On Tue, Jul 22, 2014 at 01:36:56PM +0100, Daniel P. Berrange wrote:
On Wed, Jul 16, 2014 at 08:29:54PM +0200, Martin Kletzander wrote:
> This is complete rework of:
>
>
http://www.redhat.com/archives/libvir-list/2013-April/msg01351.html
>
> where Daniel suggested we use systemd-like passing of socket fd in
> combination with the LISTEN_FDS environment variable:
>
>
http://www.redhat.com/archives/libvir-list/2013-April/msg01356.html
>
> Resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=927369
Obviously that bug is focused on starting of the session daemon,
but the code we're adding here should work with systemd. Have you
tested that this actually allows for systemd activation of the
privileged libvirtd. If we're adding this FD passing, I think we
really ought to make sure we support this, so we don't have to
revisit it later. Should add a libvirtd.socket unit file too
so we have systemd activation by default for libvirtd.
Obviously I haven't. I just wanted to get rid of that silly, silly
bug.
NB, we stil need to enable the daemon by default anyway since
libvirtd needs todo autostart of VMs, but having the socket
activation too avoids some race conditions with startup.
Yes, that's one of the reasons why I think it will create more
confusion than races it will resolve.
I'll _try_ to work this in, but how would you suggest to set up the
initial permissions? Anything the user will change in libvirtd.conf
he will also have to change in the libvirt.socket file, because
someone might use the filesystem-level permission checking for
isolating some users (or anything else) because we don't want to break
that.