Merge ~sdeziel/ubuntu/+source/lxd-agent-loader:prepare-0.6 into ubuntu/+source/lxd-agent-loader:ubuntu/devel

[Simon Déziel]

Sync the systemd unit and udev rules files from upstream

[Simon Déziel (sdeziel)]

This was tested locally:

Create a test VM and copy the built package into it:

```
$ lxc launch ubuntu-daily:24.04 v1 --vm
$ sleep 30
$ lxc file push lxd-agent-loader_0.6_all.deb v1/tmp/
```

Use SSH to access the VM instead of `lxc exec` as the `exec` method depends on the `lxd-agent` that will be bounced during the package upgrade:

```
$ lxc exec v1 -- ssh-import-id sdeziel
$ ssh <email address hidden> apt-get install /tmp/lxd-agent-loader_0.6_all.deb
Warning: Permanently added 'v1.lxd' (ED25519) to the list of known hosts.
Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be upgraded:
  lxd-agent-loader
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/4074 B of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 /tmp/lxd-agent-loader_0.6_all.deb lxd-agent-loader all 0.6 [4074 B]
debconf: unable to initialize frontend: Dialog
debconf: (TERM is not set, so the dialog frontend is not usable.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Readline
debconf: (This frontend requires a controlling tty.)
debconf: falling back to frontend: Teletype
dpkg-preconfigure: unable to re-open stdin:
(Reading database ... 65520 files and directories currently installed.)
Preparing to unpack .../lxd-agent-loader_0.6_all.deb ...
Unpacking lxd-agent-loader (0.6) over (0.5) ...
Setting up lxd-agent-loader (0.6) ...
...
```

Confirm `lxc exec` still works:

```
$ lxc exec v1 -- hostname
v1
```

Confirm the `lxd-agent` was bounced during the package upgrade:

```
$ lxc exec v1 -- journalctl -u lxd-agent
...
Jan 12 15:13:27 v1 systemd[1]: Started lxd-agent.service - LXD - agent.
Jan 12 15:13:50 v1 systemd[1]: Stopping lxd-agent.service - LXD - agent...
Jan 12 15:13:50 v1 systemd[1]: lxd-agent.service: Deactivated successfully.
Jan 12 15:13:50 v1 systemd[1]: Stopped lxd-agent.service - LXD - agent.
Jan 12 15:13:50 v1 systemd[1]: Starting lxd-agent.service - LXD - agent...
Jan 12 15:13:51 v1 systemd[1]: Started lxd-agent.service - LXD - agent.
```

[Lucas Kanashiro (lucaskanashiro)]

Thanks for this MP Simon! In general it LGTM. I added some inline comments with a question and some suggestions for the changelog. Feel free to ping me if you have any question.

review: Needs Information

[Simon Déziel (sdeziel)]

@Lucas, thanks for the review. I believe I addressed all the points you raised.

[Simon Déziel (sdeziel)]

Force pushing seems to have lost my reply to your question re the Standards-Version bump. So before bumping from 4.6.0.1 to 4.6.2 we reviewed https://www.debian.org/doc/debian-policy/upgrading-checklist.html#version-4-6-1 and https://www.debian.org/doc/debian-policy/upgrading-checklist.html#version-4-6-2 and concluded no change was needed.

[Lucas Kanashiro (lucaskanashiro)]

Thanks for answering the question, what you did is the correct way of updating the Standards-Version.

I have some inline comments regarding the changelog entry.

review: Needs Fixing

[Simon Déziel (sdeziel)]

@Lucas, thanks again for that constructive feedback. I've massaged the d/changelog based on your good suggestions, please take another look.

[Lucas Kanashiro (lucaskanashiro)]

Thanks Simon! It looks way better now :) I have a simple fix for you inline.

review: Needs Fixing

[Simon Déziel (sdeziel)]

@Lucas, lines are now wrapped.

[Lucas Kanashiro (lucaskanashiro)]

Perfect, LGTM!

review: Approve

[Lucas Kanashiro (lucaskanashiro)]

Package uploaded:

Uploading lxd-agent-loader_0.6.dsc
Uploading lxd-agent-loader_0.6.tar.xz
Uploading lxd-agent-loader_0.6_source.buildinfo
Uploading lxd-agent-loader_0.6_source.changes

diff --git a/99-lxd-agent.rules b/99-lxd-agent.rules
index 82abd4d..74af920 100644
--- a/99-lxd-agent.rules
+++ b/99-lxd-agent.rules
@@ -1 +1,5 @@
-ACTION=="add", SYMLINK=="virtio-ports/org.linuxcontainers.lxd", TAG+="systemd", ACTION=="add", RUN+="/bin/systemctl start lxd-agent.service"
+# Start the lxd-agent.service when QEMU serial devices (symlinks in virtio-ports) appear.
+SYMLINK=="virtio-ports/com.canonical.lxd", TAG+="systemd", ENV{SYSTEMD_WANTS}+="lxd-agent.service"
+
+# Legacy serial device name for backward compatibility.
+SYMLINK=="virtio-ports/org.linuxcontainers.lxd", TAG+="systemd", ENV{SYSTEMD_WANTS}+="lxd-agent.service"
diff --git a/debian/changelog b/debian/changelog
index e31a583..5969e98 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,21 @@
+lxd-agent-loader (0.6) noble; urgency=medium
+
+  * Update for new virtio-serial device name (LP: #2044859)
+    - lxd-agent-setup: Add script comment
+    - lxd-agent.service: Update lxd-agent systemd unit
+    - 99-lxd-agent.rules: Update udev rules
+  * Small tweaks to lxd-agent-setup script:
+    - lxd-agent-setup: do not preserve the ownership during the cp to avoid
+      chown
+    - lxd-agent-setup: reduce the size of /run/lxd_agent tmpfs and set
+      nodev,nosuid,noatime
+    - lxd-agent-setup: mount the config drive as readonly
+    - lxd-agent-setup: consistently rely on $PATH to find binaries
+  * d/control: Update homepage attribute and bump Standards-Version to 4.6.2
+  * d/copyright: Update copyright year and project source
+
+ -- Simon Deziel <[e-mail]>  Mon, 27 Nov 2023 17:01:06 -0500
+
 lxd-agent-loader (0.5) jammy; urgency=medium
 
   * Units: Sync with upstream:
diff --git a/debian/control b/debian/control
index c12c1e1..64270a4 100644
--- a/debian/control
+++ b/debian/control
@@ -2,8 +2,8 @@ Source: lxd-agent-loader
 Section: admin
 Priority: optional
 Maintainer: Ubuntu Developers <[e-mail]>
-Standards-Version: 4.6.0.1
-Homepage: https://linuxcontainers.org/
+Standards-Version: 4.6.2
+Homepage: https://github.com/canonical/lxd
 Build-Depends: debhelper-compat (= 13)
 Rules-Requires-Root: no
 
@@ -15,5 +15,5 @@ Description: LXD - VM agent loader
  The LXD VM agent enables access to advanced LXD features such as file
  transfer and command spawning inside virtual machines run by LXD.
  .
- This package contains init scripts that will automatically load the
- agent and run it when started in a LXD VM.
+ This package will automatically load and run the agent when started in
+ a LXD VM.
diff --git a/debian/copyright b/debian/copyright
index 528d4c4..49753e2 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -1,12 +1,12 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: lxd
 Upstream-Contact: [e-mail]
-Source: https://linuxcontainers.org/lxd/downloads
+Source: https://github.com/canonical/lxd
 Comment: The content of this package is synced with
- https://github.com/lxc/lxd/blob/master/lxd/instance/drivers/driver_qemu.go
+ https://github.com/canonical/lxd/blob/main/lxd/instance/drivers/driver_qemu.go
 
 Files: *
-Copyright: 2020 LXD contributors
+Copyright: 2023 LXD contributors
 License: Apache-2
 
 License: Apache-2
diff --git a/lxd-agent-setup b/lxd-agent-setup
index 42e16ae..4999c08 100755
--- a/lxd-agent-setup
+++ b/lxd-agent-setup
@@ -1,15 +1,21 @@
 #!/bin/sh
+#
+# Setup script for lxd-agent that is executed by the lxd-agent systemd unit before lxd-agent is started.
+# The script sets up a temporary mount point, copies data from the mount (including lxd-agent binary),
+# and then unmounts it. It also ensures appropriate permissions for the LXD agent's runtime directory.
+#
+
 set -eu
 PREFIX="/run/lxd_agent"
 
 # Functions.
 mount_virtiofs() {
-    mount -t virtiofs config "${PREFIX}/.mnt" >/dev/null 2>&1
+    mount -t virtiofs config "${PREFIX}/.mnt" -o ro >/dev/null 2>&1
 }
 
 mount_9p() {
-    /sbin/modprobe 9pnet_virtio >/dev/null 2>&1 || true
-    /bin/mount -t 9p config "${PREFIX}/.mnt" -o access=0,trans=virtio >/dev/null 2>&1
+    modprobe 9pnet_virtio >/dev/null 2>&1 || true
+    mount -t 9p config "${PREFIX}/.mnt" -o ro,access=0,trans=virtio >/dev/null 2>&1
 }
 
 fail() {
@@ -22,18 +28,15 @@ fail() {
 # Setup the mount target.
 umount -l "${PREFIX}" >/dev/null 2>&1 || true
 mkdir -p "${PREFIX}"
-mount -t tmpfs tmpfs "${PREFIX}" -o mode=0700,size=50M
+mount -t tmpfs tmpfs "${PREFIX}" -o mode=0700,nodev,nosuid,noatime,size=25M
 mkdir -p "${PREFIX}/.mnt"
 
 # Try virtiofs first.
 mount_virtiofs || mount_9p || fail "Couldn't mount virtiofs or 9p, failing."
 
 # Copy the data.
-cp -Ra "${PREFIX}/.mnt/"* "${PREFIX}"
+cp -Ra --no-preserve=ownership "${PREFIX}/.mnt/"* "${PREFIX}"
 
 # Unmount the temporary mount.
 umount "${PREFIX}/.mnt"
 rmdir "${PREFIX}/.mnt"
-
-# Fix up permissions.
-chown -R root:root "${PREFIX}"
diff --git a/lxd-agent.service b/lxd-agent.service
index e68a65b..66bc4f3 100644
--- a/lxd-agent.service
+++ b/lxd-agent.service
@@ -1,8 +1,10 @@
+# Systemd unit for lxd-agent. It ensures the lxd-agent is copied from the shared filesystem before
+# it is started. The service is triggered dynamically via udev rules when certain virtio-ports are
+# detected, rather than being enabled at boot.
 [Unit]
 Description=LXD - agent
-Documentation=https://linuxcontainers.org/lxd
-ConditionPathExists=/dev/virtio-ports/org.linuxcontainers.lxd
-Before=cloud-init.target cloud-init.service cloud-init-local.service
+Documentation=https://documentation.ubuntu.com/lxd/en/latest/
+Before=multi-user.target cloud-init.target cloud-init.service cloud-init-local.service
 DefaultDependencies=no
 
 [Service]
@@ -14,6 +16,3 @@ Restart=on-failure
 RestartSec=5s
 StartLimitInterval=60
 StartLimitBurst=10
-
-[Install]
-WantedBy=multi-user.target