fix(vm): run virt-launcher as non-root

Signed-off-by: Isteb4k <[email protected]>

Author: Isteb4k

images/libvirt/patches/001-disable-ro-and-admin-servers.patch

@@ -0,0 +1,47 @@
+diff --git a/src/remote/remote_daemon.c b/src/remote/remote_daemon.c
+index 9e82132654..fcc7514169 100644
+--- a/src/remote/remote_daemon.c
++++ b/src/remote/remote_daemon.c
+@@ -628,24 +628,24 @@ static void daemonRunStateInit(void *opaque)
+
+     /* Tie the non-privileged daemons to the session/shutdown lifecycle */
+     if (!virNetDaemonIsPrivileged(dmn)) {
+-
+-        sessionBus = virGDBusGetSessionBus();
+-        if (sessionBus != NULL)
+-            g_dbus_connection_add_filter(sessionBus,
+-                                         handleSessionMessageFunc, dmn, NULL);
+-
+-        systemBus = virGDBusGetSystemBus();
+-        if (systemBus != NULL)
+-            g_dbus_connection_signal_subscribe(systemBus,
+-                                               "org.freedesktop.login1",
+-                                               "org.freedesktop.login1.Manager",
+-                                               "PrepareForShutdown",
+-                                               NULL,
+-                                               NULL,
+-                                               G_DBUS_SIGNAL_FLAGS_NONE,
+-                                               handleSystemMessageFunc,
+-                                               dmn,
+-                                               NULL);
++        if (FALSE) {
++            sessionBus = virGDBusGetSessionBus();
++            if (sessionBus != NULL)
++                g_dbus_connection_add_filter(sessionBus,
++                                            handleSessionMessageFunc, dmn, NULL);
++            systemBus = virGDBusGetSystemBus();
++            if (systemBus != NULL)
++                g_dbus_connection_signal_subscribe(systemBus,
++                                                "org.freedesktop.login1",
++                                                "org.freedesktop.login1.Manager",
++                                                "PrepareForShutdown",
++                                                NULL,
++                                                NULL,
++                                                G_DBUS_SIGNAL_FLAGS_NONE,
++                                                handleSystemMessageFunc,
++                                                dmn,
++                                                NULL);
++        }
+     }
+
+     /* Only now accept clients from network */

images/libvirt/patches/001-podsadsadsapa.patch

@@ -0,0 +1,42 @@
+diff --git a/cmd/virt-launcher-monitor/virt-launcher-monitor.go b/cmd/virt-launcher-monitor/virt-launcher-monitor.go
+index f2a0ed86f5..90caff4265 100644
+--- a/cmd/virt-launcher-monitor/virt-launcher-monitor.go
++++ b/cmd/virt-launcher-monitor/virt-launcher-monitor.go
+@@ -35,8 +35,8 @@ import (
+ 	"time"
+ 
+ 	"github.com/spf13/pflag"
+-
+ 	"golang.org/x/sys/unix"
++
+ 	"kubevirt.io/client-go/log"
+ 
+ 	"kubevirt.io/kubevirt/pkg/util"
+@@ -177,10 +177,13 @@ func RunAndMonitor(containerDiskDir, uid string) (int, error) {
+ 	cmd.Stdout = os.Stdout
+ 	cmd.Stderr = os.Stderr
+ 
++	log.Log.Info("11111")
++
+ 	if err := cmd.Start(); err != nil {
+-		log.Log.Reason(err).Error("failed to run virt-launcher")
++		log.Log.Reason(err).With("cmd", cmd.String()).Error("[AAA] failed to run virt-launcher")
+ 		return 1, err
+ 	}
++	log.Log.Info("22222")
+ 
+ 	exitStatus := make(chan int, 10)
+ 	sigs := make(chan os.Signal, 10)
+diff --git a/pkg/virt-launcher/virtwrap/util/libvirt_helper.go b/pkg/virt-launcher/virtwrap/util/libvirt_helper.go
+index 99ce4370f6..72c69f91d1 100644
+--- a/pkg/virt-launcher/virtwrap/util/libvirt_helper.go
++++ b/pkg/virt-launcher/virtwrap/util/libvirt_helper.go
+@@ -222,7 +222,7 @@ func (l LibvirtWrapper) StartVirtquemud(stopChan chan struct{}) {
+ 			cmd := exec.Command("/usr/sbin/virtqemud", args...)
+ 			if l.user != 0 {
+ 				cmd.SysProcAttr = &syscall.SysProcAttr{
+-					AmbientCaps: []uintptr{unix.CAP_NET_BIND_SERVICE},
++					AmbientCaps: []uintptr{unix.CAP_NET_BIND_SERVICE, unix.CAP_DAC_OVERRIDE},
+ 				}
+ 			}
+ 

images/libvirt/patches/002-treat-getpeercon-eintval-as-success.patch

@@ -9,7 +9,7 @@ import:
     after: install
 imageSpec:
   config:
-    user: 0
+    user: 107
 
 ---
 {{- define "virt-launcher-dependencies" -}}
@@ -139,6 +139,12 @@ binaries:
   - /usr/bin/sh
   - /usr/bin/bash
   - /usr/bin/uname
+  - /usr/bin/ls
+  - /usr/bin/id
+  - /usr/bin/cat
+  - /usr/bin/namei
+  - /usr/bin/whoami
+  - /usr/bin/strace
   - /usr/bin/nohup
   - /usr/bin/sleep
   - /usr/bin/cp
@@ -408,4 +414,4 @@ shell:
       mkdir -p /binaries
       echo 'go build -ldflags="-s -w" -o /binaries/node-labeller ./cmd/node-labeller'
       go build -ldflags="-s -w" -o /binaries/node-labeller ./cmd/node-labeller
-      echo "Done"
+      echo "Done"