[PATCH] host/rootfs: fix vm-console

[PATCH] host/rootfs: fix vm-console

[Alyssa Ross]

cloud-hypervisor was being run with its own /dev/pts, so vm-console
couldn't find the VM PTY to open it.  Furthermore, for Cloud
Hypervisor to actually use the global /dev/pts now that it runs as
non-root, it needs to be able to open /dev/pts/ptmx.  ptmxmode=666
matches how systemd mounts /dev/pts.

Fixes: 6138e44a ("host/rootfs: run Cloud Hypervisor as non-root")
Fixes: ec47d362 ("host/rootfs: Sandbox Cloud Hypervisor")
Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
Posting to the list in particular to give a chance to anybody who
wants to tell me the sandboxing should be done a different way.

 host/rootfs/image/etc/fstab       | 2 +-
 host/rootfs/image/usr/bin/run-vmm | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab
index 18bb5e45..4d52a1da 100644
--- a/host/rootfs/image/etc/fstab
+++ b/host/rootfs/image/etc/fstab
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: CC0-1.0
 # SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
 proc	/proc		proc	nosuid,nodev,noexec				0	0
-devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620			0	0
+devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620,ptmxmode=666	0	0
 tmpfs	/dev/shm	tmpfs	nosuid,nodev					0	0
 tmpfs	/media		tmpfs	nosuid,nodev,noexec,nosymfollow,mode=755	0	0
 sysfs	/sys		sysfs	nosuid,nodev,noexec				0	0
diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm
index 94199434..6967dc55 100755
--- a/host/rootfs/image/usr/bin/run-vmm
+++ b/host/rootfs/image/usr/bin/run-vmm
@@ -93,6 +93,7 @@ bwrap
   --unshare-user
   --dev /dev
   --dev-bind /dev/kvm /dev/kvm
+  --dev-bind /dev/pts /dev/pts
   --dev-bind /dev/vfio /dev/vfio
   --tmpfs /dev/shm
   --tmpfs /tmp

base-commit: 57bf21eaf65ca5a42d18999ba65f96dcd338113c
-- 
2.54.0

Re: [PATCH] host/rootfs: fix vm-console

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 2854 bytes --]

On 6/20/26 15:46, Alyssa Ross wrote:
> cloud-hypervisor was being run with its own /dev/pts, so vm-console
> couldn't find the VM PTY to open it.  Furthermore, for Cloud
> Hypervisor to actually use the global /dev/pts now that it runs as
> non-root, it needs to be able to open /dev/pts/ptmx.  ptmxmode=666
> matches how systemd mounts /dev/pts.
> 
> Fixes: 6138e44a ("host/rootfs: run Cloud Hypervisor as non-root")
> Fixes: ec47d362 ("host/rootfs: Sandbox Cloud Hypervisor")
> Signed-off-by: Alyssa Ross <hi@alyssa.is>
> ---
> Posting to the list in particular to give a chance to anybody who
> wants to tell me the sandboxing should be done a different way.
> 
>  host/rootfs/image/etc/fstab       | 2 +-
>  host/rootfs/image/usr/bin/run-vmm | 1 +
>  2 files changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab
> index 18bb5e45..4d52a1da 100644
> --- a/host/rootfs/image/etc/fstab
> +++ b/host/rootfs/image/etc/fstab
> @@ -1,7 +1,7 @@
>  # SPDX-License-Identifier: CC0-1.0
>  # SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
>  proc	/proc		proc	nosuid,nodev,noexec				0	0
> -devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620			0	0
> +devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620,ptmxmode=666	0	0
>  tmpfs	/dev/shm	tmpfs	nosuid,nodev					0	0
>  tmpfs	/media		tmpfs	nosuid,nodev,noexec,nosymfollow,mode=755	0	0
>  sysfs	/sys		sysfs	nosuid,nodev,noexec				0	0
> diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm
> index 94199434..6967dc55 100755
> --- a/host/rootfs/image/usr/bin/run-vmm
> +++ b/host/rootfs/image/usr/bin/run-vmm
> @@ -93,6 +93,7 @@ bwrap
>    --unshare-user
>    --dev /dev
>    --dev-bind /dev/kvm /dev/kvm
> +  --dev-bind /dev/pts /dev/pts
>    --dev-bind /dev/vfio /dev/vfio
>    --tmpfs /dev/shm
>    --tmpfs /tmp
> 
> base-commit: 57bf21eaf65ca5a42d18999ba65f96dcd338113c

My understanding is that the only reason to use an actual PTY is
to forward dimension changes. Do we really need this, given that
vm-console is only for debugging?  As long as the VM has xterm-resize
installed, it's possible to sync the dimensions manually.  I'd prefer
to lose dimension change forwarding instead of weakening the sandbox.

This is worse, but it's manageable.  I worked in a Qubes VM for quite
a while this way, as I was writing a replacement for the GUI daemon
and so the in-VM GUI was not available when the custom code was not
running (or not working).

A better (and, hopefully, straightforward) solution would be to
carry dimension information in-band using specific escape sequences.
This could either be supported natively in terminal emulators, or
could implemented by a simple proxy otherwise.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] host/rootfs: fix vm-console

[Alyssa Ross]

[-- Attachment #1: Type: text/plain, Size: 3440 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 6/20/26 15:46, Alyssa Ross wrote:
>> cloud-hypervisor was being run with its own /dev/pts, so vm-console
>> couldn't find the VM PTY to open it.  Furthermore, for Cloud
>> Hypervisor to actually use the global /dev/pts now that it runs as
>> non-root, it needs to be able to open /dev/pts/ptmx.  ptmxmode=666
>> matches how systemd mounts /dev/pts.
>> 
>> Fixes: 6138e44a ("host/rootfs: run Cloud Hypervisor as non-root")
>> Fixes: ec47d362 ("host/rootfs: Sandbox Cloud Hypervisor")
>> Signed-off-by: Alyssa Ross <hi@alyssa.is>
>> ---
>> Posting to the list in particular to give a chance to anybody who
>> wants to tell me the sandboxing should be done a different way.
>> 
>>  host/rootfs/image/etc/fstab       | 2 +-
>>  host/rootfs/image/usr/bin/run-vmm | 1 +
>>  2 files changed, 2 insertions(+), 1 deletion(-)
>> 
>> diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab
>> index 18bb5e45..4d52a1da 100644
>> --- a/host/rootfs/image/etc/fstab
>> +++ b/host/rootfs/image/etc/fstab
>> @@ -1,7 +1,7 @@
>>  # SPDX-License-Identifier: CC0-1.0
>>  # SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
>>  proc	/proc		proc	nosuid,nodev,noexec				0	0
>> -devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620			0	0
>> +devpts	/dev/pts	devpts	nosuid,noexec,gid=5,mode=620,ptmxmode=666	0	0
>>  tmpfs	/dev/shm	tmpfs	nosuid,nodev					0	0
>>  tmpfs	/media		tmpfs	nosuid,nodev,noexec,nosymfollow,mode=755	0	0
>>  sysfs	/sys		sysfs	nosuid,nodev,noexec				0	0
>> diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm
>> index 94199434..6967dc55 100755
>> --- a/host/rootfs/image/usr/bin/run-vmm
>> +++ b/host/rootfs/image/usr/bin/run-vmm
>> @@ -93,6 +93,7 @@ bwrap
>>    --unshare-user
>>    --dev /dev
>>    --dev-bind /dev/kvm /dev/kvm
>> +  --dev-bind /dev/pts /dev/pts
>>    --dev-bind /dev/vfio /dev/vfio
>>    --tmpfs /dev/shm
>>    --tmpfs /tmp
>> 
>> base-commit: 57bf21eaf65ca5a42d18999ba65f96dcd338113c
>
> My understanding is that the only reason to use an actual PTY is
> to forward dimension changes. Do we really need this, given that
> vm-console is only for debugging?  As long as the VM has xterm-resize
> installed, it's possible to sync the dimensions manually.  I'd prefer
> to lose dimension change forwarding instead of weakening the sandbox.
>
> This is worse, but it's manageable.  I worked in a Qubes VM for quite
> a while this way, as I was writing a replacement for the GUI daemon
> and so the in-VM GUI was not available when the custom code was not
> running (or not working).
>
> A better (and, hopefully, straightforward) solution would be to
> carry dimension information in-band using specific escape sequences.
> This could either be supported natively in terminal emulators, or
> could implemented by a simple proxy otherwise.

Eventually I would like to just have a terminal emulator inside every
VM, rather than exposing a host terminal emulator to who knows what
weird escape sequences from the VM, so I don't think new protocols to
transmit dimensions would be a good investment.  In the meantime,
though, I'd like previously working functionality back.  Using a
terminal emulator without size information is absolutely horrible,
because line endings are messed up and long lines become very difficult
to read correctly.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]