Module machine_connector 

Varlink connections into machines, made from inside their PID namespace.

systemd’s credential-checking varlink servers (PID 1, networkd) refuse peers they cannot see in their own PID namespace: SO_PEERCRED reports pid 0 for a process in an ancestor namespace and the server closes the connection (see #211 and systemd/systemd#43807). Reaching a machine’s sockets through /proc/<leader>/root is therefore not enough — the connect() itself has to happen inside the machine’s PID namespace.

Joining a PID namespace needs CAP_SYS_ADMIN (and opening it CAP_SYS_PTRACE), and setns(CLONE_NEWPID) only moves future children. So per machine we spawn one small helper — monitord re-executed with HELPER_ARG — from a short-lived thread that joined the namespace. The helper opens the machine’s root directory, drops to an unprivileged user without any capabilities, and then serves connect requests over a socketpair: monitord names one of a fixed set of sockets (MachineSocket) and receives a connected fd back via SCM_RIGHTS. The kernel records peer credentials at connect() time, so the fd keeps working in monitord, which never leaves its own namespaces.

Connectors are cached per machine and leader PID (see crate::machines), so a machine costs one helper spawn rather than one per collection cycle, and each varlink connection only a request round trip over the socketpair.

Structs

MachineConnector

A helper inside one machine’s PID namespace handing out connected sockets.

Enums

MachineConnectorError

MachineSocket

The machine sockets a connector may connect to.

Constants

HELPER_ARG

Hidden first argument that makes monitord run as a machine connector helper instead of a collector. Dispatched from main before the tokio runtime starts; see helper_main.

Functions

helper_main

Entry point of the helper process. Never returns.

is_permission_denied

Whether err means monitord cannot join machine namespaces at all.