From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 01BD83A5D; Wed, 15 Jul 2026 10:15:18 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 3F3CC3A9A; Wed, 15 Jul 2026 10:15:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_MISSING,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 Received: from fhigh-a1-smtp.messagingengine.com (fhigh-a1-smtp.messagingengine.com [103.168.172.152]) by atuin.qyliss.net (Postfix) with ESMTPS id E4AAF3A96 for ; Wed, 15 Jul 2026 10:15:09 +0000 (UTC) Received: from phl-compute-04.internal (phl-compute-04.internal [10.202.2.44]) by mailfhigh.phl.internal (Postfix) with ESMTP id 1C27B1400088; Wed, 15 Jul 2026 06:15:08 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-04.internal (MEProxy); Wed, 15 Jul 2026 06:15:08 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alyssa.is; h=cc :cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm1; t=1784110508; x=1784196908; bh=wob2qMIMsh VhX3cm03DiqTVs5whraW3qItyQUN4Wy4E=; b=Wk5n+Rmpg+YrcJV/QaHNqcHMEt +TfK+sxAjUt/ebmELYp4cknmKWcAZyupxciG2/VL5TjeGA2zzsHCcSrYP1RBxf9t qpZOzkHgoNsnucwk4NT8RZgC5qwS7pBmm0N6YQlEQNFUGrrYSpPADps4LR/BSNJu t+pVADX9xLpEWDabkTeaf84Z1nhj+5MDNVvEYDXJo/z+4TRM+BqxDXDAuHFqhCpc V0Y5AkEyV4QSa+wAQg+/EfSjLLBl9Va3o094KgAEn4nv2izfLUAoxVLuDQkHvcr3 RUOULttH6XoaqO5JGo0oTKcwD7vukRW9TEUsjX6MwdDjXq401/TKzYUg2KCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t= 1784110508; x=1784196908; bh=wob2qMIMshVhX3cm03DiqTVs5whraW3qIty QUN4Wy4E=; b=LzueiM8CCdvcCL6HVK7886WW3FtBv8qk/mxiNWnG+jksmRYZ2ia EOeXdCRXZmdCts2NXjR8kuJ5KVLb2A0Sx8H3EDC13eWZYfG5jZPMG5Hppu5b27HF fETvLMbvyTtMhJO7TRYnwpEoy/UZpM7fmjwdL49YR8D9s09sXOk8T+Qg6aFvStyU ijXigHGRVTcpL5P+zdCUVAESUPcrw3KiQDGIgmfXSwuyGZrbo4xCKaGkUz57+W/s mJohCZK+HK860eW3tUULzFb1xI3G/a0eix09AaVdlrJwZFDslYhs8C/8xBaamLt0 q3FDu9hH1RaNh9FYANco7+0w116utF8KoUg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTGHxx+JR4F1CezZ1exnks6yuHcTknkeYz5HXUAFSj34XwpWnj11K7ZyD7+WQnKoCK 4Un7/6hn9G4wJxx3gF0Zjlg3LvzG5x7pSvj53yv+F+5jiiwtTFTBrjUvYHqhc0VQlS7bgm +99QoFwz5ipTM3sJuCTyitkoRJbNl3VWTNIAyD7FkZSM1x/20ZT6frMRRQGmll4wS0dY+d IQJST6qRuhvSfOm8r5m/RqS19dJV995R7xGwm3vJa3fvjfWRJWmMjwk0xWo1RkVgtf9tMD PBgPBBq008xAbVFB1OdIWwpnNG6+MSWrzoHW9YoNWzVHoTrqcKZsaszvU7GxUyRYcow2aY 07/noXXDsFShbh4pZlQf8Y/wU/ulHEmcHsLKn81N+sDWvTqfhHOsi+87wX9LMZ8twBbhQ2 Kj2oviSwIyXZR8KTcoqQr9jtFXdAmgjwPIKibQcSuWgBzHVdVvs+V2Pvj7pR8hsAtzgFgv xrc1SD3ERe8j09cFVvpyMb0Fjx8YTaOAZgoCz+K+R33QOwwTFobPpaF7FbmyHXLi7c9f68 7OMv1MutohyBDHiwHpMkq5sp1qfdK9D7ujIyIZAvVDyJtv1uh8lCJKqms62Y3JeTkKyQpR ml2gMvVadkX4NZ/9/sh14ebG3T/mVizVBIk6Nub2uN5KmV8Jyrg7LjOcz0nQ X-ME-Proxy: Feedback-ID: i12284293:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 15 Jul 2026 06:15:07 -0400 (EDT) Received: by mbp.qyliss.net (Postfix, from userid 1000) id 7A6AC89429CB; Wed, 15 Jul 2026 12:15:04 +0200 (CEST) From: Alyssa Ross To: Demi Marie Obenour Subject: Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace In-Reply-To: <6903a8b2-0932-4445-bf60-8a023e2f43c6@gmail.com> References: <20260709-s6-pid-namespaces-v1-1-61a56abd1e7c@gmail.com> <87ldbiaoyh.fsf@alyssa.is> <47d40c5e-ef44-4101-857e-3f656f1d14bf@gmail.com> <87jyqz1cwq.fsf@alyssa.is> <6903a8b2-0932-4445-bf60-8a023e2f43c6@gmail.com> Date: Wed, 15 Jul 2026 12:15:03 +0200 Message-ID: <87ik6g4l08.fsf@alyssa.is> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Message-ID-Hash: M2JTTQPKVD3Y6FP7SJ5JLZ3XMIK7VCNU X-Message-ID-Hash: M2JTTQPKVD3Y6FP7SJ5JLZ3XMIK7VCNU X-MailFrom: hi@alyssa.is X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Spectrum OS Development X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Demi Marie Obenour writes: > On 7/13/26 05:01, Alyssa Ross wrote: >> Demi Marie Obenour writes: >>=20 >>> On 7/10/26 10:39, Alyssa Ross wrote: >>>> Demi Marie Obenour writes: >>>> >>>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm= -services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/= s6-linux-init/run-image/service/vm-services/template/data/service/vhost-use= r-gpu/run >>>>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c= 0bfa546590b9308eb9c 100755 >>>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-servic= es/template/data/service/vhost-user-gpu/run >>>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-servic= es/template/data/service/vhost-user-gpu/run >>>>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland >>>>> s6-ipcserverd -1c 1 >>>>>=20=20 >>>>> bwrap >>>>> - --unshare-all >>>>> - # --unshare-all only implies --unshare-user-try. >>>>> - # Make this more than a "try". >>>>> + --unshare-net >>>>> + --unshare-ipc >>>>> + --unshare-uts >>>>> + --unshare-cgroup >>>>> --unshare-user >>>>> --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY >>>>> --ro-bind /usr /usr >>>> >>>> There's a subtle behaviour change here. The pid namespace is reused >>>> between runs of crosvm, because if crosvm exits, s6-ipcserverd will st= ay >>>> running and wait for the next connection, then respawn crosvm. It's >>>> done this way because crosvm has made the unusual decision to support >>>> being started on a connected socket, rather than a listening socket li= ke >>>> one might expect. Is that okay? I'd guess yes, but I want to check >>>> with you! >>> >>> It's less robust than I would like, but there is no reason one cannot >>> have both s6-supervise and bubblewrap create PID namespaces. That's >>> the approach I would go with. >>=20 >> What's the point of the intermediate PID namespace? > > Ensure that there are no stale Cloud Hypervisor processes left behind. > Specifically, the PTY watcher ought to be moved to the main process > if there is only one PTY, but it=E2=80=99s currently a separate process. Huh? This is a discussion about the vhost-user-gpu service, which runs crosvm via s6-ipcserver. Cloud Hypervisor and PTY watchers are not involved. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQRV/neXydHjZma5XLJbRZGEIw/wogUCalddpwAKCRBbRZGEIw/w oiMKAP9aXnpZDMyqnje+5HmHQBWyEOVC3msaII3mXqOFV3KiiQD+NC8N5VBAebWQ CENOUm5sep0+HauRFyEH8Z/Zzn+Vkgo= =qHcY -----END PGP SIGNATURE----- --=-=-=--