[libvirt] [PATCH 23/29] remote: introduce virtproxyd daemon to handle IP connectivity

[Daniel P. Berrangé]

The libvirtd daemon provides the traditional libvirt experience where
all the drivers are in a single daemon, and is accessible over both
local UNIX sockets and remote IP sockets.

In the new world we're having a set of per-driver daemons which will
primarily be accessed locally via their own UNIX sockets.

We still, however, need to allow for case of applications which will
connect to libvirt remotely. These remote connections can be done as
TCP/TLS sockets, or by SSH tunnelling to the UNIX socket.

In the later case, the old libvirt.so clients will only know about
the path to the old libvirtd socket /var/run/libvirt/libvirt-sock,
and not the new driver sockets /var/run/libvirt/virtqemud-sock.

It is also not desirable to expose the main driver specific daemons
over IP directly to minimize their attack service.

Thus the virtproxyd daemon steps into place, to provide TCP/TLS sockets,
and back compat for the old libvirtd UNIX socket path(s). It will then
forward all RPC calls made to the appropriate driver specific daemon.

Essentially it is equivalent to the old libvirtd with absolutely no
drivers registered except for the remote driver (and other stateless
drivers in libvirt.so).

We could have modified libvirtd so none of the drivers are registed
to get the same end result. We could even add a libvirtd.conf parameter
to control whether the drivers are loaded to enable users to switch back
to the old world if we discover bugs in the split-daemon model. Using a
new daemon though has some advantages

 - We can make virtproxyd and the virtXXXd per-driver daemons all
   have "Conflicts: libvirtd.service" in their systemd unit files.
   This will guarantee that libvirtd is never started at the same
   time, as this would result in two daemons running the same driver,
   which will lead to exciting failure modes.

 - It allows us to break CLI compat to remove the --listen parameter.
   Both listen_tcp and listen_tls parameters in /etc/libvirtd/virtd.conf
   will default to zero. Either TLS or TCP can be enabled exclusively
   though virtd.conf without requiring the extra step of adding --listen.

 - It allows us to set a strict SELinux policy over virtproxyd. For
   back compat the libvirtd policy must continue to allow all drivers
   to run. We can't easily give a second policy to libvirtd which
   locks it down. By introducing a new virtproxyd we can set a strict
   policy for that daemon only.

 - It gets rid of the wierd naming of having a daemon with "lib" in
   its name. Now all normal daemons libvirt ships will have "virt"
   as their prefix not "libvirt".

 - Distros can more easily choose their upgrade path. They can
   ship both sets of daemons in their packages, and choose to
   either enable libvirtd, or enable the per-driver daemons and
   virtproxyd out of the box. Users can easily override this if
   desired by just tweaking which systemd units are active.

After some time we can deprecate use of libvirtd and after some more
time delete it entirely, leaving us in a pretty world filled with
prancing unicorns.

Signed-off-by: Daniel P. Berrangé <berrange at redhat.com>
---
 src/remote/Makefile.inc.am | 18 ++++++++++++++----
 src/remote/remote_daemon.c | 12 ++++++++++--
 2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/src/remote/Makefile.inc.am b/src/remote/Makefile.inc.am
index 43ad53bedb..316c7ea0b6 100644
--- a/src/remote/Makefile.inc.am
+++ b/src/remote/Makefile.inc.am
@@ -161,7 +161,7 @@ endif ! WITH_REMOTE
 
 if WITH_LIBVIRTD
 
-sbin_PROGRAMS += libvirtd
+sbin_PROGRAMS += libvirtd virtproxyd
 
 augeas_DATA += remote/libvirtd.aug
 
@@ -174,7 +174,6 @@ CLEANFILES += remote/libvirtd.aug remote/test_libvirtd.aug
 man8_MANS += libvirtd.8
 
 libvirtd_SOURCES = $(REMOTE_DAEMON_SOURCES)
-
 libvirtd_CFLAGS = \
 	$(REMOTE_DAEMON_CFLAGS) \
 	-DSOCK_NAME="\"libvirt-sock\"" \
@@ -182,12 +181,23 @@ libvirtd_CFLAGS = \
 	-DSOCK_NAME_ADMIN="\"libvirt-admin-sock\"" \
 	-DDAEMON_NAME="\"libvirtd\"" \
 	-DENABLE_IP \
+	-DLIBVIRTD \
 	$(NULL)
-
 libvirtd_LDFLAGS = $(REMOTE_DAEMON_LDFLAGS)
-
 libvirtd_LDADD = $(REMOTE_DAEMON_LDADD)
 
+virtproxyd_SOURCES = $(REMOTE_DAEMON_SOURCES)
+virtproxyd_CFLAGS = \
+	$(REMOTE_DAEMON_CFLAGS) \
+	-DSOCK_NAME="\"libvirt-sock\"" \
+	-DSOCK_NAME_RO="\"libvirt-sock-ro\"" \
+	-DSOCK_NAME_ADMIN="\"libvirt-admin-sock\"" \
+	-DDAEMON_NAME="\"virtproxyd\"" \
+	-DENABLE_IP \
+	$(NULL)
+virtproxyd_LDFLAGS = $(REMOTE_DAEMON_LDFLAGS)
+virtproxyd_LDADD = $(REMOTE_DAEMON_LDADD)
+
 remote/libvirtd.conf: remote/libvirtd.conf.in
 	$(AM_V_GEN)sed \
 		-e '/:: CUT ENABLE_IP ::/d' \
diff --git a/src/remote/remote_daemon.c b/src/remote/remote_daemon.c
index d01a303f70..36e8acfca8 100644
--- a/src/remote/remote_daemon.c
+++ b/src/remote/remote_daemon.c
@@ -298,11 +298,19 @@ static int daemonErrorLogFilter(virErrorPtr err, int priority)
 
 static int daemonInitialize(void)
 {
-#ifdef MODULE_NAME
+#ifndef LIBVIRTD
+# ifdef MODULE_NAME
+    /* This a dedicated per-driver daemon build */
     if (virDriverLoadModule(MODULE_NAME, MODULE_NAME "Register", true) < 0)
         return -1;
+# else
+    /* This is virtproxyd which merely proxies to the per-driver
+     * daemons for back compat, and also allows IP connectivity.
+     */
+# endif
 #else
-    /*
+    /* This is the legacy monolithic libvirtd built with all drivers
+     *
      * Note that the order is important: the first ones have a higher
      * priority when calling virStateInitialize. We must register the
      * network, storage and nodedev drivers before any stateful domain
-- 
2.21.0