* [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root
@ 2018-11-19 16:27 Ian Jackson
2018-11-19 16:27 ` [OSSTEST PATCH 2/3] ts-depriv-audit-qemu: chmod +x qemu's chroot Ian Jackson
` (3 more replies)
0 siblings, 4 replies; 8+ messages in thread
From: Ian Jackson @ 2018-11-19 16:27 UTC (permalink / raw)
To: xen-devel; +Cc: Ian Jackson, George Dunlap
* Use mkdir -p, rather than trying to only create /run/user/$uid.
That helps if /run and/or /run/user do not exist, as they do in
libxl-made chroots with recent libxl (which gets qemu to chroot).
* Do all of this in the root directory of the qemu process, not our
own root directory. So it works if qemu is chrooted.
CC: George Dunlap <george.dunlap@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
---
ts-depriv-audit-qemu | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/ts-depriv-audit-qemu b/ts-depriv-audit-qemu
index 5d09350..4e07d76 100755
--- a/ts-depriv-audit-qemu
+++ b/ts-depriv-audit-qemu
@@ -48,9 +48,10 @@ END
qpid=$(xenstore-read /local/domain/$domid/image/device-model-pid)
uid=$(id -u xen-qemuuser-range-base)
uid=$(( $uid + $domid ))
- test -d /run/user || mkdir -m 2755 /run/user
- if mkdir -m 2700 /run/user/$uid; then
- chown $uid:root /run/user/$uid
+ qroot=$(readlink /proc/8123/root)
+ mkdir -pm 2755 $qroot/run/user
+ if mkdir -m 2700 $qroot/run/user/$uid; then
+ chown $uid:root $qroot/run/user/$uid
fi
osstest-depriv-fd-collector $qpid \
/usr/local/lib/xen/bin/depriv-fd-checker
--
2.11.0
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [OSSTEST PATCH 2/3] ts-depriv-audit-qemu: chmod +x qemu's chroot
2018-11-19 16:27 [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root Ian Jackson
@ 2018-11-19 16:27 ` Ian Jackson
2018-11-19 16:27 ` [OSSTEST PATCH 3/3] productionc-config*: Update to fishdescriptor with chroot bugfix Ian Jackson
` (2 subsequent siblings)
3 siblings, 0 replies; 8+ messages in thread
From: Ian Jackson @ 2018-11-19 16:27 UTC (permalink / raw)
To: xen-devel; +Cc: Ian Jackson, George Dunlap
libxl creates this directory with mode 0. That prevents
fishdescriptor from working. chmod it. This is OK for testing.
CC: George Dunlap <george.dunlap@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
---
ts-depriv-audit-qemu | 1 +
1 file changed, 1 insertion(+)
diff --git a/ts-depriv-audit-qemu b/ts-depriv-audit-qemu
index 4e07d76..8175008 100755
--- a/ts-depriv-audit-qemu
+++ b/ts-depriv-audit-qemu
@@ -49,6 +49,7 @@ END
uid=$(id -u xen-qemuuser-range-base)
uid=$(( $uid + $domid ))
qroot=$(readlink /proc/8123/root)
+ chmod a+x $qroot
mkdir -pm 2755 $qroot/run/user
if mkdir -m 2700 $qroot/run/user/$uid; then
chown $uid:root $qroot/run/user/$uid
--
2.11.0
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [OSSTEST PATCH 3/3] productionc-config*: Update to fishdescriptor with chroot bugfix
2018-11-19 16:27 [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root Ian Jackson
2018-11-19 16:27 ` [OSSTEST PATCH 2/3] ts-depriv-audit-qemu: chmod +x qemu's chroot Ian Jackson
@ 2018-11-19 16:27 ` Ian Jackson
2018-11-19 16:45 ` [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root George Dunlap
2018-11-19 17:24 ` Wei Liu
3 siblings, 0 replies; 8+ messages in thread
From: Ian Jackson @ 2018-11-19 16:27 UTC (permalink / raw)
To: xen-devel; +Cc: Ian Jackson, George Dunlap
Deployment note: I have copied this binary to the images directory in
Cambridge and Massachusetts. The corresponding patch to chiark-utils
is on its way to my upstream hat.
CC: George Dunlap <george.dunlap@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
---
production-config | 2 +-
production-config-cambridge | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/production-config b/production-config
index df02cd3..6b743d4 100644
--- a/production-config
+++ b/production-config
@@ -103,7 +103,7 @@ MicrocodeUpdateI386 microcode.x86.2015-06-12.cpio
# Update with ./mg-netgrub-loader-update
TftpGrubVersion XXXX-XX-XX
-DebianExtraPackages_jessie chiark-scripts_6.0.2_all.deb
+DebianExtraPackages_jessie chiark-scripts_6.0.3~citrix1_all.deb
DebianExtraPackages_uefi_i386_jessie extradebs-uefi-i386-2018-04-01/
DebianExtraPackages_uefi_amd64_jessie extradebs-uefi-amd64-2018-04-01/
diff --git a/production-config-cambridge b/production-config-cambridge
index 5c9a4a2..8e2eadd 100644
--- a/production-config-cambridge
+++ b/production-config-cambridge
@@ -82,7 +82,7 @@ TftpDiVersion_jessie 2018-06-26
DebianImageVersion_wheezy 7.2.0
DebianImageVersion_jessie 8.2.0
-DebianExtraPackages_jessie chiark-scripts_6.0.2_all.deb
+DebianExtraPackages_jessie chiark-scripts_6.0.3~citrix1_all.deb
# These should normally be the same.
MicrocodeUpdateAmd64 microcode.x86.2015-06-12.cpio
--
2.11.0
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root
2018-11-19 16:27 [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root Ian Jackson
2018-11-19 16:27 ` [OSSTEST PATCH 2/3] ts-depriv-audit-qemu: chmod +x qemu's chroot Ian Jackson
2018-11-19 16:27 ` [OSSTEST PATCH 3/3] productionc-config*: Update to fishdescriptor with chroot bugfix Ian Jackson
@ 2018-11-19 16:45 ` George Dunlap
2018-11-19 16:53 ` Ian Jackson
2018-11-19 17:24 ` Wei Liu
3 siblings, 1 reply; 8+ messages in thread
From: George Dunlap @ 2018-11-19 16:45 UTC (permalink / raw)
To: Ian Jackson, xen-devel
On 11/19/18 4:27 PM, Ian Jackson wrote:
> * Use mkdir -p, rather than trying to only create /run/user/$uid.
> That helps if /run and/or /run/user do not exist, as they do in
> libxl-made chroots with recent libxl (which gets qemu to chroot).
>
> * Do all of this in the root directory of the qemu process, not our
> own root directory. So it works if qemu is chrooted.
>
> CC: George Dunlap <george.dunlap@citrix.com>
> Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
It doesn't look like this does an `rm -rf $qroot` afterwards. If on
this system, a domain with the same domid ever starts again in depriv
mode, the `rmdir` of the chroot directory will fail, and libxl will
abort domain creation.
I realize it's a low probability something like that will happen, but I
would probably at least mention the possibility somewhere.
-George
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root
2018-11-19 16:45 ` [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root George Dunlap
@ 2018-11-19 16:53 ` Ian Jackson
2018-11-19 16:58 ` George Dunlap
0 siblings, 1 reply; 8+ messages in thread
From: Ian Jackson @ 2018-11-19 16:53 UTC (permalink / raw)
To: George Dunlap; +Cc: xen-devel
George Dunlap writes ("Re: [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root"):
> On 11/19/18 4:27 PM, Ian Jackson wrote:
> > CC: George Dunlap <george.dunlap@citrix.com>
> > Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
>
> It doesn't look like this does an `rm -rf $qroot` afterwards. If on
> this system, a domain with the same domid ever starts again in depriv
> mode, the `rmdir` of the chroot directory will fail, and libxl will
> abort domain creation.
Doesn't something in libxl already rm -r the directory ?
> I realize it's a low probability something like that will happen, but I
> would probably at least mention the possibility somewhere.
Hrm. Well, this is OK for a test script for now anyway I think.
Ian.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root
2018-11-19 16:53 ` Ian Jackson
@ 2018-11-19 16:58 ` George Dunlap
2018-11-19 17:04 ` Ian Jackson
0 siblings, 1 reply; 8+ messages in thread
From: George Dunlap @ 2018-11-19 16:58 UTC (permalink / raw)
To: Ian Jackson; +Cc: xen-devel
On 11/19/18 4:53 PM, Ian Jackson wrote:
> George Dunlap writes ("Re: [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root"):
>> On 11/19/18 4:27 PM, Ian Jackson wrote:
>>> CC: George Dunlap <george.dunlap@citrix.com>
>>> Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
>>
>> It doesn't look like this does an `rm -rf $qroot` afterwards. If on
>> this system, a domain with the same domid ever starts again in depriv
>> mode, the `rmdir` of the chroot directory will fail, and libxl will
>> abort domain creation.
>
> Doesn't something in libxl already rm -r the directory ?
It calls `rmdir`, which will fail if the directory isn't empty.
Implementing `rm -rf` in C is a reasonably large faff; and given that
qemu shouldn't be able to write to it anyway, I figured simply doing an
`rmdir` and failing if it failed with anything other than ENOENT would
be suitable. (See the comment in libxl_dm).
-George
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root
2018-11-19 16:58 ` George Dunlap
@ 2018-11-19 17:04 ` Ian Jackson
0 siblings, 0 replies; 8+ messages in thread
From: Ian Jackson @ 2018-11-19 17:04 UTC (permalink / raw)
To: George Dunlap; +Cc: xen-devel
George Dunlap writes ("Re: [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root"):
> Implementing `rm -rf` in C is a reasonably large faff; and given that
> qemu shouldn't be able to write to it anyway, I figured simply doing an
> `rmdir` and failing if it failed with anything other than ENOENT would
> be suitable. (See the comment in libxl_dm).
I think for now we should ignore this wrinkle. I think it won't bite
us unless a domid is reused in an osstest run...
Ian.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root
2018-11-19 16:27 [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root Ian Jackson
` (2 preceding siblings ...)
2018-11-19 16:45 ` [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root George Dunlap
@ 2018-11-19 17:24 ` Wei Liu
3 siblings, 0 replies; 8+ messages in thread
From: Wei Liu @ 2018-11-19 17:24 UTC (permalink / raw)
To: Ian Jackson; +Cc: xen-devel, Wei Liu, George Dunlap
On Mon, Nov 19, 2018 at 04:27:39PM +0000, Ian Jackson wrote:
> * Use mkdir -p, rather than trying to only create /run/user/$uid.
> That helps if /run and/or /run/user do not exist, as they do in
> libxl-made chroots with recent libxl (which gets qemu to chroot).
>
> * Do all of this in the root directory of the qemu process, not our
> own root directory. So it works if qemu is chrooted.
>
> CC: George Dunlap <george.dunlap@citrix.com>
> Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
> ---
> ts-depriv-audit-qemu | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/ts-depriv-audit-qemu b/ts-depriv-audit-qemu
> index 5d09350..4e07d76 100755
> --- a/ts-depriv-audit-qemu
> +++ b/ts-depriv-audit-qemu
> @@ -48,9 +48,10 @@ END
> qpid=$(xenstore-read /local/domain/$domid/image/device-model-pid)
> uid=$(id -u xen-qemuuser-range-base)
> uid=$(( $uid + $domid ))
> - test -d /run/user || mkdir -m 2755 /run/user
> - if mkdir -m 2700 /run/user/$uid; then
> - chown $uid:root /run/user/$uid
> + qroot=$(readlink /proc/8123/root)
8123? I think you mean $uid or something.
Wei.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2018-11-19 17:24 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-11-19 16:27 [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root Ian Jackson
2018-11-19 16:27 ` [OSSTEST PATCH 2/3] ts-depriv-audit-qemu: chmod +x qemu's chroot Ian Jackson
2018-11-19 16:27 ` [OSSTEST PATCH 3/3] productionc-config*: Update to fishdescriptor with chroot bugfix Ian Jackson
2018-11-19 16:45 ` [OSSTEST PATCH 1/3] ts-depriv-audit-qemu: Create complete /run/user in appropriate root George Dunlap
2018-11-19 16:53 ` Ian Jackson
2018-11-19 16:58 ` George Dunlap
2018-11-19 17:04 ` Ian Jackson
2018-11-19 17:24 ` Wei Liu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.