passt, branch 2024_05_23.765eb0b

apparmor: Fix comments after PID file and AF_UNIX socket creation refactoring

2024-05-23T14:44:21+00:00

Now:
- we don't open the PID file in main() anymore
- PID file and AF_UNIX socket are opened by pidfile_open() and
  tap_sock_unix_open()
- write_pidfile() becomes pidfile_write()

Reported-by: Richard W.M. Jones 
Signed-off-by: Stefano Brivio 
Acked-by: Richard W.M. Jones

conf, passt.h: Rename pid_file in struct ctx to pidfile

2024-05-23T14:44:14+00:00

We have pidfile_fd now, pid_file_fd would be quite ugly.

Signed-off-by: Stefano Brivio 
Reviewed-by: Richard W.M. Jones

conf, passt, tap: Open socket and PID files before switching UID/GID

2024-05-23T14:43:26+00:00

Otherwise, if the user runs us as root, and gives us paths that are
only accessible by root, we'll fail to open them, which might in turn
encourage users to change permissions or ownerships: definitely a bad
idea in terms of security.

Reported-by: Minxi Hou 
Reported-by: Richard W.M. Jones 
Signed-off-by: Stefano Brivio 
Acked-by: Richard W.M. Jones

passt, util: Move opening of PID file to its own function

2024-05-23T14:43:13+00:00

We won't call it from main() any longer: move it.

Signed-off-by: Stefano Brivio 
Reviewed-by: Richard W.M. Jones

util: Rename write_pidfile() to pidfile_write()

2024-05-23T14:43:05+00:00

As I'm adding pidfile_open() in the next patch. The function comment
didn't match, by the way.

Signed-off-by: Stefano Brivio 
Reviewed-by: Richard W.M. Jones

tap: Split tap_sock_unix_init() into opening and listening parts

2024-05-23T14:42:43+00:00

We'll need to open and bind the socket a while before listening to it,
so split that into two different functions. No functional changes
intended.

Signed-off-by: Stefano Brivio 
Reviewed-by: Richard W.M. Jones

passt, tap: Don't use -1 as uninitialised value for fd_tap_listen

2024-05-23T14:42:27+00:00

This is a remnant from the time we kept access to the original
filesystem and we could reinitialise the listening AF_UNIX socket.

Since commit 0515adceaa8f ("passt, pasta: Namespace-based sandboxing,
defer seccomp policy application"), however, we can't re-bind the
listening socket once we're up and running.

Drop the -1 initalisation and the corresponding check.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

tap: Move all-ones initialisation of mac_guest to tap_sock_init()

2024-05-23T14:42:06+00:00

It has nothing to do with tap_sock_unix_init(). It used to be there as
that function could be called multiple times per passt instance, but
it's not the case anymore.

This also takes care of the fact that, with --fd, we wouldn't set the
initial MAC address, so we would need to wait for the guest to send us
an ARP packet before we could exchange data.

Fixes: 6b4e68383c66 ("passt, tap: Add --fd option")
Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson 
Acked-by: Richard W.M. Jones

conf: Don't lecture user about starting us as root

2024-05-23T14:40:33+00:00

libguestfs tools have a good reason to run as root: if the guest image
is owned by root, it would be counterproductive to encourage users to
invoke them as non-root, as it would require changing permissions or
ownership of the image file.

And if they run as root, we'll start as root, too. Warn users we'll
switch to 'nobody', but don't tell them what to do.

Reported-by: Richard W.M. Jones 
Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson 
Reviewed-by: Richard W.M. Jones

netlink, test: Ignore deprecated addresses

2024-05-22T21:21:09+00:00

When we retrieve or copy host addresses we can include deprecated
addresses, which is not what we want.  Adjust our logic to exclude them.
Similarly our tests can retrieve deprecated addresses, so exclude them
there too.

I hit this in practice because my router sometimes temporarily advertises
an fd00:: prefix before the real delegated IPv6 prefix.  The deprecated
address can hang around for some time messing up my tests.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio