From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 3722095F4; Wed, 24 Jun 2026 08:47:37 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 3FE2995E9; Wed, 24 Jun 2026 08:47:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_MISSING,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 Received: from fout-b1-smtp.messagingengine.com (fout-b1-smtp.messagingengine.com [202.12.124.144]) by atuin.qyliss.net (Postfix) with ESMTPS id D91A195E6 for ; Wed, 24 Jun 2026 08:47:33 +0000 (UTC) Received: from phl-compute-06.internal (phl-compute-06.internal [10.202.2.46]) by mailfout.stl.internal (Postfix) with ESMTP id 70F1C1D000CD; Wed, 24 Jun 2026 04:47:32 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-06.internal (MEProxy); Wed, 24 Jun 2026 04:47:32 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alyssa.is; h=cc :cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1782290852; x=1782377252; bh=/yYHaf141F W2WGrmEGYJdYHhbWgJQ138cIQnr3cOPwk=; b=FmfPuis6WmYwOY1EoG6YU5RaPY oG1y5vz+LyHOir07QUCONKQdJkzANLT7eWZmgDpdQvKdQoE6S8z2eEmYuQYnxsXl 54Zr12b9blSiiCWdD6ZzjNswwbVAXHeadBSDznwnM+1wxZ9W2ICykpkGlu8yVqCD DZmCzpHe6lLOnvJBk85OUSAaW8sL0DloiulffEeGjAOqXf+8xA7MCnmGt5HkT99w mHE/WUy4AOVVyUyE+aJyuNU0FW0IxHMJTTLpGLyZ/1BH+Stb1lfDpa+mB8gw8BJu xT1CxQ79G/nQVBw2yMVGxDaJjjICa3mYosd/8Eb5ecdZdvpKOkKxmGPzDDCg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t= 1782290852; x=1782377252; bh=/yYHaf141FW2WGrmEGYJdYHhbWgJQ138cIQ nr3cOPwk=; b=HxqSbqR2iRHiyTnhk6F+Upq+JXW7OOALqjZmKm7cE7p6Icnij2t d1j2FMNeWIBurbYs9oKV8MWmZDVr6Y8L4/SRB05OuSr0QHiN8ytw3ggFEEnzXFag hWflq06+lYy6k/wt+e2pmwxghiMpOYxAsnIgc7NU+BG7/UD/4J5NjNk7YV4dwkQW hwv8lbXTPpj1NErePLBq7iJPaVblOYcy9mz0uMOcvgmlzc2DzsOCobzT3S2LfzTW nh/WlqpYu4502gYQEJDEO34AaKhJp1Rk8rL02IwNgvTeC96TitYCE0FpJ1Yka6hO glp52RsnX3H3JegjxGGognkVaghyLVYWnkw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTGC18IVIv6NzutUXSG/di78bqvb7eEfonfoWcZb1r8/TOPlF2wEMn1n6CRFacW6NE /OG6NN3UThjmrUYROC53aqeEOzr6Yn1FQ63ZU0TsF+Qz9FtejJcRJtiRfB93iu04TOU/N+ WTZZs1SrfjOYl89X4DHo4t3CNMU0c8C0+5MHulpPAKz8vGCJcveb1qWBPfULRdi6nox0OQ NmzrMRpDmym5sozuEnfmPFnMdLe4OzTqa3ABSWzGrn4FdsGjWLXXlU0DwpjjRw4DEPCkQa CLhgNciScTw6Ezk9EEtmln+kYmFS/X8P9UiLln6+xxpeOALbQr0mTXQVo0Jk4fphsU+wDj DDtRLm1Hd2ZWNWyYVssva8fYUT5OL1Kdb9tW2fFiD8AfziWPWScg3LzQ1uHy8XSzxIxKTy YEQbINg9V65CVuH89wviwn3+z7bFFNpyzkz2K14FALygFfW8Vtp4yYYMvSrfDzT1DinPlv +DlFv/uCBeRaSCRFKQDHnhxMbTOJWBfvwP7FIdmfj91ntJ/wm+AtEo0cTiaU1IRPsdATum FZnx/8fxsSNsFmDTiopKCf/GIezP/PDqa+84CTwMHogJhwFFxvk3O9VPy1z3Lop0tIfnH0 bfmAk9x+VoQxUkAIqANnl7x3m799bBI2lKL/QbSvpBiZHIiOWGIrTSISA4oA X-ME-Proxy: Feedback-ID: i12284293:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 24 Jun 2026 04:47:31 -0400 (EDT) Received: by fw12.qyliss.net (Postfix, from userid 1000) id 92CE0B90E66F; Wed, 24 Jun 2026 10:47:29 +0200 (CEST) From: Alyssa Ross To: Demi Marie Obenour Subject: Re: [PATCH] host/rootfs: fix vm-console In-Reply-To: <2ce58534-97a7-4846-9f6d-30aa7b044078@gmail.com> References: <20260620194635.53707-2-hi@alyssa.is> <2ce58534-97a7-4846-9f6d-30aa7b044078@gmail.com> Date: Wed, 24 Jun 2026 10:47:28 +0200 Message-ID: <8733yc72an.fsf@alyssa.is> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Message-ID-Hash: JGHRJBQKRZ4J43CCVAZN273JFOQ7TFHV X-Message-ID-Hash: JGHRJBQKRZ4J43CCVAZN273JFOQ7TFHV X-MailFrom: hi@alyssa.is X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Yureka Lilian , devel@spectrum-os.org X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Demi Marie Obenour writes: > On 6/20/26 15:46, Alyssa Ross wrote: >> cloud-hypervisor was being run with its own /dev/pts, so vm-console >> couldn't find the VM PTY to open it. Furthermore, for Cloud >> Hypervisor to actually use the global /dev/pts now that it runs as >> non-root, it needs to be able to open /dev/pts/ptmx. ptmxmode=3D666 >> matches how systemd mounts /dev/pts. >>=20 >> Fixes: 6138e44a ("host/rootfs: run Cloud Hypervisor as non-root") >> Fixes: ec47d362 ("host/rootfs: Sandbox Cloud Hypervisor") >> Signed-off-by: Alyssa Ross >> --- >> Posting to the list in particular to give a chance to anybody who >> wants to tell me the sandboxing should be done a different way. >>=20 >> host/rootfs/image/etc/fstab | 2 +- >> host/rootfs/image/usr/bin/run-vmm | 1 + >> 2 files changed, 2 insertions(+), 1 deletion(-) >>=20 >> diff --git a/host/rootfs/image/etc/fstab b/host/rootfs/image/etc/fstab >> index 18bb5e45..4d52a1da 100644 >> --- a/host/rootfs/image/etc/fstab >> +++ b/host/rootfs/image/etc/fstab >> @@ -1,7 +1,7 @@ >> # SPDX-License-Identifier: CC0-1.0 >> # SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross >> proc /proc proc nosuid,nodev,noexec 0 0 >> -devpts /dev/pts devpts nosuid,noexec,gid=3D5,mode=3D620 0 0 >> +devpts /dev/pts devpts nosuid,noexec,gid=3D5,mode=3D620,ptmxmode=3D666 = 0 0 >> tmpfs /dev/shm tmpfs nosuid,nodev 0 0 >> tmpfs /media tmpfs nosuid,nodev,noexec,nosymfollow,mode=3D755 0 0 >> sysfs /sys sysfs nosuid,nodev,noexec 0 0 >> diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/b= in/run-vmm >> index 94199434..6967dc55 100755 >> --- a/host/rootfs/image/usr/bin/run-vmm >> +++ b/host/rootfs/image/usr/bin/run-vmm >> @@ -93,6 +93,7 @@ bwrap >> --unshare-user >> --dev /dev >> --dev-bind /dev/kvm /dev/kvm >> + --dev-bind /dev/pts /dev/pts >> --dev-bind /dev/vfio /dev/vfio >> --tmpfs /dev/shm >> --tmpfs /tmp >>=20 >> base-commit: 57bf21eaf65ca5a42d18999ba65f96dcd338113c > > My understanding is that the only reason to use an actual PTY is > to forward dimension changes. Do we really need this, given that > vm-console is only for debugging? As long as the VM has xterm-resize > installed, it's possible to sync the dimensions manually. I'd prefer > to lose dimension change forwarding instead of weakening the sandbox. > > This is worse, but it's manageable. I worked in a Qubes VM for quite > a while this way, as I was writing a replacement for the GUI daemon > and so the in-VM GUI was not available when the custom code was not > running (or not working). > > A better (and, hopefully, straightforward) solution would be to > carry dimension information in-band using specific escape sequences. > This could either be supported natively in terminal emulators, or > could implemented by a simple proxy otherwise. Eventually I would like to just have a terminal emulator inside every VM, rather than exposing a host terminal emulator to who knows what weird escape sequences from the VM, so I don't think new protocols to transmit dimensions would be a good investment. In the meantime, though, I'd like previously working functionality back. Using a terminal emulator without size information is absolutely horrible, because line endings are messed up and long lines become very difficult to read correctly. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQQGoGac7QfI+H5ZtFCZddwkt31pFQUCajuZoAAKCRCZddwkt31p FQ8oAQD2tExNgtaFOg/nh5LjVXvJ4CIjbtKtI79VSFtoVUIMoAEA+FBdbspDuSLe rY1Qe9aryQEJF+tuX2KnOX0xrkTmKwk= =tKou -----END PGP SIGNATURE----- --=-=-=--