Skip to content

Commit 68be6f2

Browse files
janduboisjandubois
authored
Merge pull request #4384 from AkihiroSuda/fix-4334
templates: fedora-43: disable ssh.overVsock as a workaround for SELinux issue
2 parents 155afcb + bcfa689 commit 68be6f2

File tree

13 files changed

+64
-19
lines changed

13 files changed

+64
-19
lines changed

‎hack/test-templates.sh‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -336,30 +336,30 @@ if [[ -n ${CHECKS["ssh-over-vsock"]} ]]; then
336336
if [[ "$(limactl ls "${NAME}" --yq .vmType)" == "vz" ]]; then
337337
INFO "Testing SSH over vsock"
338338
set -x
339-
INFO "Testing LIMA_SSH_OVER_VSOCK=true environment"
339+
INFO "Testing .ssh.overVsock=true configuration"
340340
limactl stop "${NAME}"
341341
# Detection of the SSH server on VSOCK may fail; however, a failing log indicates that controlling detection via the environment variable works as expected.
342-
if ! LIMA_SSH_OVER_VSOCK=true limactl start "${NAME}" 2>&1 | grep -i -E "(started vsock forwarder|Failed to detect SSH server on vsock)"; then
342+
if ! limactl start --set '.ssh.overVsock=true' "${NAME}" 2>&1 | grep -i -E "(started vsock forwarder|Failed to detect SSH server on vsock)"; then
343343
set +x
344344
diagnose "${NAME}"
345-
ERROR "LIMA_SSH_OVER_VSOCK=true did not enable vsock forwarder"
345+
ERROR ".ssh.overVsock=true did not enable vsock forwarder"
346346
exit 1
347347
fi
348-
INFO 'Testing LIMA_SSH_OVER_VSOCK="" environment'
348+
INFO 'Testing .ssh.overVsock=null configuration'
349349
limactl stop "${NAME}"
350350
# Detection of the SSH server on VSOCK may fail; however, a failing log indicates that controlling detection via the environment variable works as expected.
351-
if ! LIMA_SSH_OVER_VSOCK="" limactl start "${NAME}" 2>&1 | grep -i -E "(started vsock forwarder|Failed to detect SSH server on vsock)"; then
351+
if ! limactl start --set '.ssh.overVsock=null' "${NAME}" 2>&1 | grep -i -E "(started vsock forwarder|Failed to detect SSH server on vsock)"; then
352352
set +x
353353
diagnose "${NAME}"
354-
ERROR "LIMA_SSH_OVER_VSOCK= did not enable vsock forwarder"
354+
ERROR ".ssh.overVsock=null did not enable vsock forwarder"
355355
exit 1
356356
fi
357-
INFO "Testing LIMA_SSH_OVER_VSOCK=false environment"
357+
INFO "Testing .ssh.overVsock=false configuration"
358358
limactl stop "${NAME}"
359-
if ! LIMA_SSH_OVER_VSOCK=false limactl start "${NAME}" 2>&1 | grep -i "skipping detection of SSH server on vsock port"; then
359+
if ! limactl start --set '.ssh.overVsock=false' "${NAME}" 2>&1 | grep -i "skipping detection of SSH server on vsock port"; then
360360
set +x
361361
diagnose "${NAME}"
362-
ERROR "LIMA_SSH_OVER_VSOCK=false did not disable vsock forwarder"
362+
ERROR ".ssh.overVsock=false did not disable vsock forwarder"
363363
exit 1
364364
fi
365365
set +x

‎pkg/driver/krunkit/krunkit_driver_darwin_arm64.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,10 @@ func (l *LimaKrunkitDriver) CreateDisk(ctx context.Context) error {
6464
}
6565

6666
func (l *LimaKrunkitDriver) Start(ctx context.Context) (chan error, error) {
67+
if l.Instance.Config.SSH.OverVsock != nil && *l.Instance.Config.SSH.OverVsock {
68+
logrus.Warn(".ssh.overVsock is not implemented yet for krunkit driver")
69+
}
70+
6771
var err error
6872
l.usernetClient, l.stopUsernet, err = startUsernet(ctx, l.Instance)
6973
if err != nil {

‎pkg/driver/qemu/qemu_driver.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,10 @@ func (l *LimaQemuDriver) Start(_ context.Context) (chan error, error) {
247247
}
248248
}()
249249

250+
if l.Instance.Config.SSH.OverVsock != nil && *l.Instance.Config.SSH.OverVsock {
251+
logrus.Warn(".ssh.overVsock is not implemented yet for QEMU driver")
252+
}
253+
250254
qCfg := Config{
251255
Name: l.Instance.Name,
252256
InstanceDir: l.Instance.Dir,

‎pkg/driver/vz/vm_darwin.go‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -105,16 +105,11 @@ func startVM(ctx context.Context, inst *limatype.Instance, sshLocalPort int) (vm
105105
defer close(notifySSHLocalPortAccessible)
106106
usernetSSHLocalPort := sshLocalPort
107107
useSSHOverVsock := true
108-
if envVar := os.Getenv("LIMA_SSH_OVER_VSOCK"); envVar != "" {
109-
b, err := strconv.ParseBool(envVar)
110-
if err != nil {
111-
logrus.WithError(err).Warnf("invalid LIMA_SSH_OVER_VSOCK value %q", envVar)
112-
} else {
113-
useSSHOverVsock = b
114-
}
108+
if inst.Config.SSH.OverVsock != nil {
109+
useSSHOverVsock = *inst.Config.SSH.OverVsock
115110
}
116111
if !useSSHOverVsock {
117-
logrus.Info("LIMA_SSH_OVER_VSOCK is false, skipping detection of SSH server on vsock port")
112+
logrus.Info("ssh.overVsock is false, skipping detection of SSH server on vsock port")
118113
} else if err := usernetClient.WaitOpeningSSHPort(ctx, inst); err == nil {
119114
hostAddress := net.JoinHostPort(inst.SSHAddress, strconv.Itoa(usernetSSHLocalPort))
120115
if err := wrapper.startVsockForwarder(ctx, 22, hostAddress); err == nil {

‎pkg/driver/vz/vz_driver_darwin.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,10 @@ func (l *LimaVzDriver) FillConfig(ctx context.Context, cfg *limatype.LimaYAML, _
140140
cfg.MountType = ptr.Of(limatype.VIRTIOFS)
141141
}
142142

143+
if cfg.SSH.OverVsock == nil {
144+
cfg.SSH.OverVsock = ptr.Of(true)
145+
}
146+
143147
var vzOpts limatype.VZOpts
144148
if err := limayaml.Convert(cfg.VMOpts[limatype.VZ], &vzOpts, "vmOpts.vz"); err != nil {
145149
logrus.WithError(err).Warnf("Couldn't convert %q", cfg.VMOpts[limatype.VZ])

‎pkg/driver/wsl2/wsl_driver_windows.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,11 @@ func (l *LimaWslDriver) Delete(ctx context.Context) error {
220220
}
221221

222222
func (l *LimaWslDriver) Start(ctx context.Context) (chan error, error) {
223+
if l.Instance.Config.SSH.OverVsock != nil && *l.Instance.Config.SSH.OverVsock {
224+
// Probably never supportable for WSL2
225+
logrus.Warn(".ssh.overVsock is not supported for WSL2 driver")
226+
}
227+
223228
logrus.Infof("Starting WSL VM")
224229
status, err := getWslStatus(ctx, l.Instance.Name)
225230
if err != nil {

‎pkg/limatype/lima_yaml.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,8 @@ type SSH struct {
196196
ForwardAgent *bool `yaml:"forwardAgent,omitempty" json:"forwardAgent,omitempty" jsonschema:"nullable"` // default: false
197197
ForwardX11 *bool `yaml:"forwardX11,omitempty" json:"forwardX11,omitempty" jsonschema:"nullable"` // default: false
198198
ForwardX11Trusted *bool `yaml:"forwardX11Trusted,omitempty" json:"forwardX11Trusted,omitempty" jsonschema:"nullable"` // default: false
199+
200+
OverVsock *bool `yaml:"overVsock,omitempty" json:"overVsock,omitempty" jsonschema:"nullable"` // default: depends on VMType
199201
}
200202

201203
type Firmware struct {

‎pkg/limayaml/defaults.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,26 @@ func FillDefault(ctx context.Context, y, d, o *limatype.LimaYAML, filePath strin
375375
y.SSH.ForwardX11Trusted = ptr.Of(false)
376376
}
377377

378+
if y.SSH.OverVsock == nil {
379+
y.SSH.OverVsock = d.SSH.OverVsock
380+
}
381+
if o.SSH.OverVsock != nil {
382+
y.SSH.OverVsock = o.SSH.OverVsock
383+
}
384+
// y.SSH.OverVsock default value depends on the driver; filled in driver-specific FillDefault()
385+
386+
// The deprecated environment variable LIMA_SSH_OVER_VSOCK takes precedence over .ssh.overVsock
387+
if envVar := os.Getenv("LIMA_SSH_OVER_VSOCK"); envVar != "" {
388+
logrus.Warn("The environment variable LIMA_SSH_OVER_VSOCK is deprecated in favor of the YAML field .ssh.overVsock")
389+
b, err := strconv.ParseBool(envVar)
390+
if err != nil {
391+
logrus.WithError(err).Warnf("invalid LIMA_SSH_OVER_VSOCK value %q", envVar)
392+
} else {
393+
logrus.Debugf("Overriding ssh.overVsock from %v to %v via LIMA_SSH_OVER_VSOCK", y.SSH.OverVsock, &b)
394+
y.SSH.OverVsock = ptr.Of(b)
395+
}
396+
}
397+
378398
hosts := make(map[string]string)
379399
// Values can be either names or IP addresses. Name values are canonicalized in the hostResolver.
380400
maps.Copy(hosts, d.HostResolver.Hosts)

‎templates/_images/fedora-43.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@ images:
99

1010
# No RISC-V release yet for Fedora 43: https://download.fedoraproject.org/pub/alt/risc-v/release/
1111

12+
ssh:
13+
# ssh.overVsock does not work with Fedora 43 due to a SELinux policy issue
14+
# https://github.com/lima-vm/lima/issues/4334#issuecomment-3561294333
15+
# avc: denied { getattr } for pid=1355 comm="sshd-auth" scontext=system_u:system_r:sshd_auth_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=vsock_socket permissive=1
16+
overVsock: false
17+
1218
# # NOTE: Intel Mac with macOS prior to 15.5 requires setting vmType to qemu
1319
# # https://github.com/lima-vm/lima/issues/3334
1420
# vmType: qemu

‎templates/default.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,9 @@ ssh:
138138
# Trust forwarded X11 clients
139139
# 🟢 Builtin default: false
140140
forwardX11Trusted: null
141+
# Enable SSH over vsock.
142+
# 🟢 Builtin default: true for vz, false for other vmTypes
143+
overVsock: null
141144

142145
caCerts:
143146
# If set to `true`, this will remove all the default trusted CA certificates that

0 commit comments

Comments
 (0)