd+xy3Li/8oeYDAqrsnrOjb+WvGhCykJk4urBog2LNtcyCj kTs7F+WeXGUo0NDhbd3Z6AyFfqeF7uJ3D5hlpX2nI9no/ugPrrTVoVZAgrrnNz0iZG2DVx46 x913pVKHl5mlYQARAQABwsFfBBgBAgAJBQJafgNKAhsMAAoJELKItV//nCLBwNIP/AiIHE8b oIqReFQyaMzxq6lE4YZCZNj65B/nkDOvodSiwfwjjVVE2V3iEzxMHbgyTCGA67+Bo/d5aQGj gn0TPtsGzelyQHipaUzEyrsceUGWYoKXYyVWKEfyh0cDfnd9diAm3VeNqchtcMpoehETH8fr RHnJdBcjf112PzQSdKC6kqU0Q196c4Vp5HDOQfNiDnTf7gZSj0BraHOByy9LEDCLhQiCmr+2 E0rW4tBtDAn2HkT9uf32ZGqJCn1O+2uVfFhGu6vPE5qkqrbSE8TG+03H8ecU2q50zgHWPdHM OBvy3EhzfAh2VmOSTcRK+tSUe/u3wdLRDPwv/DTzGI36Kgky9MsDC5gpIwNbOJP2G/q1wT1o Gkw4IXfWv2ufWiXqJ+k7HEi2N1sree7Dy9KBCqb+ca1vFhYPDJfhP75I/VnzHVssZ/rYZ9+5 1yDoUABoNdJNSGUYl+Yh9Pw9pE3Kt4EFzUlFZWbE4xKL/NPno+z4J9aWemLLszcYz/u3XnbO vUSQHSrmfOzX3cV4yfmjM5lewgSstoxGyTx2M8enslgdXhPthZlDnTnOT+C+OTsh8+m5tos8 HQjaPM01MKBiAqdPgksm1wu2DrrwUi6ChRVTUBcj6+/9IJ81H2P2gJk3Ls3AVIxIffLoY34E +MYSfkEjBz0E8CLOcAw7JIwAaeBT In-Reply-To: <87ldbiaoyh.fsf@alyssa.is> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------ALtWhHPt8Bbb00sG7w5dmF7l" Message-ID-Hash: EZGVQSHOKO6VL4UK3SJ6KS4BQXJ3ARHC X-Message-ID-Hash: EZGVQSHOKO6VL4UK3SJ6KS4BQXJ3ARHC X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Hits: member-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; emergency CC: Spectrum OS Development X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------ALtWhHPt8Bbb00sG7w5dmF7l Content-Type: multipart/mixed; boundary="------------Xfu0WJglHPeD0ezks9aEoXgC"; protected-headers="v1"; hp="clear" Message-ID: <47d40c5e-ef44-4101-857e-3f656f1d14bf@gmail.com> Date: Fri, 10 Jul 2026 13:09:15 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace To: Alyssa Ross Cc: Spectrum OS Development References: <20260709-s6-pid-namespaces-v1-1-61a56abd1e7c@gmail.com> <87ldbiaoyh.fsf@alyssa.is> Content-Language: en-US From: Demi Marie Obenour Autocrypt: addr=demiobenour@gmail.com; keydata= xsFNBFp+A0oBEADffj6anl9/BHhUSxGTICeVl2tob7hPDdhHNgPR4C8xlYt5q49yB+l2nipd aq+4Gk6FZfqC825TKl7eRpUjMriwle4r3R0ydSIGcy4M6eb0IcxmuPYfbWpr/si88QKgyGSV Z7GeNW1UnzTdhYHuFlk8dBSmB1fzhEYEk0RcJqg4AKoq6/3/UorR+FaSuVwT7rqzGrTlscnT DlPWgRzrQ3jssesI7sZLm82E3pJSgaUoCdCOlL7MMPCJwI8JpPlBedRpe9tfVyfu3euTPLPx wcV3L/cfWPGSL4PofBtB8NUU6QwYiQ9Hzx4xOyn67zW73/G0Q2vPPRst8LBDqlxLjbtx/WLR 6h3nBc3eyuZ+q62HS1pJ5EvUT1vjyJ1ySrqtUXWQ4XlZyoEFUfpJxJoN0A9HCxmHGVckzTRl 5FMWo8TCniHynNXsBtDQbabt7aNEOaAJdE7to0AH3T/Bvwzcp0ZJtBk0EM6YeMLtotUut7h2 Bkg1b//r6bTBswMBXVJ5H44Qf0+eKeUg7whSC9qpYOzzrm7+0r9F5u3qF8ZTx55TJc2g656C 9a1P1MYVysLvkLvS4H+crmxA/i08Tc1h+x9RRvqba4lSzZ6/Tmt60DPM5Sc4R0nSm9BBff0N m0bSNRS8InXdO1Aq3362QKX2NOwcL5YaStwODNyZUqF7izjK4QARAQABzTxEZW1pIE1hcmll IE9iZW5vdXIgKGxvdmVyIG9mIGNvZGluZykgPGRlbWlvYmVub3VyQGdtYWlsLmNvbT7CwXgE EwECACIFAlp+A0oCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJELKItV//nCLBhr8Q AK/xrb4wyi71xII2hkFBpT59ObLN+32FQT7R3lbZRjVFjc6yMUjOb1H/hJVxx+yo5gsSj5LS 9AwggioUSrcUKldfA/PKKai2mzTlUDxTcF3vKx6iMXKA6AqwAw4B57ZEJoMM6egm57TV19kz PMc879NV2nc6+elaKl+/kbVeD3qvBuEwsTe2Do3HAAdrfUG/j9erwIk6gha/Hp9yZlCnPTX+ VK+xifQqt8RtMqS5R/S8z0msJMI/ajNU03kFjOpqrYziv6OZLJ5cuKb3bZU5aoaRQRDzkFIR 6aqtFLTohTo20QywXwRa39uFaOT/0YMpNyel0kdOszFOykTEGI2u+kja35g9TkH90kkBTG+a EWttIht0Hy6YFmwjcAxisSakBuHnHuMSOiyRQLu43ej2+mDWgItLZ48Mu0C3IG1seeQDjEYP tqvyZ6bGkf2Vj+L6wLoLLIhRZxQOedqArIk/Sb2SzQYuxN44IDRt+3ZcDqsPppoKcxSyd1Ny 2tpvjYJXlfKmOYLhTWs8nwlAlSHX/c/jz/ywwf7eSvGknToo1Y0VpRtoxMaKW1nvH0OeCSVJ itfRP7YbiRVc2aNqWPCSgtqHAuVraBRbAFLKh9d2rKFB3BmynTUpc1BQLJP8+D5oNyb8Ts4x Xd3iV/uD8JLGJfYZIR7oGWFLP4uZ3tkneDfYzsFNBFp+A0oBEAC9ynZI9LU+uJkMeEJeJyQ/ 8VFkCJQPQZEsIGzOTlPnwvVna0AS86n2Z+rK7R/usYs5iJCZ55/JISWd8xD57ue0eB47bcJv VqGlObI2DEG8TwaW0O0duRhDgzMEL4t1KdRAepIESBEA/iPpI4gfUbVEIEQuqdqQyO4GAe+M kD0Hy5JH/0qgFmbaSegNTdQg5iqYjRZ3ttiswalql1/iSyv1WYeC1OAs+2BLOAT2NEggSiVO txEfgewsQtCWi8H1SoirakIfo45Hz0tk/Ad9ZWh2PvOGt97Ka85o4TLJxgJJqGEnqcFUZnJJ riwoaRIS8N2C8/nEM53jb1sH0gYddMU3QxY7dYNLIUrRKQeNkF30dK7V6JRH7pleRlf+wQcN fRAIUrNlatj9TxwivQrKnC9aIFFHEy/0mAgtrQShcMRmMgVlRoOA5B8RTulRLCmkafvwuhs6 dCxN0GNAORIVVFxjx9Vn7OqYPgwiofZ6SbEl0hgPyWBQvE85klFLZLoj7p+joDY1XNQztmfA rnJ9x+YV4igjWImINAZSlmEcYtd+xy3Li/8oeYDAqrsnrOjb+WvGhCykJk4urBog2LNtcyCj kTs7F+WeXGUo0NDhbd3Z6AyFfqeF7uJ3D5hlpX2nI9no/ugPrrTVoVZAgrrnNz0iZG2DVx46 x913pVKHl5mlYQARAQABwsFfBBgBAgAJBQJafgNKAhsMAAoJELKItV//nCLBwNIP/AiIHE8b oIqReFQyaMzxq6lE4YZCZNj65B/nkDOvodSiwfwjjVVE2V3iEzxMHbgyTCGA67+Bo/d5aQGj gn0TPtsGzelyQHipaUzEyrsceUGWYoKXYyVWKEfyh0cDfnd9diAm3VeNqchtcMpoehETH8fr RHnJdBcjf112PzQSdKC6kqU0Q196c4Vp5HDOQfNiDnTf7gZSj0BraHOByy9LEDCLhQiCmr+2 E0rW4tBtDAn2HkT9uf32ZGqJCn1O+2uVfFhGu6vPE5qkqrbSE8TG+03H8ecU2q50zgHWPdHM OBvy3EhzfAh2VmOSTcRK+tSUe/u3wdLRDPwv/DTzGI36Kgky9MsDC5gpIwNbOJP2G/q1wT1o Gkw4IXfWv2ufWiXqJ+k7HEi2N1sree7Dy9KBCqb+ca1vFhYPDJfhP75I/VnzHVssZ/rYZ9+5 1yDoUABoNdJNSGUYl+Yh9Pw9pE3Kt4EFzUlFZWbE4xKL/NPno+z4J9aWemLLszcYz/u3XnbO vUSQHSrmfOzX3cV4yfmjM5lewgSstoxGyTx2M8enslgdXhPthZlDnTnOT+C+OTsh8+m5tos8 HQjaPM01MKBiAqdPgksm1wu2DrrwUi6ChRVTUBcj6+/9IJ81H2P2gJk3Ls3AVIxIffLoY34E +MYSfkEjBz0E8CLOcAw7JIwAaeBT In-Reply-To: <87ldbiaoyh.fsf@alyssa.is> --------------Xfu0WJglHPeD0ezks9aEoXgC Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 7/10/26 10:39, Alyssa Ross wrote: > Demi Marie Obenour writes: >=20 >> s6-supervise can do so directly with less overhead. >> >> Signed-off-by: Demi Marie Obenour >> --- >> host/rootfs/file-list.mk | = 2 ++ >> .../template/data/service/spectrum-router/flag-newpidns | = 0 >> .../service/vm-services/template/data/service/spectrum-router/run | = 5 ++++- >> .../vm-services/template/data/service/vhost-user-gpu/flag-newpidns | = 0 >> .../service/vm-services/template/data/service/vhost-user-gpu/run | = 7 ++++--- >> 5 files changed, 10 insertions(+), 4 deletions(-) >=20 > I guess this isn't done for run-vmm because it might not be run through= s6? Exactly! >> diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk >> index 3899d620717fc97f42e669e5313c4100dcf5b1cd..951cb2e9f0af05839ef5e9= c0b5384c13e56622ff 100644 >> --- a/host/rootfs/file-list.mk >> +++ b/host/rootfs/file-list.mk >> @@ -30,10 +30,12 @@ FILES =3D \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/dbus/notification-fd \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/dbus/run \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/spectrum-router/down \ >> + image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/spectrum-router/flag-newpidns \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/spectrum-router/notification-fd \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/spectrum-router/run \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/vhost-user-fs/notification-fd \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/vhost-user-fs/run \ >> + image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/vhost-user-gpu/flag-newpidns \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/vhost-user-gpu/notification-fd \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/vhost-user-gpu/run \ >> image/etc/s6-linux-init/run-image/service/vm-services/template/data/= service/xdg-desktop-portal-spectrum-host/notification-fd \ >> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-= services/template/data/service/spectrum-router/flag-newpidns b/host/rootf= s/image/etc/s6-linux-init/run-image/service/vm-services/template/data/ser= vice/spectrum-router/flag-newpidns >> new file mode 100644 >> index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29= ae775ad8c2e48c5391 >> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-= services/template/data/service/spectrum-router/run b/host/rootfs/image/et= c/s6-linux-init/run-image/service/vm-services/template/data/service/spect= rum-router/run >> index 3de58c27facc78c48176d8f9a6dd1827ac926f1a..ce84ed951de1a179d1430f= aae412fe4c1a2fb1f1 100755 >> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-service= s/template/data/service/spectrum-router/run >> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-service= s/template/data/service/spectrum-router/run >> @@ -25,7 +25,10 @@ if { >> s6-setuidgid router >> =20 >> bwrap >> - --unshare-all >> + --unshare-net >> + --unshare-ipc >> + --unshare-uts >> + --unshare-cgroup >> --unshare-user >> --dev-bind / / >> --setenv RUST_LOG spectrum-router=3Ddebug,info >> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-= services/template/data/service/vhost-user-gpu/flag-newpidns b/host/rootfs= /image/etc/s6-linux-init/run-image/service/vm-services/template/data/serv= ice/vhost-user-gpu/flag-newpidns >> new file mode 100644 >> index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29= ae775ad8c2e48c5391 >> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-= services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc= /s6-linux-init/run-image/service/vm-services/template/data/service/vhost-= user-gpu/run >> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0= bfa546590b9308eb9c 100755 >> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-service= s/template/data/service/vhost-user-gpu/run >> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-service= s/template/data/service/vhost-user-gpu/run >> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland >> s6-ipcserverd -1c 1 >> =20 >> bwrap >> - --unshare-all >> - # --unshare-all only implies --unshare-user-try. >> - # Make this more than a "try". >> + --unshare-net >> + --unshare-ipc >> + --unshare-uts >> + --unshare-cgroup >> --unshare-user >> --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY >> --ro-bind /usr /usr >=20 > There's a subtle behaviour change here. The pid namespace is reused > between runs of crosvm, because if crosvm exits, s6-ipcserverd will sta= y > running and wait for the next connection, then respawn crosvm. It's > done this way because crosvm has made the unusual decision to support > being started on a connected socket, rather than a listening socket lik= e > one might expect. Is that okay? I'd guess yes, but I want to check > with you! It's less robust than I would like, but there is no reason one cannot have both s6-supervise and bubblewrap create PID namespaces. That's the approach I would go with. --=20 Sincerely, Demi Marie Obenour (she/her/hers) --------------Xfu0WJglHPeD0ezks9aEoXgC-- --------------ALtWhHPt8Bbb00sG7w5dmF7l Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEopQtqVJW1aeuo9/sszaHOrMp8lMFAmpRJ0UACgkQszaHOrMp 8lMJOg//ZH3jbHfsxJ8X0OLWfzxR0MfJtwjQiI0G3K47utPIVzC0fWFwkJY8Qduo iJ7xGYGZJIsTEMZ7fRpUNgrGAd7K5kwsKUtLiuvAdp6gIkAs00TN/SwhBGQ9M3zq 8hyVld0Uq+2vgpQ3ivADvTJNuHmbs2anwQcGBuuPRYQBEXHZ+PF36G3cYJzNiKzB toDp/bhnVBGKtQoaSpS3RErRsn1srg+P1EHw7NYRT9myh6AO/oonLnFLtemCas2L /JjIoA8tBUfsvG5DUL92LczZC9hYL6zHJjvYUP1Ag5sJspPfu4mRgw5jYbuF/8i5 mF/cz/9UriW/fxdafcYgA0gFM3i9mQh6fVcQoCsL4PliDnSnaytnQS9V72sS272+ cUbDUmWp85tycFL/q8EtxhKitc52x2sD/tUWYw8rc/oDGnpKGfSSsWyu4Chb0myO yzG4OGukE19cK0SUp1Jwp3qnnV4kNxB4HakxMF9iLMGN/+K5mFGwfmXahW4XmiTi qLZLqh7FCl4RXVvbtH1NYa5EekZ0cQHNSNFfWMiDlVlVOuugRFfAb8QoPUqeYtys 4YAKTmcux5oFf4QeK6kgTqco0HIANIYKMsnOqnsCWzUuTbxFCaGwiBuQO4zgs2xK jw1Q8dXKmdcFkxm5LZsajDY/sMVUlfRlYclO2IMG5RXejYrTpfw= =drBJ -----END PGP SIGNATURE----- --------------ALtWhHPt8Bbb00sG7w5dmF7l--