From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 36B371A2D; Sat, 11 Jul 2026 19:04:41 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id E01C71A06; Sat, 11 Jul 2026 19:04:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yw1-x1135.google.com (mail-yw1-x1135.google.com [IPv6:2607:f8b0:4864:20::1135]) by atuin.qyliss.net (Postfix) with ESMTPS id 5AE9F1A04 for ; Sat, 11 Jul 2026 19:04:38 +0000 (UTC) Received: by mail-yw1-x1135.google.com with SMTP id 00721157ae682-806449d108aso30371817b3.2 for ; Sat, 11 Jul 2026 12:04:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783796672; x=1784401472; darn=spectrum-os.org; h=content-type:autocrypt:subject:from:to:content-language:user-agent :mime-version:date:message-id:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Ec6gzrpeyjYlDxVxge4oVSBew/L0vSJUKtrekE1AhoM=; b=Ie4ZKvCNkl3LDjNYTyeyhHE/fvMo0vqNRDH2JKzWLHe13cEq2lhVRneT87go1FPH79 /WIuIpzd09jXPzGrz6Ixyjx2zwn4qo/ncdZMeZ5QioHevMLtQgfbhPQLe66WqtEAOoUq C8Q+ZZOFIpehyezjFbPECOfm4xE1JwufyauYoSd68mqxiH3axjUOvxmp9VNR/XNuGiSc pnyQOBvHVgCEvMsTySoPUudsgtn1a3LSH5aJ+La8sp7z2ZgeXMoVchrjwqIBR8OYipcv 8kZcr6dDfr9Lx53i94Ke+CN3wCHbaCewTUe26BstVZkXermBl7Xr9qLrpQIIf2vLW192 1wqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783796672; x=1784401472; h=content-type:autocrypt:subject:from:to:content-language:user-agent :mime-version:date:message-id:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=Ec6gzrpeyjYlDxVxge4oVSBew/L0vSJUKtrekE1AhoM=; b=Mzj0g6nexas8vW5wRJTYHffFobzHgB9YYDeH2Z8vi5lXgRoSQCi6gpbfMfYrVFYTBJ 9nh5YGowEctT7tUPnuJszZXw0kt5F/ZNZHVx7p8AvwYZCmwbsCyMipRW1Ha8pd9XbYml sIXd7SDWHzSMxheuE2ZwemZbjdt9+KT75E2TPGRbQaRDksnLIBTJ5X8gyf3Nb9reu5C7 takUlWUI3GDkGu1tRsFQVT8Na5xK+WrZ43w7YREvw/hh8xCKQmJk5b71xyjumsKTzlHH rmk4ctHejQ5TaXx7P5G6HoaX5tTsJ1/69Tj8ykqrypxD7ToQPTB2AyFICtZu7ayWMCbu EFXA== X-Gm-Message-State: AOJu0YwFnDS1XVaL68Yw4ZDM55MfGxXxr76u1aUnE/FzjHSyoR9SB2Sp TrCXAUFj60XP7/JGIV5QGEy8YAvATUVprVIgCEeQvytFZu9nxlxvZAV8jDTNhA== X-Gm-Gg: AfdE7cmKOgVz/HpXBXvOB1bPGWCHlbVVlhF7ZFnAxwskXW/NfNUdv9fvRNoMamLGob4 KlwcqkFpapGRXakibPIwRv6yWnFq9Viz81QpO5y3Thc+hz90A/9fcLILHIlDWpClT0DXJMzYXtF U2iWabXiwZ8OJB76N7oBjp3U6Dk5LCli5O+BTxob+pb3BkieW2+YzV0jmY6yvE9VMzDK2ch/zNo ANc3RaQVbD3SGar6MtVHSB72iFLqPmmQScGR1MIOt8kbhRquJOyWX2Np82Ip+fw6JoDj9t0c6xc 26omP1XnrCUJJZvpN3vyK9DeziEh6HaV2WddWpFcVyoyO+kqjtmn1HXlQcnJiA9kHg2bZiv0X/J V/Elk3NJm0Mn8JU3c9v1N96GdhhZAwKM/Gvqh0DwuVreF9p3cIxIL3v3Gq4YcwhARiZgOfV6KME 2C+xi1B5Zt31vZalY= X-Received: by 2002:a05:690c:c4d3:b0:81e:6c2e:f113 with SMTP id 00721157ae682-81e90159a5cmr27327577b3.36.1783796672055; Sat, 11 Jul 2026 12:04:32 -0700 (PDT) Received: from [10.138.10.6] ([185.98.168.14]) by smtp.gmail.com with ESMTPSA id 00721157ae682-81e6c1a44d6sm77219567b3.31.2026.07.11.12.04.29 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 11 Jul 2026 12:04:30 -0700 (PDT) Message-ID: Date: Sat, 11 Jul 2026 15:04:19 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: Spectrum OS Development From: Demi Marie Obenour Subject: Why is /run/vm/by-id/${VM} writable by the VMM? Autocrypt: addr=demiobenour@gmail.com; keydata= xsFNBFp+A0oBEADffj6anl9/BHhUSxGTICeVl2tob7hPDdhHNgPR4C8xlYt5q49yB+l2nipd aq+4Gk6FZfqC825TKl7eRpUjMriwle4r3R0ydSIGcy4M6eb0IcxmuPYfbWpr/si88QKgyGSV Z7GeNW1UnzTdhYHuFlk8dBSmB1fzhEYEk0RcJqg4AKoq6/3/UorR+FaSuVwT7rqzGrTlscnT DlPWgRzrQ3jssesI7sZLm82E3pJSgaUoCdCOlL7MMPCJwI8JpPlBedRpe9tfVyfu3euTPLPx wcV3L/cfWPGSL4PofBtB8NUU6QwYiQ9Hzx4xOyn67zW73/G0Q2vPPRst8LBDqlxLjbtx/WLR 6h3nBc3eyuZ+q62HS1pJ5EvUT1vjyJ1ySrqtUXWQ4XlZyoEFUfpJxJoN0A9HCxmHGVckzTRl 5FMWo8TCniHynNXsBtDQbabt7aNEOaAJdE7to0AH3T/Bvwzcp0ZJtBk0EM6YeMLtotUut7h2 Bkg1b//r6bTBswMBXVJ5H44Qf0+eKeUg7whSC9qpYOzzrm7+0r9F5u3qF8ZTx55TJc2g656C 9a1P1MYVysLvkLvS4H+crmxA/i08Tc1h+x9RRvqba4lSzZ6/Tmt60DPM5Sc4R0nSm9BBff0N m0bSNRS8InXdO1Aq3362QKX2NOwcL5YaStwODNyZUqF7izjK4QARAQABzTxEZW1pIE1hcmll IE9iZW5vdXIgKGxvdmVyIG9mIGNvZGluZykgPGRlbWlvYmVub3VyQGdtYWlsLmNvbT7CwXgE EwECACIFAlp+A0oCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJELKItV//nCLBhr8Q AK/xrb4wyi71xII2hkFBpT59ObLN+32FQT7R3lbZRjVFjc6yMUjOb1H/hJVxx+yo5gsSj5LS 9AwggioUSrcUKldfA/PKKai2mzTlUDxTcF3vKx6iMXKA6AqwAw4B57ZEJoMM6egm57TV19kz PMc879NV2nc6+elaKl+/kbVeD3qvBuEwsTe2Do3HAAdrfUG/j9erwIk6gha/Hp9yZlCnPTX+ VK+xifQqt8RtMqS5R/S8z0msJMI/ajNU03kFjOpqrYziv6OZLJ5cuKb3bZU5aoaRQRDzkFIR 6aqtFLTohTo20QywXwRa39uFaOT/0YMpNyel0kdOszFOykTEGI2u+kja35g9TkH90kkBTG+a EWttIht0Hy6YFmwjcAxisSakBuHnHuMSOiyRQLu43ej2+mDWgItLZ48Mu0C3IG1seeQDjEYP tqvyZ6bGkf2Vj+L6wLoLLIhRZxQOedqArIk/Sb2SzQYuxN44IDRt+3ZcDqsPppoKcxSyd1Ny 2tpvjYJXlfKmOYLhTWs8nwlAlSHX/c/jz/ywwf7eSvGknToo1Y0VpRtoxMaKW1nvH0OeCSVJ itfRP7YbiRVc2aNqWPCSgtqHAuVraBRbAFLKh9d2rKFB3BmynTUpc1BQLJP8+D5oNyb8Ts4x Xd3iV/uD8JLGJfYZIR7oGWFLP4uZ3tkneDfYzsFNBFp+A0oBEAC9ynZI9LU+uJkMeEJeJyQ/ 8VFkCJQPQZEsIGzOTlPnwvVna0AS86n2Z+rK7R/usYs5iJCZ55/JISWd8xD57ue0eB47bcJv VqGlObI2DEG8TwaW0O0duRhDgzMEL4t1KdRAepIESBEA/iPpI4gfUbVEIEQuqdqQyO4GAe+M kD0Hy5JH/0qgFmbaSegNTdQg5iqYjRZ3ttiswalql1/iSyv1WYeC1OAs+2BLOAT2NEggSiVO txEfgewsQtCWi8H1SoirakIfo45Hz0tk/Ad9ZWh2PvOGt97Ka85o4TLJxgJJqGEnqcFUZnJJ riwoaRIS8N2C8/nEM53jb1sH0gYddMU3QxY7dYNLIUrRKQeNkF30dK7V6JRH7pleRlf+wQcN fRAIUrNlatj9TxwivQrKnC9aIFFHEy/0mAgtrQShcMRmMgVlRoOA5B8RTulRLCmkafvwuhs6 dCxN0GNAORIVVFxjx9Vn7OqYPgwiofZ6SbEl0hgPyWBQvE85klFLZLoj7p+joDY1XNQztmfA rnJ9x+YV4igjWImINAZSlmEcYtd+xy3Li/8oeYDAqrsnrOjb+WvGhCykJk4urBog2LNtcyCj kTs7F+WeXGUo0NDhbd3Z6AyFfqeF7uJ3D5hlpX2nI9no/ugPrrTVoVZAgrrnNz0iZG2DVx46 x913pVKHl5mlYQARAQABwsFfBBgBAgAJBQJafgNKAhsMAAoJELKItV//nCLBwNIP/AiIHE8b oIqReFQyaMzxq6lE4YZCZNj65B/nkDOvodSiwfwjjVVE2V3iEzxMHbgyTCGA67+Bo/d5aQGj gn0TPtsGzelyQHipaUzEyrsceUGWYoKXYyVWKEfyh0cDfnd9diAm3VeNqchtcMpoehETH8fr RHnJdBcjf112PzQSdKC6kqU0Q196c4Vp5HDOQfNiDnTf7gZSj0BraHOByy9LEDCLhQiCmr+2 E0rW4tBtDAn2HkT9uf32ZGqJCn1O+2uVfFhGu6vPE5qkqrbSE8TG+03H8ecU2q50zgHWPdHM OBvy3EhzfAh2VmOSTcRK+tSUe/u3wdLRDPwv/DTzGI36Kgky9MsDC5gpIwNbOJP2G/q1wT1o Gkw4IXfWv2ufWiXqJ+k7HEi2N1sree7Dy9KBCqb+ca1vFhYPDJfhP75I/VnzHVssZ/rYZ9+5 1yDoUABoNdJNSGUYl+Yh9Pw9pE3Kt4EFzUlFZWbE4xKL/NPno+z4J9aWemLLszcYz/u3XnbO vUSQHSrmfOzX3cV4yfmjM5lewgSstoxGyTx2M8enslgdXhPthZlDnTnOT+C+OTsh8+m5tos8 HQjaPM01MKBiAqdPgksm1wu2DrrwUi6ChRVTUBcj6+/9IJ81H2P2gJk3Ls3AVIxIffLoY34E +MYSfkEjBz0E8CLOcAw7JIwAaeBT Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------Dlbd2TlFRAHCFV5d6hqbtcje" Message-ID-Hash: 6Z7GIYEGLJKHUFVKCWXW5JYVPWA2HM4K X-Message-ID-Hash: 6Z7GIYEGLJKHUFVKCWXW5JYVPWA2HM4K X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Hits: member-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; emergency X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------Dlbd2TlFRAHCFV5d6hqbtcje Content-Type: multipart/mixed; boundary="------------VnjvWvgAwDiw5owg0lGaBoqd"; protected-headers="v1"; hp="clear" Message-ID: Date: Sat, 11 Jul 2026 15:04:19 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: Spectrum OS Development From: Demi Marie Obenour Subject: Why is /run/vm/by-id/${VM} writable by the VMM? Autocrypt: addr=demiobenour@gmail.com; keydata= xsFNBFp+A0oBEADffj6anl9/BHhUSxGTICeVl2tob7hPDdhHNgPR4C8xlYt5q49yB+l2nipd aq+4Gk6FZfqC825TKl7eRpUjMriwle4r3R0ydSIGcy4M6eb0IcxmuPYfbWpr/si88QKgyGSV Z7GeNW1UnzTdhYHuFlk8dBSmB1fzhEYEk0RcJqg4AKoq6/3/UorR+FaSuVwT7rqzGrTlscnT DlPWgRzrQ3jssesI7sZLm82E3pJSgaUoCdCOlL7MMPCJwI8JpPlBedRpe9tfVyfu3euTPLPx wcV3L/cfWPGSL4PofBtB8NUU6QwYiQ9Hzx4xOyn67zW73/G0Q2vPPRst8LBDqlxLjbtx/WLR 6h3nBc3eyuZ+q62HS1pJ5EvUT1vjyJ1ySrqtUXWQ4XlZyoEFUfpJxJoN0A9HCxmHGVckzTRl 5FMWo8TCniHynNXsBtDQbabt7aNEOaAJdE7to0AH3T/Bvwzcp0ZJtBk0EM6YeMLtotUut7h2 Bkg1b//r6bTBswMBXVJ5H44Qf0+eKeUg7whSC9qpYOzzrm7+0r9F5u3qF8ZTx55TJc2g656C 9a1P1MYVysLvkLvS4H+crmxA/i08Tc1h+x9RRvqba4lSzZ6/Tmt60DPM5Sc4R0nSm9BBff0N m0bSNRS8InXdO1Aq3362QKX2NOwcL5YaStwODNyZUqF7izjK4QARAQABzTxEZW1pIE1hcmll IE9iZW5vdXIgKGxvdmVyIG9mIGNvZGluZykgPGRlbWlvYmVub3VyQGdtYWlsLmNvbT7CwXgE EwECACIFAlp+A0oCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJELKItV//nCLBhr8Q AK/xrb4wyi71xII2hkFBpT59ObLN+32FQT7R3lbZRjVFjc6yMUjOb1H/hJVxx+yo5gsSj5LS 9AwggioUSrcUKldfA/PKKai2mzTlUDxTcF3vKx6iMXKA6AqwAw4B57ZEJoMM6egm57TV19kz PMc879NV2nc6+elaKl+/kbVeD3qvBuEwsTe2Do3HAAdrfUG/j9erwIk6gha/Hp9yZlCnPTX+ VK+xifQqt8RtMqS5R/S8z0msJMI/ajNU03kFjOpqrYziv6OZLJ5cuKb3bZU5aoaRQRDzkFIR 6aqtFLTohTo20QywXwRa39uFaOT/0YMpNyel0kdOszFOykTEGI2u+kja35g9TkH90kkBTG+a EWttIht0Hy6YFmwjcAxisSakBuHnHuMSOiyRQLu43ej2+mDWgItLZ48Mu0C3IG1seeQDjEYP tqvyZ6bGkf2Vj+L6wLoLLIhRZxQOedqArIk/Sb2SzQYuxN44IDRt+3ZcDqsPppoKcxSyd1Ny 2tpvjYJXlfKmOYLhTWs8nwlAlSHX/c/jz/ywwf7eSvGknToo1Y0VpRtoxMaKW1nvH0OeCSVJ itfRP7YbiRVc2aNqWPCSgtqHAuVraBRbAFLKh9d2rKFB3BmynTUpc1BQLJP8+D5oNyb8Ts4x Xd3iV/uD8JLGJfYZIR7oGWFLP4uZ3tkneDfYzsFNBFp+A0oBEAC9ynZI9LU+uJkMeEJeJyQ/ 8VFkCJQPQZEsIGzOTlPnwvVna0AS86n2Z+rK7R/usYs5iJCZ55/JISWd8xD57ue0eB47bcJv VqGlObI2DEG8TwaW0O0duRhDgzMEL4t1KdRAepIESBEA/iPpI4gfUbVEIEQuqdqQyO4GAe+M kD0Hy5JH/0qgFmbaSegNTdQg5iqYjRZ3ttiswalql1/iSyv1WYeC1OAs+2BLOAT2NEggSiVO txEfgewsQtCWi8H1SoirakIfo45Hz0tk/Ad9ZWh2PvOGt97Ka85o4TLJxgJJqGEnqcFUZnJJ riwoaRIS8N2C8/nEM53jb1sH0gYddMU3QxY7dYNLIUrRKQeNkF30dK7V6JRH7pleRlf+wQcN fRAIUrNlatj9TxwivQrKnC9aIFFHEy/0mAgtrQShcMRmMgVlRoOA5B8RTulRLCmkafvwuhs6 dCxN0GNAORIVVFxjx9Vn7OqYPgwiofZ6SbEl0hgPyWBQvE85klFLZLoj7p+joDY1XNQztmfA rnJ9x+YV4igjWImINAZSlmEcYtd+xy3Li/8oeYDAqrsnrOjb+WvGhCykJk4urBog2LNtcyCj kTs7F+WeXGUo0NDhbd3Z6AyFfqeF7uJ3D5hlpX2nI9no/ugPrrTVoVZAgrrnNz0iZG2DVx46 x913pVKHl5mlYQARAQABwsFfBBgBAgAJBQJafgNKAhsMAAoJELKItV//nCLBwNIP/AiIHE8b oIqReFQyaMzxq6lE4YZCZNj65B/nkDOvodSiwfwjjVVE2V3iEzxMHbgyTCGA67+Bo/d5aQGj gn0TPtsGzelyQHipaUzEyrsceUGWYoKXYyVWKEfyh0cDfnd9diAm3VeNqchtcMpoehETH8fr RHnJdBcjf112PzQSdKC6kqU0Q196c4Vp5HDOQfNiDnTf7gZSj0BraHOByy9LEDCLhQiCmr+2 E0rW4tBtDAn2HkT9uf32ZGqJCn1O+2uVfFhGu6vPE5qkqrbSE8TG+03H8ecU2q50zgHWPdHM OBvy3EhzfAh2VmOSTcRK+tSUe/u3wdLRDPwv/DTzGI36Kgky9MsDC5gpIwNbOJP2G/q1wT1o Gkw4IXfWv2ufWiXqJ+k7HEi2N1sree7Dy9KBCqb+ca1vFhYPDJfhP75I/VnzHVssZ/rYZ9+5 1yDoUABoNdJNSGUYl+Yh9Pw9pE3Kt4EFzUlFZWbE4xKL/NPno+z4J9aWemLLszcYz/u3XnbO vUSQHSrmfOzX3cV4yfmjM5lewgSstoxGyTx2M8enslgdXhPthZlDnTnOT+C+OTsh8+m5tos8 HQjaPM01MKBiAqdPgksm1wu2DrrwUi6ChRVTUBcj6+/9IJ81H2P2gJk3Ls3AVIxIffLoY34E +MYSfkEjBz0E8CLOcAw7JIwAaeBT --------------VnjvWvgAwDiw5owg0lGaBoqd Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable This seems to be a fairly significant hole in the VMM's sandbox. Various code operates in that directory and isn't secure against symlink attacks. Does the VMM really need write access to that directory? Could it be given access to a subdirectory that is mounted "nosymfollow"? --=20 Sincerely, Demi Marie Obenour (she/her/hers) --------------VnjvWvgAwDiw5owg0lGaBoqd-- --------------Dlbd2TlFRAHCFV5d6hqbtcje Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEopQtqVJW1aeuo9/sszaHOrMp8lMFAmpSk7QACgkQszaHOrMp 8lP2FRAAp4nWnqYEUoVLWcOog0iNHMz6dK2pAemp8E6eyLtYge3/UKHQvw58eRJg MNBbf5EXNaWIW3y8JNmkb3fzsl5mSkLsDaQJyJraKyySn3SAEfA/YLP1tl8Zl23w ssqaUXjvIotSsJKG8UatZ9/YrKDaPyGWJLKScyRxFjFYnjNQMkNmTXj8FRxz9N7o 4MVbRrzBfaeOPO3eQkv7Eswg+jjIXhPM83M3oQNzb0LO6uCD2E45Gf2qJxI69RB5 AD4VUvSC4zTJdAgM4meNDkWkrXHxtx5wz9Fw7f18Cs5cf8HMIlZEJW+VVpD1AbSG PQMNwUKUHYA7/2WxdPAQU0uIfQtYa72cDYTbAI/Y1CANLUt1afEDjgwmnVmpY/ce F+aHE9k27bBhDHzui/qbM6kxL8/c3wXrSmSiTMBawBtxW6xZjaqT1npAVTT3LNfH 7eoh/9XqZwR/OFMymL39bZv2pawIeHh/lCkL+AYpuJnEWytIRXbcdbRhHChItWlp kuACPUfVlm2GZb5wjq6VQdiZIyswVWWb1tUKuq+NoSfIPnMurkxJbxP9c5XFwmye 18ihu13+VxpkF6DC5bpL1qPISd1M+mOYiyaW0Gb1NNoZN7x2gGJYdgmbYmnJDtmD 8Ae8e/XxCDm2avWVUnJEiSyR9ghYcrCBLqGDiI+DYjPkhW4b2EA= =1l2F -----END PGP SIGNATURE----- --------------Dlbd2TlFRAHCFV5d6hqbtcje--