Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace

[Demi Marie Obenour <demiobenour@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 2178 bytes --]

On 7/13/26 05:01, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> On 7/10/26 10:39, Alyssa Ross wrote:
>>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>>
>>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755
>>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland
>>>>  s6-ipcserverd -1c 1
>>>>  
>>>>  bwrap
>>>> -  --unshare-all
>>>> -  # --unshare-all only implies --unshare-user-try.
>>>> -  # Make this more than a "try".
>>>> +  --unshare-net
>>>> +  --unshare-ipc
>>>> +  --unshare-uts
>>>> +  --unshare-cgroup
>>>>    --unshare-user
>>>>    --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
>>>>    --ro-bind /usr /usr
>>>
>>> There's a subtle behaviour change here.  The pid namespace is reused
>>> between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay
>>> running and wait for the next connection, then respawn crosvm.  It's
>>> done this way because crosvm has made the unusual decision to support
>>> being started on a connected socket, rather than a listening socket like
>>> one might expect.  Is that okay?  I'd guess yes, but I want to check
>>> with you!
>>
>> It's less robust than I would like, but there is no reason one cannot
>> have both s6-supervise and bubblewrap create PID namespaces.  That's
>> the approach I would go with.
> 
> What's the point of the intermediate PID namespace?

Ensure that there are no stale Cloud Hypervisor processes left behind.
Specifically, the PTY watcher ought to be moved to the main process
if there is only one PTY, but it’s currently a separate process.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]