If a systemd socket uses /var/run in its path, systemd prints a warning
at runtime

[   15.139976] systemd[1]: /usr/lib/systemd/system/virtlockd.socket:5:
  ListenStream= references a path below legacy directory /var/run/,
  updating /var/run/libvirt/virtlockd-sock → /run/libvirt/virtlockd-sock;
  please update the unit file accordingly.

This minimal change updates the socket unit files to honour the
$runstatedir path.

There's no functional change by default yet since both expressions
expand to the same value.
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>

The virtlockd daemon's only intended client is the libvirtd daemon. As
such it should never allow clients from other user accounts to connect.
The code already enforces this and drops clients from other UIDs, but
we can get earlier (and thus stronger) protection against DoS by setting
the socket permissions to 0600

Fixes CVE-2019-10132
Reviewed-by: NJán Tomko <jtomko@redhat.com>
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>

After deploying virtlogd by default we identified a number of
mistakes in the systemd unit file. virtlockd's relationship
to libvirtd is the same as virtlogd, so we must apply the
same unit file fixes to virtlockd
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

- Pass VIRTLOCKD_ARGS through to virtlockd.

- Use SIGUSR1, not SIGHUP, in ExecReload. At present, virtlockd only
  responds to the former.

- Have "systemctl enable virtlockd.service" enable virtlockd.socket,
  rather than throw an error.

- Make virtlockd.socket wanted by sockets.target, rather than
  multi-user.target. This is consistent with other socket units in
  Fedora, and it ensures that the socket is available before libvirtd is
  started.
Signed-off-by: NMichael Chapman <mike@very.puzzling.org>

Change the socket path to match the one used by lockd driver.

https://bugzilla.redhat.com/show_bug.cgi?id=968128

virtlockd.service could be installed to a configurable root,
but virtlockd.socket was hardcoded to installation into a
distro.

* src/Makefile.am (virtlockd.service, virtlockd.socket): Drop
unused substitutions.
* src/locking/virtlockd.socket.in (ListenStream): Don't hard-code
/var.

This enhancement virtlockd so that it can receive a pre-opened
UNIX domain socket from systemd at launch time, and adds the
systemd service/socket unit files

* daemon/libvirtd.service.in: Require virtlockd to be running
* libvirt.spec.in: Add virtlockd systemd files
* src/Makefile.am: Install systemd files
* src/locking/lock_daemon.c: Support socket activation
* src/locking/virtlockd.service.in, src/locking/virtlockd.socket.in:
  systemd unit files
* src/rpc/virnetserverservice.c, src/rpc/virnetserverservice.h:
  Add virNetServerServiceNewFD() method
* src/rpc/virnetsocket.c, src/rpc/virnetsocket.h: Add virNetSocketNewListenFD
  method
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>