[PATCH 7/8] host/rootfs: move fs directory out of VM directory

Alyssa Ross
2025-12-10T12:48:44Z

This will enable running virtiofsd as a user that does not have access
to VM directories.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
.../template/data/service/vhost-user-fs/run | 2 +-
host/rootfs/image/usr/bin/create-vm-dependencies | 12 +++++-------
host/rootfs/image/usr/bin/run-appimage | 2 +-
host/rootfs/image/usr/bin/run-flatpak | 2 +-
host/rootfs/image/usr/bin/spectrum-update | 14 +++++++-------
5 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
index 79830a00..116570c3 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
@@ -15,4 +15,4 @@ importas -i VM VM
nsenter --mount=/run/vm/by-id/${VM}/mount
unshare -U --map-user 1000 --map-group 1000 --uts --ipc --cgroup

-virtiofsd --fd 3 --shared-dir /run/vm/by-id/${VM}/fs
+virtiofsd --fd 3 --shared-dir /run/fs/${VM}
diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies
index 98f10489..344e7778 100755
--- a/host/rootfs/image/usr/bin/create-vm-dependencies
+++ b/host/rootfs/image/usr/bin/create-vm-dependencies
@@ -9,8 +9,8 @@ if { mount --make-private --bind /run/vm/by-id/${1}/user /run/vm/by-id/${1}/user
if {
mkdir -p
/run/doc/${1}/doc
- /run/vm/by-id/${1}/fs/config
- /run/vm/by-id/${1}/fs/doc
+ /run/fs/${1}/config
+ /run/fs/${1}/doc
}

if {
@@ -20,16 +20,14 @@ if {
--mount=/run/vm/by-id/${1}/mount
--user=/run/vm/by-id/${1}/user

- if { mount --make-shared --rbind /run/vm/by-id/${1} /run/vm/by-id/${1} }
-
# The VM should not be able to write directly into a tmpfs, and the host
# should be able to assume there are no untrusted symlinks there, but there
# can be writable block-based bind mounted subdirectories.
- if { mount --rbind -o nofail /run/vm/by-id/${1}/config/fs /run/vm/by-id/${1}/fs/config }
- if { mount --rbind -o ro /run/vm/by-id/${1}/fs /run/vm/by-id/${1}/fs }
+ if { mount --make-shared --rbind -o nofail /run/vm/by-id/${1}/config/fs /run/fs/${1}/config }
+ if { mount --rbind -o ro /run/fs/${1} /run/fs/${1} }

if { mount --make-shared --rbind /run/doc/${1} /run/doc/${1} }
- mount --rbind /run/doc/${1}/doc /run/vm/by-id/${1}/fs/doc
+ mount --rbind /run/doc/${1}/doc /run/fs/${1}/doc
}

if { s6-instance-create /run/service/vm-services $1 }
diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage
index 5e8e29fa..f0fe8311 100755
--- a/host/rootfs/image/usr/bin/run-appimage
+++ b/host/rootfs/image/usr/bin/run-appimage
@@ -20,7 +20,7 @@ if { create-vm-dependencies $id }

if {
nsenter --mount=${dir}/mount
- cd ${dir}/fs/config
+ cd /run/fs/${id}/config
if { redirfd -w 1 type echo appimage }
if { touch run }
mount --bind $1 run
diff --git a/host/rootfs/image/usr/bin/run-flatpak b/host/rootfs/image/usr/bin/run-flatpak
index 86ccc12a..f9179819 100755
--- a/host/rootfs/image/usr/bin/run-flatpak
+++ b/host/rootfs/image/usr/bin/run-flatpak
@@ -23,7 +23,7 @@ if {

if {
nsenter --mount=${dir}/mount
- cd ${dir}/fs/config
+ cd /run/fs/${id}/config
if { redirfd -w 1 type echo flatpak }
mount-flatpak $@
}
diff --git a/host/rootfs/image/usr/bin/spectrum-update b/host/rootfs/image/usr/bin/spectrum-update
index b1517a6c..10a9f197 100755
--- a/host/rootfs/image/usr/bin/spectrum-update
+++ b/host/rootfs/image/usr/bin/spectrum-update
@@ -43,11 +43,11 @@ foreground {
# mounts instead of rm -rf. Once this code is in a separate mount
# namespace, the copies should be replaced by bind mounts.
if {
- if { rm -rf -- /run/vm/by-id/${update_vm_id}/fs/etc }
+ if { rm -rf -- /run/fs/${update_vm_id}/etc }
umask 022
- if { mkdir -p -- /run/vm/by-id/${update_vm_id}/fs/updates /run/vm/by-id/${update_vm_id}/fs/etc/systemd }
- if { cp -R -- /etc/vm-sysupdate.d /etc/update-url /run/vm/by-id/${update_vm_id}/fs/etc }
- cp -- /etc/systemd/import-pubring.gpg /run/vm/by-id/${update_vm_id}/fs/etc/systemd
+ if { mkdir -p -- /run/fs/${update_vm_id}/updates /run/fs/${update_vm_id}/etc/systemd }
+ if { cp -R -- /etc/vm-sysupdate.d /etc/update-url /run/fs/${update_vm_id}/etc }
+ cp -- /etc/systemd/import-pubring.gpg /run/fs/${update_vm_id}/etc/systemd
}

nsenter --mount=/run/vm/by-id/${update_vm_id}/mount
@@ -55,10 +55,10 @@ foreground {

# If the directory is already mounted, unmount it. This prevents a
# confusing error from mount.
- foreground { redirfd -w 2 /dev/null umount -- /run/vm/by-id/${update_vm_id}/fs/updates }
+ foreground { redirfd -w 2 /dev/null umount -- /run/fs/${update_vm_id}/updates }

# Share the update directory with the VM.
- if { mount --bind -- shared /run/vm/by-id/${update_vm_id}/fs/updates }
+ if { mount --bind -- shared /run/fs/${update_vm_id}/updates }

# Start the update VM.
if { vm-start $update_vm_id }
@@ -69,7 +69,7 @@ foreground {
if { s6-svwait -D /run/service/vmm/instance/${update_vm_id} }

# Remove the bind mount.
- if { umount -- /run/vm/by-id/${update_vm_id}/fs/updates }
+ if { umount -- /run/fs/${update_vm_id}/updates }

# Ensure that the VM cannot change the directory
# while systemd-sysupdate is using it.
--
2.51.0