libvirt/src/locking/virtlockd.socket.in

[Unit]
Description=Virtual machine lock manager socket
Before=libvirtd.service

[Socket]
ListenStream=@runstatedir@/libvirt/virtlockd-sock
SocketMode=0600

[Install]
WantedBy=sockets.target
Enable systemd socket activation with virtlockd This enhancement virtlockd so that it can receive a pre-opened UNIX domain socket from systemd at launch time, and adds the systemd service/socket unit files * daemon/libvirtd.service.in: Require virtlockd to be running * libvirt.spec.in: Add virtlockd systemd files * src/Makefile.am: Install systemd files * src/locking/lock_daemon.c: Support socket activation * src/locking/virtlockd.service.in, src/locking/virtlockd.socket.in: systemd unit files * src/rpc/virnetserverservice.c, src/rpc/virnetserverservice.h: Add virNetServerServiceNewFD() method * src/rpc/virnetsocket.c, src/rpc/virnetsocket.h: Add virNetSocketNewListenFD method Signed-off-by: Daniel P. Berrange <berrange@redhat.com> 2011-07-07 14:02:32 +00:00			`[Unit]`
			`Description=Virtual machine lock manager socket`
virtlockd: fix systemd unit file dependancies After deploying virtlogd by default we identified a number of mistakes in the systemd unit file. virtlockd's relationship to libvirtd is the same as virtlogd, so we must apply the same unit file fixes to virtlockd Signed-off-by: Daniel P. Berrange <berrange@redhat.com> 2017-01-17 15:45:57 +00:00			`Before=libvirtd.service`
Enable systemd socket activation with virtlockd This enhancement virtlockd so that it can receive a pre-opened UNIX domain socket from systemd at launch time, and adds the systemd service/socket unit files * daemon/libvirtd.service.in: Require virtlockd to be running * libvirt.spec.in: Add virtlockd systemd files * src/Makefile.am: Install systemd files * src/locking/lock_daemon.c: Support socket activation * src/locking/virtlockd.service.in, src/locking/virtlockd.socket.in: systemd unit files * src/rpc/virnetserverservice.c, src/rpc/virnetserverservice.h: Add virNetServerServiceNewFD() method * src/rpc/virnetsocket.c, src/rpc/virnetsocket.h: Add virNetSocketNewListenFD method Signed-off-by: Daniel P. Berrange <berrange@redhat.com> 2011-07-07 14:02:32 +00:00
			`[Socket]`
systemd: honour $runstatedir in socket unit files If a systemd socket uses /var/run in its path, systemd prints a warning at runtime [ 15.139976] systemd[1]: /usr/lib/systemd/system/virtlockd.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/libvirt/virtlockd-sock → /run/libvirt/virtlockd-sock; please update the unit file accordingly. This minimal change updates the socket unit files to honour the $runstatedir path. There's no functional change by default yet since both expressions expand to the same value. Reviewed-by: Michal Privoznik <mprivozn@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> 2019-08-20 10:57:46 +00:00			`ListenStream=@runstatedir@/libvirt/virtlockd-sock`
locking: restrict sockets to mode 0600 The virtlockd daemon's only intended client is the libvirtd daemon. As such it should never allow clients from other user accounts to connect. The code already enforces this and drops clients from other UIDs, but we can get earlier (and thus stronger) protection against DoS by setting the socket permissions to 0600 Fixes CVE-2019-10132 Reviewed-by: Ján Tomko <jtomko@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> 2019-04-30 15:51:37 +00:00			`SocketMode=0600`
Enable systemd socket activation with virtlockd This enhancement virtlockd so that it can receive a pre-opened UNIX domain socket from systemd at launch time, and adds the systemd service/socket unit files * daemon/libvirtd.service.in: Require virtlockd to be running * libvirt.spec.in: Add virtlockd systemd files * src/Makefile.am: Install systemd files * src/locking/lock_daemon.c: Support socket activation * src/locking/virtlockd.service.in, src/locking/virtlockd.socket.in: systemd unit files * src/rpc/virnetserverservice.c, src/rpc/virnetserverservice.h: Add virNetServerServiceNewFD() method * src/rpc/virnetsocket.c, src/rpc/virnetsocket.h: Add virNetSocketNewListenFD method Signed-off-by: Daniel P. Berrange <berrange@redhat.com> 2011-07-07 14:02:32 +00:00
			`[Install]`
virtlockd: improve systemd units - Pass VIRTLOCKD_ARGS through to virtlockd. - Use SIGUSR1, not SIGHUP, in ExecReload. At present, virtlockd only responds to the former. - Have "systemctl enable virtlockd.service" enable virtlockd.socket, rather than throw an error. - Make virtlockd.socket wanted by sockets.target, rather than multi-user.target. This is consistent with other socket units in Fedora, and it ensures that the socket is available before libvirtd is started. Signed-off-by: Michael Chapman <mike@very.puzzling.org> 2013-12-09 06:23:25 +00:00			`WantedBy=sockets.target`