Log calls made from dom0 to the journal

[ben-grande]

Follow dom0 calls:

    sudo journalctl -f SYSLOG_IDENTIFER=qrexec-client

[ben-grande]

The format differs from qrexec.parser qubes-qrexec-policy-daemon.

• It uses service+arg: src -> dest
• Here we use src -> dest: remote_cmdline

Because I the cmdline may be long, I think it's best if it's at the end. But I understand this causes a bit of inconsistency when reading and comparing against other formats.

[ben-grande]

PipelineRetryFailed

[ben-grande]

PipelineRetryFailed

[ben-grande]

Strange, the tests and build have systemd-devel for -lsystemd, but the tests cannot find it while the build can.

[ben-grande]

https://gitlab.com/QubesOS/qubes-core-qrexec/-/jobs/14597578686

Package libsystemd was not found in the pkg-config search path.
Perhaps you should add the directory containing `libsystemd.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libsystemd' not found

% fd libsystemd.pc /usr
/usr/lib64/pkgconfig/libsystemd.pc

% rpm -qf /usr/lib64/pkgconfig/libsystemd.pc
systemd-devel-256.17-1.fc41.x86_64

---

I see it now, package is not really being installed.

+ sudo dnf install 'python3dist(coverage)' 'python3dist(pytest)' 'python3dist(gbulb)' 'python3dist(pyinotify)' 'python3dist(pytest-asyncio)' qubes-libvchan-xen-devel pam-devel systemd-devel
Updating and loading repositories:
Repositories loaded.
Package "python3-coverage-7.3.2-6.fc42.x86_64" is already installed.
Package "python3-pytest-8.3.4-2.fc42.noarch" is already installed.
Package "python3-inotify-0.9.6-37.fc42.noarch" is already installed.
Package "python3-pytest-asyncio-0.24.0-2.fc42.noarch" is already installed.
Package "pam-devel-1.7.0-7.fc42.x86_64" is already installed.
Package                   Arch   Version       Repository                 Size
Installing:
 python3-gbulb            noarch 0.6.5-2.fc42  fedora                219.8 KiB
 qubes-libvchan-xen-devel x86_64 4.2.7-1.fc42  qubes-vm-r4.2-current   3.1 KiB
 systemd-devel            x86_64 257.13-1.fc42 updates               612.1 KiB
Transaction Summary:
 Installing:         3 packages
Total size of inbound packages is 746 KiB. Need to download 746 KiB.
After this operation, 835 KiB extra will be used (install 835 KiB, remove 0 B).
Is this ok [y/N]: Operation aborted by the user.
+ :

Cancelled ^^^

[ben-grande]

PipelineRetryFailed

[codecov]

Codecov Report

❌ Patch coverage is 14.28571% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.96%. Comparing base (3fb761a) to head (da45b05).
⚠️ Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
daemon/qrexec-client.c	14.28%	6 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #232      +/-   ##
==========================================
- Coverage   80.98%   80.96%   -0.03%     
==========================================
  Files          58       58              
  Lines       10815    10833      +18     
==========================================
+ Hits         8759     8771      +12     
- Misses       2056     2062       +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[marmarek]

libsystemd is a huge library (and also pulling in other heavy dependencies, like whole openssl), I don't want this in a program that's supposed to start fast. If anything, you can use syslog() function which is part of the standard library so doesn't require anything extra. But also, I'm not really convinced if this extra logging is necessary at all. It might be useful when debugging some specific cases, but otherwise it will be just a lot of noise about various qubes-internal calls.

[ben-grande]

But also, I'm not really convinced if this extra logging is necessary at all. It might be useful when debugging some specific cases, but otherwise it will be just a lot of noise about various qubes-internal calls.

Before I attempt to move to syslog, can we have a debug build available from the repos, already compiled, that include this change? Because the current process is:

git am *.patch
make all-dom0
sudo make -C daemon install
sudo systemctl restart qubes-qrexec-policy-daemon

I can also enable conditionally the logging only if a certain file exists, such as /var/run/qubes/debug or /usr/lib/qubes/debug for something persistent, but yes, the logging library would be included in every build this way.

So, would you accept:

1. A separate debug build already compiled (not debugsource)
2. Same package, library always included, but only use it when a certain debug file exists
3. Nothing, contributors should have their workaround

[marmarek]

No, I won't accept qrexec-client linked with libsystemd. It doesn't matter if function is used or not by default - linking is not conditional.

But, enabling logging based on presence of some debug flag file sounds okay. Looks like it could be simply /run/qubes-service/qrexec-debug, enabled by qvm-service --enable dom0 qrexec-debug.

[marmarek]

I don't like this change, when user calls the script directly on their own system, it should at least ask for confirmation.
The failure you got in CI was because you forgot to add the package to CI config (.gitlab-ci.yml).

[ben-grande]

PipelineRetryFailed