Re: [PATCH 2/2] host/rootfs: disable CONFIG_PROC_SCSI in kernel

[Demi Marie Obenour <demiobenour@gmail.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 2747 bytes --]

On 12/15/25 07:27, Alyssa Ross wrote:
> This is a legacy interface.  I doubt anything in Spectrum depends on
> it.  The previous approach of masking it out with Bubblewrap failed on
> aarch64, where it was already disabled in the kernel config.
> 
> Fixes: 62590b8 ("host/rootfs: Sandbox crosvm")
> Fixes: ec47d36 ("host/rootfs: Sandbox Cloud Hypervisor")
> Signed-off-by: Alyssa Ross <hi@alyssa.is>
> ---
> This also means the floodgates are now open for any other rootfs kernel 
> changes that anybody wants to propose.

I'll start by disabling non-AF_UNIX, non-AF_NETLINK networking!

>  host/rootfs/default.nix                                     | 6 +++++-
>  .../vm-services/template/data/service/vhost-user-gpu/run    | 2 --
>  host/rootfs/image/usr/bin/run-vmm                           | 2 --
>  3 files changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
> index 66aa366..26757ef 100644
> --- a/host/rootfs/default.nix
> +++ b/host/rootfs/default.nix
> @@ -49,7 +49,11 @@ let
>      system.stateVersion = trivial.release;
>    });
>  
> -  kernel = linux_latest;
> +  kernel = linux_latest.override {
> +    structuredExtraConfig = with lib.kernel; {
> +      SCSI_PROC_FS = no;
> +    };
> +  };
>  
>    appvm = callSpectrumPackage ../../img/app { inherit (foot) terminfo; };
>    netvm = callSpectrumPackage ../../vm/sys/net { inherit (foot) terminfo; };
> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
> index e063a82..bdd842e 100755
> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
> @@ -31,8 +31,6 @@ bwrap
>    --disable-userns
>    --proc /proc
>    --ro-bind /proc/sys /proc/sys
> -  --tmpfs /proc/scsi
> -  --remount-ro /proc/scsi
>    --tmpfs /proc/acpi
>    --remount-ro /proc/acpi
>    --tmpfs /proc/fs
> diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/usr/bin/run-vmm
> index e30b14c..d71f7eb 100755
> --- a/host/rootfs/image/usr/bin/run-vmm
> +++ b/host/rootfs/image/usr/bin/run-vmm
> @@ -104,8 +104,6 @@ bwrap
>    --bind /run /run
>    --proc /proc
>    --ro-bind /proc/sys /proc/sys
> -  --tmpfs /proc/scsi
> -  --remount-ro /proc/scsi
>    --tmpfs /proc/acpi
>    --remount-ro /proc/acpi
>    --tmpfs /proc/fs

Acked-by: Demi Marie Obenour <demiobenour@gmail.com>
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]