Bug 2346248

Summary:	systemd presets request - aesmd.service mpa_registration.service qgs.service
Product:	[Fedora] Fedora	Reporter:	Daniel Berrangé <berrange>
Component:	fedora-release	Assignee:	Stephen Gallagher <sgallagh>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	alciregi, fedoraproject, kevin, mboddu, pbrobinson, samyak.jn11, sgallagh, thrcka, zbyszek
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	fedora-release-43-0.4	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-02-18 13:29:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2346158

Description Daniel Berrangé 2025-02-18 12:31:23 UTC

* Does the service require post-rpm-installation configuration in order to be useful (for example, does it need manual edits to a configuration file)?

Configuration is an optional step, the defaults are suitable to get started.

* Does the service listen on a network socket for connections originating on a separate physical or virtual machine?

No, aesmd.service & qgs.service listen on UNIX sockets; mpa_registration.service does not listen on sockets at all.

* Is the service non-persistent (i.e. run once at startup and exit)?

aesmd.service & qgs.service are persistent long running services, mpa_registration is single-shot run & exit. The latter will check EFI variables to determine if any work is needed and silently exits if nothing needs doing, as such it can be safely run on every boot to "do the right thing(tm)"

* What is the exact name (or names) of the systemd unit files to be enabled?

 aesmd.service  
 mpa_registration.service  
 qgs.service

Upstream has no support for socket activation for the two persistent daemons unfortunately.

* Is this request for all Fedora deliverables or only for some Editions (list them)?

All

Comment 1 Daniel Berrangé 2025-02-18 12:33:14 UTC

Note, that all of these services are conditionalized on /dev/sgx_enclave existing

$ grep Condition *service
aesmd.service:ConditionPathExists=/dev/sgx_enclave
mpa_registration.service:ConditionPathExists=/dev/sgx_enclave
qgs.service:ConditionPathExists=/dev/sgx_enclave


The kernel will auto-create /dev/sgx_enclave if-and-only-if the user has gone into the firmware and turned on the SGX feature, as it is usually not enabled by default.

Comment 2 Daniel Berrangé 2025-02-18 12:42:49 UTC

I speculatively created a PR:

https://src.fedoraproject.org/rpms/fedora-release/pull-request/365

Assuming its accepted, this will also be required to be cherry-picked over to the Fedora 42 branch for https://fedoraproject.org/w/index.php?title=Changes/IntelSGX