Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: Test virtiofsd as root #3623

Closed
wants to merge 3 commits into from
Closed
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
qemu: Work around virtiofsd as root in pod
Work around https://gitlab.com/virtio-fs/virtiofsd/-/merge_requests/197

Basically virtiofsd should not be trying to drop capabilities
when it can't do so, but we should be able to ask it to stop doing that.
cgwalters committed Sep 18, 2023
commit bcc60808abf47b6147635f32ddfccee4d571932f
30 changes: 22 additions & 8 deletions mantle/platform/qemu.go
Original file line number Diff line number Diff line change
@@ -1587,6 +1587,27 @@ func (builder *QemuBuilder) VirtioJournal(config *conf.Conf, queryArguments stri
return stream, nil
}

// createVirtiofsCmd returns a new command instance configured to launch virtiofsd.
func createVirtiofsCmd(directory, socketPath string) exec.Cmd {
args := []string{"--sandbox", "none", "--socket-path", socketPath, "--shared-dir", "."}
// Work around https://gitlab.com/virtio-fs/virtiofsd/-/merge_requests/197
if os.Getuid() == 0 {
args = append(args, "--modcaps=-mknod:-setfcap")
}
cmd := exec.Command("/usr/libexec/virtiofsd", args...)
// This sets things up so that the `.` we passed in the arguments is the target directory
cmd.Dir = directory
// Quiet the daemon by default
cmd.Env = append(cmd.Env, "RUST_LOG=ERROR")
// But we do want to see errors
cmd.Stderr = os.Stderr
// Like other processes, "lifecycle bind" it to us
cmd.SysProcAttr = &syscall.SysProcAttr{
Pdeathsig: syscall.SIGTERM,
}
return cmd
}

// Exec tries to run a QEMU instance with the given settings.
func (builder *QemuBuilder) Exec() (*QemuInstance, error) {
builder.finalize()
@@ -1805,14 +1826,7 @@ func (builder *QemuBuilder) Exec() (*QemuInstance, error) {
builder.Append("-device", fmt.Sprintf("vhost-user-fs-pci,queue-size=1024,chardev=%s,tag=%s", virtiofsChar, hostmnt.dest))
plog.Debugf("creating virtiofs helper for %s", hostmnt.src)
// TODO: Honor hostmnt.readonly somehow here (add an option to virtiofsd)
p := exec.Command("/usr/libexec/virtiofsd", "--sandbox", "none", "--socket-path", virtiofsdSocket, "--shared-dir", ".")
p.Dir = hostmnt.src
// Quiet the daemon by default
p.Env = append(p.Env, "RUST_LOG=ERROR")
p.Stderr = os.Stderr
p.SysProcAttr = &syscall.SysProcAttr{
Pdeathsig: syscall.SIGTERM,
}
p := createVirtiofsCmd(hostmnt.src, virtiofsdSocket)
if err := p.Start(); err != nil {
return nil, fmt.Errorf("failed to start virtiofsd")
}