Hi Paolo,
> > > +static void compute_default_paths(void)
> > > +{
> > > + socket_path = g_build_filename("/run", "qemu-vmsr-helper.sock",
> > > NULL);
> > > + pidfile = g_build_filename("/run", "qemu-vmsr-helper.pid", NULL);
> > > +}
> >
> > We shouldn't be hardcoding /run, we need to honour --prefix and
> > --localstatedir args given to configure. /var/run is a symlink
> > to /run so the end result ends up the same AFAIK
>
> Indeed; just copy from scsi/qemu-pr-helper.c.
>
When I copy the same as compute-default() of scsi/qemu-pr-helper.c, the
helper is listening to "/var/local/run/qemu-vmsr-helper.sock".
Problem is /var/local/run is 700 while /run is 755.
So I would need to adjust the qemu-vmsr-helper.service to give
the --socket=PATH of qemu-vmsr-helper.socket (i.e
/run/qemu-vmsr-helper.sock)
Problem is when I do that , I fall into the case:
"Unix socket can't be set when using socket activation"
So I'm a bit confused what to do about that.
> > You never answered my question from the previous posting of this
> >
> > This check is merely validating the the thread ID in the message
> > is a child of the process ID connected to the socket. Any process
> > on the entire host can satisfy this requirement.
> >
> > I don't see what is limiting this to only QEMU as claimed by the
> > commit message, unless you're expecting the UNIX socket permissions
> > to be such that only processes under the qemu:qemu user:group pair
> > can access to the socket ? That would be a libvirt based permissions
> > assumption though.
>
> Yes, this is why the systemd socket uses 600, like
> contrib/systemd/qemu-pr-helper.socket. The socket can be passed via
> SCM_RIGHTS by libvirt, or its permissions can be changed (e.g. 660 and
> root:kvm would make sense on a Debian system), or a separate helper
> can be started by libvirt.
>
> Either way, the policy is left to the user rather than embedding it in
> the provided systemd unit.
>
During this patch test, when I run by hand my VM (without libvirt),
the vmsr helper systemd service/socket was like that:
[Service]
ExecStart=/usr/bin/qemu-vmsr-helper
User=root
Group=root
and
[Socket]
ListenStream=/run/qemu-vmsr-helper.sock
SocketUser=qemu
SocketGroup=qemu
SocketMode=0660
And it seems to works. So I'm not sure 100% what to do in my patch.
Should I follow the pr-helper systemd files anyway ?
Regards,
Anthony
