tart set: support optional "pt" and "px" units for "--display" argument (#1155)

* tart set: support optional "pt" and "px" units for "--display" argument

* Don't forget to update "unit" too

.cirrus.yml

@@ -1,7 +1,7 @@
 use_compute_credits: true
 
 task:
-  name: Test on Sequoia
+  name: Test
   alias: test
   persistent_worker:
     labels:

Sources/tart/Commands/Run.swift

@@ -134,11 +134,12 @@ struct Run: AsyncParsableCommand {
 
   Learn how to create a disk image using Disk Utility here: https://support.apple.com/en-gb/guide/disk-utility/dskutl11888/mac
 
-  To work with block devices, the easiest way is to modify their permissions (e.g. by using "sudo chown $USER /dev/diskX") or to run the Tart binary as root, which affects locating Tart VMs.
+  To work with block devices, the easiest way is to modify their permissions to be accessible to the current user:
 
-  To work around this pass TART_HOME explicitly:
+  sudo chown $USER /dev/diskX
+  tart run sequoia --disk=/dev/diskX
 
-  sudo TART_HOME="$HOME/.tart" tart run sequoia --disk=/dev/disk0
+  Warning: after running the chown command above, all software running under the current user will be able to access /dev/diskX. If that violates your threat model, we recommend avoiding mounting block devices altogether.
   """, valueName: "path[:options]"), completion: .file())
   var disk: [String] = []
 
@@ -201,15 +202,28 @@ struct Run: AsyncParsableCommand {
                            """))
   var netSoftnet: Bool = false
 
-  @Option(help: ArgumentHelp("Comma-separated list of CIDRs to allow the traffic to when using Softnet isolation\n(e.g. --net-softnet-allow=192.168.0.0/24)", discussion: """
+  @Option(help: ArgumentHelp("Comma-separated list of CIDRs to allow the traffic to when using Softnet isolation (e.g. --net-softnet-allow=192.168.0.0/24)", discussion: """
   This option allows you bypass the private IPv4 address space restrictions imposed by --net-softnet.
 
-  For example, you can allow the VM to communicate with the local network with e.g. --net-softnet-allow=10.0.0.0/16 or to completely disable the destination based restrictions with --net-softnet-allow=0.0.0.0/0.
+  For example, you can allow the VM to communicate with the local network with e.g. --net-softnet-allow=10.0.0.0/16 or with --net-softnet-allow=0.0.0.0/0 to completely disable the destination based restrictions, including VMs bridge isolation.
+
+  When used with --net-softnet-block, the longest prefix match always wins. In case the same prefix is both allowed and blocked, blocking takes precedence.
 
   Implies --net-softnet.
   """, valueName: "comma-separated CIDRs"))
   var netSoftnetAllow: String?
 
+  @Option(help: ArgumentHelp("Comma-separated list of CIDRs to block the traffic to when using Softnet isolation (e.g. --net-softnet-block=66.66.0.0/16)", discussion: """
+  This option allows you to tighten the IPv4 address space restrictions imposed by --net-softnet even further.
+
+  For example --net-softnet-block=0.0.0.0/0 may be used to establish a default deny policy that is further relaxed with --net-softnet-allow.
+
+  When used with --net-softnet-allow, the longest prefix match always wins. In case the same prefix is both allowed and blocked, blocking takes precedence.
+
+  Implies --net-softnet.
+  """, valueName: "comma-separated CIDRs"))
+  var netSoftnetBlock: String?
+
   @Option(help: ArgumentHelp("Comma-separated list of TCP ports to expose (e.g. --net-softnet-expose 2222:22,8080:80)", discussion: """
   Options are comma-separated and are as follows:
 
@@ -265,13 +279,19 @@ struct Run: AsyncParsableCommand {
   #endif
   var noTrackpad: Bool = false
 
+  @Flag(help: ArgumentHelp("Disable the pointer"))
+  var noPointer: Bool = false
+
+  @Flag(help: ArgumentHelp("Disable the keyboard"))
+  var noKeyboard: Bool = false
+
   mutating func validate() throws {
     if vnc && vncExperimental {
       throw ValidationError("--vnc and --vnc-experimental are mutually exclusive")
     }
 
     // Automatically enable --net-softnet when any of its related options are specified
-    if netSoftnetAllow != nil || netSoftnetExpose != nil {
+    if netSoftnetAllow != nil || netSoftnetBlock != nil || netSoftnetExpose != nil {
       netSoftnet = true
     }
 
@@ -316,8 +336,15 @@ struct Run: AsyncParsableCommand {
       if noTrackpad {
         throw ValidationError("--no-trackpad cannot be used with --suspendable")
       }
+      if noKeyboard {
+        throw ValidationError("--no-keyboard cannot be used with --suspendable")
+      }
+      if noPointer {
+        throw ValidationError("--no-pointer cannot be used with --suspendable")
+      }
     }
 
+
     if noTrackpad {
       let config = try VMConfig.init(fromURL: vmDir.configURL)
       if config.os != .darwin {
@@ -393,7 +420,9 @@ struct Run: AsyncParsableCommand {
       clipboard: !noClipboard,
       sync: VZDiskImageSynchronizationMode(diskOptions.syncModeRaw),
       caching: VZDiskImageCachingMode(diskOptions.cachingModeRaw),
-      noTrackpad: noTrackpad
+      noTrackpad: noTrackpad,
+      noPointer: noPointer,
+      noKeyboard: noKeyboard
     )
 
     let vncImpl: VNC? = try {
@@ -594,6 +623,10 @@ struct Run: AsyncParsableCommand {
       softnetExtraArguments += ["--allow", netSoftnetAllow]
     }
 
+    if let netSoftnetBlock = netSoftnetBlock {
+      softnetExtraArguments += ["--block", netSoftnetBlock]
+    }
+
     if let netSoftnetExpose = netSoftnetExpose {
       softnetExtraArguments += ["--expose", netSoftnetExpose]
     }

Sources/tart/Commands/Set.swift

@@ -14,7 +14,7 @@ struct Set: AsyncParsableCommand {
   @Option(help: "VM memory size in megabytes")
   var memory: UInt64?
 
-  @Option(help: "VM display resolution in a format of <width>x<height>. For example, 1200x800")
+  @Option(help: "VM display resolution in a format of WIDTHxHEIGHT[pt|px]. For example, 1200x800, 1200x800pt or 1920x1080px. Units are treated as hints and default to \"pt\" (points) for macOS VMs and \"px\" (pixels) for Linux VMs when not specified.")
   var display: VMDisplayConfig?
 
   @Flag(inversion: .prefixedNo, help: ArgumentHelp("Whether to automatically reconfigure the VM's display to fit the window"))
@@ -56,6 +56,7 @@ struct Set: AsyncParsableCommand {
       if (display.height > 0) {
         vmConfig.display.height = display.height
       }
+      vmConfig.display.unit = display.unit
     }
 
     vmConfig.displayRefit = displayRefit
@@ -88,12 +89,24 @@ struct Set: AsyncParsableCommand {
 
 extension VMDisplayConfig: ExpressibleByArgument {
   public init(argument: String) {
+    var argument = argument
+    var unit: Unit? = nil
+
+    if argument.hasSuffix(Unit.pixel.rawValue) {
+      argument = String(argument.dropLast(Unit.pixel.rawValue.count))
+      unit = Unit.pixel
+    } else if argument.hasSuffix(Unit.point.rawValue) {
+      argument = String(argument.dropLast(Unit.point.rawValue.count))
+      unit = Unit.point
+    }
+
     let parts = argument.components(separatedBy: "x").map {
       Int($0) ?? 0
     }
     self = VMDisplayConfig(
       width: parts[safe: 0] ?? 0,
-      height: parts[safe: 1] ?? 0
+      height: parts[safe: 1] ?? 0,
+      unit: unit,
     )
   }
 }

Sources/tart/Platform/Darwin.swift

@@ -82,7 +82,7 @@ struct UnsupportedHostOSError: Error, CustomStringConvertible {
     func graphicsDevice(vmConfig: VMConfig) -> VZGraphicsDeviceConfiguration {
       let result = VZMacGraphicsDeviceConfiguration()
 
-      if let hostMainScreen = NSScreen.main {
+      if (vmConfig.display.unit ?? .point) == .point, let hostMainScreen = NSScreen.main {
         let vmScreenSize = NSSize(width: vmConfig.display.width, height: vmConfig.display.height)
         result.displays = [
           VZMacGraphicsDisplayConfiguration(for: hostMainScreen, sizeInPoints: vmScreenSize)

Sources/tart/VM.swift

@@ -51,7 +51,9 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
        clipboard: Bool = true,
        sync: VZDiskImageSynchronizationMode = .full,
        caching: VZDiskImageCachingMode? = nil,
-       noTrackpad: Bool = false
+       noTrackpad: Bool = false,
+       noPointer: Bool = false,
+       noKeyboard: Bool = false
   ) throws {
     name = vmDir.name
     config = try VMConfig.init(fromURL: vmDir.configURL)
@@ -73,7 +75,9 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
                                                 clipboard: clipboard,
                                                 sync: sync,
                                                 caching: caching,
-                                                noTrackpad: noTrackpad
+                                                noTrackpad: noTrackpad,
+                                                noPointer: noPointer,
+                                                noKeyboard: noKeyboard
     )
     virtualMachine = VZVirtualMachine(configuration: configuration)
 
@@ -316,7 +320,9 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
     clipboard: Bool = true,
     sync: VZDiskImageSynchronizationMode = .full,
     caching: VZDiskImageCachingMode? = nil,
-    noTrackpad: Bool = false
+    noTrackpad: Bool = false,
+    noPointer: Bool = false,
+    noKeyboard: Bool = false
   ) throws -> VZVirtualMachineConfiguration {
     let configuration = VZVirtualMachineConfiguration()
 
@@ -356,8 +362,16 @@ class VM: NSObject, VZVirtualMachineDelegate, ObservableObject {
       configuration.keyboards = platformSuspendable.keyboardsSuspendable()
       configuration.pointingDevices = platformSuspendable.pointingDevicesSuspendable()
     } else {
-      configuration.keyboards = vmConfig.platform.keyboards()
-      if noTrackpad {
+
+      if noKeyboard {
+        configuration.keyboards = []
+      } else {
+        configuration.keyboards = vmConfig.platform.keyboards()
+      }
+
+      if noPointer {
+        configuration.pointingDevices = []
+      } else if noTrackpad {
         configuration.pointingDevices = vmConfig.platform.pointingDevicesSimplified()
       } else {
         configuration.pointingDevices = vmConfig.platform.pointingDevices()

Sources/tart/VMConfig.swift

@@ -32,14 +32,24 @@ enum CodingKeys: String, CodingKey {
   case hardwareModel
 }
 
-struct VMDisplayConfig: Codable {
+struct VMDisplayConfig: Codable, Equatable {
+  enum Unit: String, Codable {
+    case point = "pt"
+    case pixel = "px"
+  }
+
   var width: Int = 1024
   var height: Int = 768
+  var unit: Unit?
 }
 
 extension VMDisplayConfig: CustomStringConvertible {
   var description: String {
-    "\(width)x\(height)"
+    if let unit {
+      "\(width)x\(height)\(unit.rawValue)"
+    } else {
+      "\(width)x\(height)"
+    }
   }
 }
 

Tests/TartTests/VMConfigTests.swift

@@ -0,0 +1,18 @@
+import XCTest
+@testable import tart
+
+final class VMConfigTests: XCTestCase {
+  func testVMDisplayConfig() throws {
+    // Defaults units (points)
+    var vmDisplayConfig = VMDisplayConfig.init(argument: "1234x5678")
+    XCTAssertEqual(VMDisplayConfig(width: 1234, height: 5678, unit: nil), vmDisplayConfig)
+
+    // Explicit units (points)
+    vmDisplayConfig = VMDisplayConfig.init(argument: "1234x5678pt")
+    XCTAssertEqual(VMDisplayConfig(width: 1234, height: 5678, unit: .point), vmDisplayConfig)
+
+    // Explicit units (pixels)
+    vmDisplayConfig = VMDisplayConfig.init(argument: "1234x5678px")
+    XCTAssertEqual(VMDisplayConfig(width: 1234, height: 5678, unit: .pixel), vmDisplayConfig)
+  }
+}

docs/faq.md

@@ -5,6 +5,42 @@ title: Frequently Asked Questions
 description: Advanced configuration and troubleshooting tips for advanced configurations.
 ---
 
+## Headless machines
+
+Starting from macOS 15 (Sequoia), there's an undocumented requirement from [Virtualization.Framework](https://developer.apple.com/documentation/virtualization) (which Tart uses) to have an unlocked `login.keychain` available at the times when running a VM.
+
+Without an existing and unlocked `login.keychain`, the VM won't start with errors like:
+
+* `SecKeyCreateRandomKey_ios failed`
+* `Failed to generate keypair`
+* `Interaction is not allowed with the Security Server`
+
+Below you'll find a couple of workarounds for this behavior.
+
+### Log in via GUI at least once
+
+Connect to the headless machine via [Screen Sharing](https://support.apple.com/guide/mac-help/share-the-screen-of-another-mac-mh14066/mac) and log in to a Mac user account. If you haven't done already, you can enable Screen Sharing [via the terminal](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-to-mac-instance.html#mac-instance-vnc).
+
+Logging in graphically will automatically create the `login.keychain`. Afterward, you have two options:
+
+* configure [automatic log in to a Mac user account](https://support.apple.com/en-us/102316)
+    * this will maintain a running user session (GUI) even after the machine reboots
+    * moreover, you can still lock the screen (either manually [or automatically](https://support.apple.com/guide/mac-help/change-lock-screen-settings-on-mac-mh11784/mac)), however, the security benefit of this is questionable
+* use `security unlock-keychain login.keychain` to unlock the login keychain via the terminal
+    * this command also supports the `-p` command-line argument, which allows you to supply a password and unlock non-interactively
+
+### Create and unlock the login keychain via the terminal
+
+Compared to the previous approach, this one is fully automated, but might stop working at some point in the future:
+
+```shell
+security create-keychain -p '' login.keychain
+security unlock-keychain -p '' login.keychain
+security login-keychain -s login.keychain
+```
+
+Note that this will create a `login.keychain` with an empty password. Consider supplying a different value to `-p` or omitting the `-p` to enter the password interactively. 
+
 ## Troubleshooting crashes
 
 If you experience a crash or encounter another error while using the tart executable, you can collect debug information to assist with troubleshooting. Run the following command in a separate terminal window to gather logs from the Tart process and the macOS Virtualization subsystem:
@@ -143,12 +179,12 @@ This is because Tart uses [Keychain](https://en.wikipedia.org/wiki/Keychain_(sof
 To unlock the Keychain in an SSH session, run the following command, which will ask for your user's password:
 
 ```shell
-security unlock-keychain
+security unlock-keychain login.keychain
 ```
 
-This command also supports the `-p` command-line argument that allows you to supply the password and unlock non-interactively, which is great for scripts.
+This command also supports the `-p` command-line argument that allows you to supply a password and unlock non-interactively, which is great for scripts.
 
-If that doesn't work for you for some reason, you can pass the credentials via the environment variables, see [Registry Authorization](integrations/vm-management.md#registry-authorization) for more details on how to do that.
+Alternatively, you can pass the credentials via the environment variables, see [Registry Authorization](integrations/vm-management.md#registry-authorization) for more details on how to do that.
 
 ## How is Tart different from Anka?
 

integration-tests/requirements.txt

@@ -1,6 +1,6 @@
 pytest
 testcontainers
-requests == 2.31.0 # work around https://github.com/psf/requests/issues/6707
+requests
 bitmath
 pytest-dependency
 paramiko

integration-tests/test_run.py

@@ -9,7 +9,7 @@ def test_run(tart, run_opts):
     vm_name = f"integration-test-run-{uuid.uuid4()}"
 
     # Instantiate a VM with admin:admin SSH access
-    tart.run(["clone", "ghcr.io/cirruslabs/macos-sonoma-base:latest", vm_name])
+    tart.run(["clone", "ghcr.io/cirruslabs/macos-tahoe-base:latest", vm_name])
 
     # Run the VM asynchronously
     tart_run_process = tart.run_async(["run", vm_name] + run_opts)