[PATCH 2/3] host/rootfs: put router app sockets in own dir

Alyssa Ross
2025-12-09T00:38:45Z

When we have different Cloud Hypervisor instances running as different
users, it makes sense not to permit them to see into each other's
/run/vm directories. That means we'll need somewhere else to store
router app sockets, which should be accessible by VMs other than the
driver VM associated with the router.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
host/rootfs/Makefile | 1 +
.../template/data/service/spectrum-router/run | 2 +-
tools/start-vmm/lib.rs | 14 ++++++++++++--
3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
index 7bec125..831fdc1 100644
--- a/host/rootfs/Makefile
+++ b/host/rootfs/Makefile
@@ -14,6 +14,7 @@ DIRS = \
dev \
etc/s6-linux-init/env \
etc/s6-linux-init/run-image/configs \
+ etc/s6-linux-init/run-image/router \
etc/s6-linux-init/run-image/sd-notify-wrapper \
etc/s6-linux-init/run-image/service/serial-getty/instance \
etc/s6-linux-init/run-image/service/serial-getty/instances \
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
index 61375ca..c79747c 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
@@ -8,7 +8,7 @@ importas -i VM VM
s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-driver.sock
fdmove -c 3 0

-s6-ipcserver-socketbinder -a 0770 /run/vm/by-id/${VM}/router-app.sock
+s6-ipcserver-socketbinder -a 0770 /run/router/${VM}
fdmove -c 4 0

# Notify readiness.
diff --git a/tools/start-vmm/lib.rs b/tools/start-vmm/lib.rs
index b44e037..2ee87bd 100644
--- a/tools/start-vmm/lib.rs
+++ b/tools/start-vmm/lib.rs
@@ -1,5 +1,5 @@
// SPDX-License-Identifier: EUPL-1.2+
-// SPDX-FileCopyrightText: 2022-2024 Alyssa Ross <hi@alyssa.is>
+// SPDX-FileCopyrightText: 2022-2025 Alyssa Ross <hi@alyssa.is>
// SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>

mod ch;
@@ -117,6 +117,16 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> {
));
}

+ let provider_path = Path::new("/run/vm/by-name").join(&provider_name);
+ let provider_target = provider_path
+ .read_link()
+ .map_err(|e| format!("dereferencing {provider_path:?}: {e}"))?;
+ let provider_id = provider_target
+ .file_name()
+ .ok_or_else(|| format!("{provider_path:?} target has no file name"))?
+ .to_str()
+ .ok_or_else(|| format!("{provider_target:?} has non-UTF-8 basename"))?;
+
let mut hasher = std::hash::DefaultHasher::new();
vm_name.hash(&mut hasher);
let id_hashed = hasher.finish();
@@ -132,7 +142,7 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> {

Ok(NetConfig {
vhost_user: true,
- vhost_socket: format!("/run/vm/by-name/{provider_name}/router-app.sock"),
+ vhost_socket: format!("/run/router/{provider_id}"),
id: provider_name,
mac,
})
--
2.51.0