Demi Marie Obenour writes: > On 6/20/26 15:46, Alyssa Ross wrote: >> cloud-hypervisor was being run with its own /dev/pts, so vm-console >> couldn't find the VM PTY to open it. Furthermore, for Cloud >> Hypervisor to actually use the global /dev/pts now that it runs as >> non-root, it needs to be able to open /dev/pts/ptmx. ptmxmode=666 >> matches how systemd mounts /dev/pts. >> >> Fixes: 6138e44a ("host/rootfs: run Cloud Hypervisor as non-root") >> Fixes: ec47d362 ("host/rootfs: Sandbox Cloud Hypervisor") >> Signed-off-by: Alyssa Ross >> --- >> Posting to the list in particular to give a chance to anybody who >> wants to tell me the sandboxing should be done a different way. >> >> host/rootfs/image/etc/fstab | 2 +- >> host/rootfs/image/usr/bin/run-vmm | 1 + >> 2 files changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab >> index 18bb5e45..4d52a1da 100644 >> --- a/host/rootfs/image/etc/fstab >> +++ b/host/rootfs/image/etc/fstab >> @@ -1,7 +1,7 @@ >> # SPDX-License-Identifier: CC0-1.0 >> # SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross >> proc /proc proc nosuid,nodev,noexec 0 0 >> -devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620 0 0 >> +devpts /dev/pts devpts nosuid,noexec,gid=5,mode=620,ptmxmode=666 0 0 >> tmpfs /dev/shm tmpfs nosuid,nodev 0 0 >> tmpfs /media tmpfs nosuid,nodev,noexec,nosymfollow,mode=755 0 0 >> sysfs /sys sysfs nosuid,nodev,noexec 0 0 >> diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm >> index 94199434..6967dc55 100755 >> --- a/host/rootfs/image/usr/bin/run-vmm >> +++ b/host/rootfs/image/usr/bin/run-vmm >> @@ -93,6 +93,7 @@ bwrap >> --unshare-user >> --dev /dev >> --dev-bind /dev/kvm /dev/kvm >> + --dev-bind /dev/pts /dev/pts >> --dev-bind /dev/vfio /dev/vfio >> --tmpfs /dev/shm >> --tmpfs /tmp >> >> base-commit: 57bf21eaf65ca5a42d18999ba65f96dcd338113c > > My understanding is that the only reason to use an actual PTY is > to forward dimension changes. Do we really need this, given that > vm-console is only for debugging? As long as the VM has xterm-resize > installed, it's possible to sync the dimensions manually. I'd prefer > to lose dimension change forwarding instead of weakening the sandbox. > > This is worse, but it's manageable. I worked in a Qubes VM for quite > a while this way, as I was writing a replacement for the GUI daemon > and so the in-VM GUI was not available when the custom code was not > running (or not working). > > A better (and, hopefully, straightforward) solution would be to > carry dimension information in-band using specific escape sequences. > This could either be supported natively in terminal emulators, or > could implemented by a simple proxy otherwise. Eventually I would like to just have a terminal emulator inside every VM, rather than exposing a host terminal emulator to who knows what weird escape sequences from the VM, so I don't think new protocols to transmit dimensions would be a good investment. In the meantime, though, I'd like previously working functionality back. Using a terminal emulator without size information is absolutely horrible, because line endings are messed up and long lines become very difficult to read correctly.