feat: krun_set_rootfs_read_only

include/libkrun.h

@@ -474,6 +474,19 @@ int32_t krun_set_kernel(uint32_t ctx_id,
                         const char *initramfs,
                         const char *cmdline);
 
+/**
+ * Sets the read-only flag for the kernel boot arguments. This results in the root
+ * filesystem being mounted read-only.
+ * Arguments:
+ *  "ctx_id"        - the configuration context ID.
+ *  "read_only"     - true when the root filesystem should be mounted read-only.
+ *
+ * Returns:
+ *  Zero on success or a negative error number on failure.
+*/
+int32_t krun_set_rootfs_read_only(uint32_t ctx_id,
+                                  bool read_only);
+
 /**
  * Sets environment variables to be configured in the context of the executable.
  *

src/libkrun/src/lib.rs

@@ -130,6 +130,7 @@ struct ContextConfig {
     vmr: VmResources,
     workdir: Option<String>,
     exec_path: Option<String>,
+    rootfs_read_only: bool,
     env: Option<String>,
     args: Option<String>,
     rlimits: Option<String>,
@@ -176,6 +177,17 @@ impl ContextConfig {
         }
     }
 
+    fn set_rootfs_read_only(&mut self, read_only: bool) {
+        self.rootfs_read_only = read_only;
+    }
+
+    fn get_rootfs_read_write(&self) -> String {
+        match &self.rootfs_read_only {
+            true => "ro".to_string(),
+            false => "rw".to_string(),
+        }
+    }
+
     fn set_env(&mut self, env: String) {
         self.env = Some(env);
     }
@@ -915,6 +927,21 @@ pub unsafe extern "C" fn krun_set_exec(
     KRUN_SUCCESS
 }
 
+#[allow(clippy::format_collect)]
+#[allow(clippy::missing_safety_doc)]
+#[no_mangle]
+pub unsafe extern "C" fn krun_set_rootfs_read_only(ctx_id: u32, read_only: bool) -> i32 {
+    match CTX_MAP.lock().unwrap().entry(ctx_id) {
+        Entry::Occupied(mut ctx_cfg) => {
+            let cfg = ctx_cfg.get_mut();
+            cfg.set_rootfs_read_only(read_only);
+        }
+        Entry::Vacant(_) => return -libc::ENOENT,
+    }
+
+    KRUN_SUCCESS
+}
+
 #[allow(clippy::format_collect)]
 #[allow(clippy::missing_safety_doc)]
 #[no_mangle]
@@ -1463,8 +1490,9 @@ pub extern "C" fn krun_start_enter(ctx_id: u32) -> i32 {
 
     let boot_source = BootSourceConfig {
         kernel_cmdline_prolog: Some(format!(
-            "{} init={} {} {} {} {}",
+            "{} {} init={} {} {} {} {}",
             DEFAULT_KERNEL_CMDLINE,
+            ctx_cfg.get_rootfs_read_write(),
             INIT_PATH,
             ctx_cfg.get_exec_path(),
             ctx_cfg.get_workdir(),

src/vmm/src/builder.rs

@@ -531,7 +531,9 @@ pub fn build_microvm(
     } else if let Some(cmdline) = &vm_resources.boot_config.kernel_cmdline_prolog {
         kernel_cmdline.insert_str(cmdline).unwrap();
     } else {
-        kernel_cmdline.insert_str(DEFAULT_KERNEL_CMDLINE).unwrap();
+        kernel_cmdline
+            .insert_str(format!("{DEFAULT_KERNEL_CMDLINE} rw"))
+            .unwrap();
     }
 
     #[cfg(not(feature = "tee"))]

src/vmm/src/vmm_config/boot_source.rs

@@ -5,10 +5,10 @@ use std::fmt::{Display, Formatter, Result};
 
 #[cfg(target_os = "linux")]
 pub const DEFAULT_KERNEL_CMDLINE: &str = "reboot=k panic=-1 panic_print=0 nomodule console=hvc0 \
-                                          rootfstype=virtiofs rw quiet no-kvmapf";
+                                          rootfstype=virtiofs quiet no-kvmapf";
 #[cfg(target_os = "macos")]
 pub const DEFAULT_KERNEL_CMDLINE: &str = "reboot=k panic=-1 panic_print=0 nomodule console=hvc0 \
-                                          rootfstype=virtiofs rw quiet no-kvmapf";
+                                          rootfstype=virtiofs quiet no-kvmapf";
 
 /// Strongly typed data structure used to configure the boot source of the
 /// microvm.