libvirt/src/logging/virtlogd.socket.in

[Unit]
Description=Virtual machine log manager socket
Before=libvirtd.service

[Socket]
ListenStream=@localstatedir@/run/libvirt/virtlogd-sock
SocketMode=0600

[Install]
WantedBy=sockets.target
Import stripped down virtlockd code as basis of virtlogd Copy the virtlockd codebase across to form the initial virlogd code. Simple search & replace of s/lock/log/ and gut the remote protocol & dispatcher. This gives us a daemon that starts up and listens for connections, but does nothing with them. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> 2015-02-09 16:35:05 +00:00			`[Unit]`
			`Description=Virtual machine log manager socket`
virtlogd.socket: Tie lifecycle to libvirtd.service We already guarantee that virtlogd.socket is enabled/disabled along with libvirtd.service, but if libvirtd.service has just been installed and is started before rebooting, then virtlogd.socket will not be running and guest startup will fail. Add Requires=virtlogd.socket to libvirtd.service to make sure virtlogd.socket is always started along with libvirtd.service, and add Before=libvirtd.service to both virtlogd.socket and virtlogd.service so that virtlogd never disappears before libvirtd has exited. Also add PartOf=libvirtd.service to both virtlogd.socket and virtlogd.service, so that virtlogd can be shut down when not needed. Resolves: https://bugzilla.redhat.com/1372576 2016-09-06 15:16:24 +02:00			`Before=libvirtd.service`
Import stripped down virtlockd code as basis of virtlogd Copy the virtlockd codebase across to form the initial virlogd code. Simple search & replace of s/lock/log/ and gut the remote protocol & dispatcher. This gives us a daemon that starts up and listens for connections, but does nothing with them. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> 2015-02-09 16:35:05 +00:00
			`[Socket]`
			`ListenStream=@localstatedir@/run/libvirt/virtlogd-sock`
logging: restrict sockets to mode 0600 The virtlogd daemon's only intended client is the libvirtd daemon. As such it should never allow clients from other user accounts to connect. The code already enforces this and drops clients from other UIDs, but we can get earlier (and thus stronger) protection against DoS by setting the socket permissions to 0600 Fixes CVE-2019-10132 Reviewed-by: Ján Tomko <jtomko@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> 2019-04-30 17:27:41 +01:00			`SocketMode=0600`
Import stripped down virtlockd code as basis of virtlogd Copy the virtlockd codebase across to form the initial virlogd code. Simple search & replace of s/lock/log/ and gut the remote protocol & dispatcher. This gives us a daemon that starts up and listens for connections, but does nothing with them. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> 2015-02-09 16:35:05 +00:00
			`[Install]`
			`WantedBy=sockets.target`