From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 2A8B812431; Mon, 08 Dec 2025 21:33:28 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id AC30D1241F; Mon, 08 Dec 2025 21:33:24 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_MISSING,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 Received: from fout-a6-smtp.messagingengine.com (fout-a6-smtp.messagingengine.com [103.168.172.149]) by atuin.qyliss.net (Postfix) with ESMTPS id 704271241E for ; Mon, 08 Dec 2025 21:33:23 +0000 (UTC) Received: from phl-compute-03.internal (phl-compute-03.internal [10.202.2.43]) by mailfout.phl.internal (Postfix) with ESMTP id 52AE2EC063B; Mon, 8 Dec 2025 16:33:21 -0500 (EST) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-03.internal (MEProxy); Mon, 08 Dec 2025 16:33:21 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alyssa.is; h=cc :cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1765229601; x=1765316001; bh=Yg19zLsCaC 2TBGWxaocaB/xS9arUqWhb+cROEVV8GmE=; b=iVIqou5s3kdoD6JUK7BSEboflr c4fU85v4pLt85iA59JjgDPek7HCCNs/daTd7BIPcTxgK+nvwiQjmJLR3zWmZxrHu pfz6/9f2om4YO3Kem97MluoHw0IZZThW+zdIHbive9y2uzH/LB3sn96PXQ9eqiuW FuwNWtikcb3rxQ6VKL8hoDeDVA9rAGl0RrnQHlHiMcm89K7HNh87e7m23AH+p0G5 5+6wzjUwINFwbyWY3/xYZTAg9sR5J8diAs2TbVq0XI5g+M1wrcutd0BhocsRanSl D4soAGN9LzTTXN+Rpgc0haoC3bQIB4nWvg43F/uXwFbQrBk6WSDX0Ch+Uy+w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t= 1765229601; x=1765316001; bh=Yg19zLsCaC2TBGWxaocaB/xS9arUqWhb+cR OEVV8GmE=; b=G/pfzsK4xSKPKzpMEJ1hueRrwQAcIrVxVyIUTvvC6qQ8qkfiqgn wmqyDmM3wzmMLhLGgPrgfEYCF4UU+QiEx9Aq+Ab/TYsV/0pfBYwMgCkGW14o6VxY S6U/zKOoTCJ7X6196QSgExE2Gc1kVP8BpQhXyrJmM/l/zv0voOpuX1k0EUDAz3W7 JHu+UKjzNktNAZk9QgvsN9OiZMdqDgku060eZzunrQ804R5YN5InD5Jr4unZsSbA m8FNeH2DVS3Er0W9X1T1ZZrm6QA+oKdiTSp86m3tdWTaLh1OsxNxmwDyiyG0qYSl Gtg8FD91aUIRZAlE/IuNGZK9igVgxNCXi6w== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefgedrtddtgddujeejjecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpuffrtefokffrpgfnqfghnecuuegr ihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjug hrpefhvfevufgjfhffkfggtgesghdtreertddtjeenucfhrhhomheptehlhihsshgrucft ohhsshcuoehhihesrghlhihsshgrrdhisheqnecuggftrfgrthhtvghrnhepteehvedugf ejgfehhfeijeduleekleejgedvkeeuuefhhfegvdevfeetveegteeinecuvehluhhsthgv rhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhephhhisegrlhihshhsrgdrih hspdhnsggprhgtphhtthhopedvpdhmohguvgepshhmthhpohhuthdprhgtphhtthhopegu vghmihhosggvnhhouhhrsehgmhgrihhlrdgtohhmpdhrtghpthhtohepuggvvhgvlhessh hpvggtthhruhhmqdhoshdrohhrgh X-ME-Proxy: Feedback-ID: i12284293:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Mon, 8 Dec 2025 16:33:20 -0500 (EST) Received: by fw12.qyliss.net (Postfix, from userid 1000) id BBE215C054F6; Mon, 08 Dec 2025 22:33:04 +0100 (CET) From: Alyssa Ross To: Demi Marie Obenour Subject: Re: [PATCH] img/app: fix running AppImages In-Reply-To: <83ff610d-c524-4963-9a21-402da0e7d593@gmail.com> References: <20251208211101.430776-1-hi@alyssa.is> <83ff610d-c524-4963-9a21-402da0e7d593@gmail.com> Date: Mon, 08 Dec 2025 22:33:02 +0100 Message-ID: <87h5u0lkvl.fsf@alyssa.is> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Message-ID-Hash: QA3UOXY5T5WRTAUT7QKBVJKPQV2PHGUN X-Message-ID-Hash: QA3UOXY5T5WRTAUT7QKBVJKPQV2PHGUN X-MailFrom: hi@alyssa.is X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: devel@spectrum-os.org X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Demi Marie Obenour writes: > On 12/8/25 16:11, Alyssa Ross wrote: >> The non-root user that applications run as can't mount FUSE >> filesystems. I don't want to introduce setuid or an IPC service just >> for running AppImages, although we could revisit if we find that >> applications themselves rely on being able to mount FUSE filesystems. >> For now, it'll be more efficient to use the in-kernel squashfs >> implementation anyway. >>=20 >> We do need to set a few environment variables normally set by the >> AppImage runtime, but as far as I can tell it doesn't do much more >> than this that applications could rely on. >>=20 >> This only works for type 2 AppImages, but I expect that's just about >> every AppImage nowadays, and if turns out not to be it shouldn't be >> too hard to support type 1. >>=20 >> Fixes: 8bfcbf9 ("img/app: run applications as non-root") >> Signed-off-by: Alyssa Ross >> --- >> img/app/Makefile | 2 +- >> img/app/image/etc/s6-rc/app/run | 11 +++++++++-- >> 2 files changed, 10 insertions(+), 3 deletions(-) >>=20 >> diff --git a/img/app/Makefile b/img/app/Makefile >> index ddfc8ef..7354f89 100644 >> --- a/img/app/Makefile >> +++ b/img/app/Makefile >> @@ -30,7 +30,7 @@ $(imgdir)/appvm/blk/root.img: ../../scripts/make-gpt.s= h ../../scripts/sfdisk-fie >> build/rootfs.erofs:root:5460386f-2203-4911-8694-91400125c604:root >> mv $@.tmp $@ >>=20=20 >> -DIRS =3D dev home/user run proc sys tmp \ >> +DIRS =3D dev home/user run mnt proc sys tmp \ >> etc/s6-linux-init/run-image/pipewire \ >> etc/s6-linux-init/run-image/service \ >> etc/s6-linux-init/run-image/user \ >> diff --git a/img/app/image/etc/s6-rc/app/run b/img/app/image/etc/s6-rc/a= pp/run >> index e05d4fe..e691a63 100755 >> --- a/img/app/image/etc/s6-rc/app/run >> +++ b/img/app/image/etc/s6-rc/app/run >> @@ -14,10 +14,17 @@ foreground { >> withstdinas -E type >> case $type { >> appimage { >> - if { modprobe fuse } >> + if { modprobe loop } >> + if { >> + backtick -E offset { /run/virtiofs/virtiofs0/config/run --appim= age-offset } >> + mount -o offset=3D${offset} /run/virtiofs/virtiofs0/config/run = /mnt >> + } >> s6-setuidgid user >> + export APPIMAGE /run/virtiofs/virtiofs0/config/run >> + export APPDIR /mnt >> + export ARGV0 /mnt/AppRun >> export LD_LIBRARY_PATH /lib64 >> - /run/virtiofs/virtiofs0/config/run >> + /mnt/AppRun >> } >> flatpak { >> s6-envdir -fnL /run/virtiofs/virtiofs0/config/params >>=20 >> base-commit: 5104fa720ce8b00612c5487fc47124fbf99e58c6 > > The kernel SquashFS implementation probably isn't hardened against > malicious inputs. I'd stick with the setuid binary for now, or write > an IPC service. Unlike the host, the guest doesn't have no_new_privs > as far as I know. Another option is to run the app as user namespace > root with CAP_SYS_ADMIN (but not CAP_NET_ADMIN or other capabilities). Since the only purpose of an application VM is to run an application, I'm not very worried about the kernel squashfs implementation. We do not trust guest kernels anyway. (The purpose of not running everything as root here is to make the system easier to understand and maintain, and to present a more normal environment for applications.) Setuid isn't as easy as that =E2=80=94 we'd need to do something like NixOS= 's wrappers mechanism to even have setuid binaries available. We could alternatively possibly copy a static binary to a tmpfs, but in these particular circumstances I think going through fuse is worse than letting the kernel do it anyway. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQQGoGac7QfI+H5ZtFCZddwkt31pFQUCaTdEDgAKCRCZddwkt31p FbtMAQCOCNjHzn4uBGlEXR2ULxKnDV1Ol4mUdHS8jIhtjOL1AwD8CsBdmP0y+3IN fNrk+r1uFiY2Nf6X5gd6edLfOsswEw4= =n+8e -----END PGP SIGNATURE----- --=-=-=--