From c09c7e7278edd68ec37707551aeae339dea0243d Mon Sep 17 00:00:00 2001 From: zbarsky-openai Date: Mon, 24 Aug 2026 17:27:31 -0400 Subject: [PATCH] vm: enable /proc/sys in both guest kernel configurations actiond's minimal `allnoconfig` Linux kernels omit `/proc/sys` altogether. A real actiond-executed probe currently fails with: ```text {"sysctl": "/proc/sys/kernel/hostname", "errno": 2} FileNotFoundError: [Errno 2] No such file or directory: '/proc/sys/kernel/hostname' ``` Enable `CONFIG_PROC_SYSCTL=y` in both ARM64 and x86_64 kernel configurations. Linux's existing `PROC_SYSCTL` option selects the underlying `SYSCTL` support; no runtime package is added. Existing procfs mounts then expose the standard kernel settings interface while retaining the current unprivileged action, seccomp, Landlock, and disabled-BPF-JIT protections. Validated by rebuilding the ARM64 guest through actiond itself (974 actual remote actions; `0807aacd-7c6d-43ca-a75c-271eebdb6ceb`), booting that kernel, and confirming `/proc/sys/kernel/hostname` is readable while nested seccomp filter installation still succeeds (`d40ec092-87c4-4a13-a4a7-5b92e9cb1a0f`). The production sandbox suite then passed with 191 tests and 10 expected skips under the real actiond executor (`f6788d1f-8b3d-459c-87b8-bf5efd588496`). --- vm/linux.config | 1 + vm/linux_x86_64.config | 1 + 2 files changed, 2 insertions(+) diff --git a/vm/linux.config b/vm/linux.config index 69abcd9..1909ea8 100644 --- a/vm/linux.config +++ b/vm/linux.config @@ -51,6 +51,7 @@ CONFIG_PCI_HOST_GENERIC=y CONFIG_PID_NS=y CONFIG_POSIX_TIMERS=y CONFIG_PROC_FS=y +CONFIG_PROC_SYSCTL=y CONFIG_PRINTK=y CONFIG_RD_ZSTD=y CONFIG_SECCOMP=y diff --git a/vm/linux_x86_64.config b/vm/linux_x86_64.config index 278a71f..b30d9ac 100644 --- a/vm/linux_x86_64.config +++ b/vm/linux_x86_64.config @@ -48,6 +48,7 @@ CONFIG_PCI=y CONFIG_PID_NS=y CONFIG_POSIX_TIMERS=y CONFIG_PROC_FS=y +CONFIG_PROC_SYSCTL=y CONFIG_PRINTK=y CONFIG_SECCOMP=y CONFIG_SERIAL_8250=y