Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace

[Alyssa Ross <hi@alyssa.is>]

[-- Attachment #1: Type: text/plain, Size: 1838 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 7/10/26 10:39, Alyssa Ross wrote:
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>> 
>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755
>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland
>>>  s6-ipcserverd -1c 1
>>>  
>>>  bwrap
>>> -  --unshare-all
>>> -  # --unshare-all only implies --unshare-user-try.
>>> -  # Make this more than a "try".
>>> +  --unshare-net
>>> +  --unshare-ipc
>>> +  --unshare-uts
>>> +  --unshare-cgroup
>>>    --unshare-user
>>>    --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
>>>    --ro-bind /usr /usr
>> 
>> There's a subtle behaviour change here.  The pid namespace is reused
>> between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay
>> running and wait for the next connection, then respawn crosvm.  It's
>> done this way because crosvm has made the unusual decision to support
>> being started on a connected socket, rather than a listening socket like
>> one might expect.  Is that okay?  I'd guess yes, but I want to check
>> with you!
>
> It's less robust than I would like, but there is no reason one cannot
> have both s6-supervise and bubblewrap create PID namespaces.  That's
> the approach I would go with.

What's the point of the intermediate PID namespace?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]