Fix whippet defaults and wildcard replacements #720
Merged
+210
−73
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
KCSesh
reviewed
Nov 7, 2025
bcressey
reviewed
Nov 7, 2025
Split Send and Recieve records to their own structs to establish a clearer separation of concerns while transforming a Rule to either type of record. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
arnaldo2792
force-pushed
the
fix-whippet-defaults
branch
from
12493e3 to
a7bc759
Compare
bcressey
reviewed
Nov 7, 2025
Use the correct default value for the `max_fds` fields of send and receive records. Replace wildcard values for send and receive rules with an empty string as this is what the broker uses for fallback rules. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>
arnaldo2792
force-pushed
the
fix-whippet-defaults
branch
from
a7bc759 to
6fda99e
Compare
Contributor
Author
|
Forced push implements the |
bcressey
approved these changes
Nov 11, 2025
KCSesh
approved these changes
Nov 11, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes:
The first patch of the splits
SendReceiveRecordto their own structures. I did this after discussing with @cbgbt that it will be best to have them separated to have a clear separation of concerns and make it harder for developers to construct the wrong type from aRule.The second patch of the series fixes the default value used by
SendRecordandReceiveRecordfor themax_fds, to match what thedbus-launcheruses. As part of this change, I also fixed howwhippethandles wildcards*while translatingRuletoSendandReceiverecords, and replaces those values with empty strings following what thedbus-launcherdoes.Testing done:
Prior to this change,
systemd-nspawnin systemd 257 failed to create containers as one of the Dbus messages includedmax_fds = 1which failed to match the broker conditionMESSAGE_max_fds <= RULE_max_fds, sinceRULE_max_fdswas set to 0 for all rules.After this change,
systemd-nspawnruns successfully:bash-5.1# systemd-analyze --version systemd 257 (257.7) -PAM -AUDIT +SELINUX -APPARMOR -IMA +IPE -SMACK +SECCOMP -GCRYPT -GNUTLS -OPENSSL +ACL +BLKID -CURL -ELFUTILS -FIDO2 -IDN2 -IDN -IPTC +KMOD -LIBCRYPTSETUP -LIBCRYPTSETUP_PLUGINS +LIBFDISK -PCRE2 -PWQUALITY -P11KIT -QRENCODE -TPM2 -BZIP2 -LZ4 -XZ -ZLIB -ZSTD -BPF_FRAMEWORK -BTF -XKBCOMMON -UTMP -SYSVINIT -LIBARCHIVE bash-5.1# systemctl status whippet.service ● whippet.service - D-Bus System Message Bus Loaded: loaded (/x86_64-bottlerocket-linux-gnu/sys-root/usr/lib/systemd/system/whippet.service; enabled; preset: enabled) Drop-In: /x86_64-bottlerocket-linux-gnu/sys-root/usr/lib/systemd/system/service.d └─00-aws-config.conf Active: active (running) since Thu 2025-11-06 04:54:25 UTC; 18h ago Invocation: 6278eaaeb65f404c9dc940b2a226692e TriggeredBy: ● dbus.socket Main PID: 1272 (whippet) Tasks: 6 (limit: 18596) Memory: 5.5M (peak: 21.8M) CPU: 4.372s CGroup: /system.slice/whippet.service ├─1272 /usr/bin/whippet └─1277 /usr/bin/dbus-broker --log 12 --controller 11 --machine-id ec2aaf8da556039d3f042c6c3ce12549 --max-bytes 536870912 --max-fds 4096 --max-matches 16384 Nov 06 23:29:05 ip-172-31-46-10.us-west-2.compute.internal whippet[1277]: POLICY_NAME_CHECK: RECV name=org.freedesktop.systemd1 subject_id=1 subject_seclabel=system_u:system_r:init_t:s0 Nov 06 23:29:05 ip-172-31-46-10.us-west-2.compute.internal whippet[1277]: POLICY_NAME_RESULT: RECV name=org.freedesktop.systemd1 subject_id=1 result=rules_found Nov 06 23:29:05 ip-172-31-46-10.us-west-2.compute.internal whippet[1277]: POLICY_RULE_EVAL: RECV subject_id=1 name=org.freedesktop.systemd1 rule_priority=7905747460161236529 priority_match=YES type_match=YES path_match=YES interface_match=YES member_match=YES broadcast_match=YES f… Nov 06 23:29:05 ip-172-31-46-10.us-west-2.compute.internal whippet[1277]: POLICY_RULE_MATCH: RECV name=org.freedesktop.systemd1 path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=UnitRemoved type=4 broadcast=true n_fds=0 rule_path…1236529 verdict=ALLOW Nov 06 23:29:05 ip-172-31-46-10.us-west-2.compute.internal whippet[1277]: POLICY_RULE_EVAL: RECV subject_id=1 name=org.freedesktop.systemd1 rule_priority=2635249153387079026 priority_match=NO type_match=YES path_match=YES interface_match=YES member_match=YES broadcast_match=YES fd… Nov 06 23:29:05 ip-172-31-46-10.us-west-2.compute.internal whippet[1277]: POLICY_FINAL_VERDICT: RECV subject_id=1 interface=org.freedesktop.systemd1.Manager method=UnitRemoved path=/org/freedesktop/systemd1 type=4 broadcast=true n_fds=0 priority=7905747460161236529 verdict=ALLOW Nov 06 23:29:05 ip-172-31-46-10.us-west-2.compute.internal whippet[1277]: [BROKER] Driver dispatch result - peer :1.1, result=0 Nov 06 23:29:05 ip-172-31-46-10.us-west-2.compute.internal whippet[1277]: [BROKER] No message available - peer :1.1 Nov 06 23:29:05 ip-172-31-46-10.us-west-2.compute.internal whippet[1277]: [BROKER] No message available - peer :1.1 Nov 06 23:29:05 ip-172-31-46-10.us-west-2.compute.internal whippet[1277]: [BROKER] No message available - peer :1.2 Hint: Some lines were ellipsized, use -l to show in full. bash-5.1# systemd-nspawn -D /var/lib/machines/test-container/ --register=no bash ░ Spawning container test-container on /var/lib/machines/test-container. ░ Press Ctrl-] three times within 1s to kill container. bash-5.2#I tested creating a container with its own ENI, and confirmed that all the plumbing to set that up works:
I had internet access from within the container:
I tested
networkctlcan configure the extra ENI in my host:bash-5.1# networkctl list IDX LINK TYPE OPERATIONAL SETUP 1 lo loopback carrier unmanaged 2 eth0 ether routable configured 3 docker0 bridge no-carrier unmanaged 6 eth1 ether routable configured 4 links listed. bash-5.1# ping -I eth1 8.8.8.8 PING 8.8.8.8 (8.8.8.8) from 172.31.40.46 eth1: 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=5.97 ms ^C --- 8.8.8.8 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 5.974/5.974/5.974/0.000 ms bash-5.1# resolvectl status eth1 Link 6 (eth1) Current Scopes: DNS Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported Current DNS Server: 8.8.8.8 DNS Servers: 8.8.8.8 172.31.0.2 Default Route: yes bash-5.1#Terms of contribution:
By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.