04.09.2024 13:45, Simon John wrote:
Package: qemu-system-common
Version: 1:9.0.2+ds-7
Severity: normal
Dear Maintainer,
From the "qemu (1:9.0.2+ds-2) unstable; urgency=medium" changelog:
* move helper binaries (qemu-bridge-helper, virtfs-proxy-helper,
vhost-user-gpu) from usr/lib/qemu to usr/libexec/qemu
Can we not do this until tools like virt-manager and virsh are changed, as now
we have this silly 10 second delay.
Oh. I didn't think about this. I somehow assumed all this stuff is
internal to qemu and not used by the outside world (it is in libexec
for a reason anyway). Now when you raised this issue to me, I think
the move was wrong to begin with.
Yes, it is about LFS compliance, but not breaking things has a higher
priority.
Where the 10 sec delay comes from, anyway? Ah. It is my script, the
wrapper, vhost-user-gpu. Yeah. So I did think about other usages.
Yes, this definitely needs a review. Thank you for bringing this
issue up.
Not sure how recommending users "update their scripts" helps when the main
packages that use them aren't being updated.
Well, the need to update the scripts is already quite annoying.
For now I'm having to delete the helpers in /usr/lib/qemu/ and create symlinks to the versions in /usr/libexec/qemu/ so why don't we symlink the whole
directory or better still update qemu-system-gui, qemu-system-common and virtiofsd to use the new path?
virtiofsd is a different matter though - since it is not part of qemu
anymore and ships in a separate package with separate .json file
telling where the binary is.
What do you mean
Similar to removing the setuid bit on qemu-bridge-helper, we need a way to override/prevent this on upgrade using dpkg as you can't make a symlink
immutable:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765936
Yes, this is a 10 years old bug which should now be revisited at least.
Back at the time - especially since I dealt with network interfaces and
security back then - it definitely looked unsafe to keep suid bit on
qemu-bridge-helper. Now quite some things has changed, and it looks
like it was only me in the world who think it's not good to have it
suid to root.
And yes, you're absolutely right here, the move to libexec/ breaks
the workaround for lack of suid bit on q-b-h in debian. This is
another something which I didn't think about when moving things.
I'll take a look at both of the issues.
Thank you once again!
/mjt
