On 13/06/2012, at 12:54 PM, Gao,Yan wrote:
On 06/13/12 10:40, Gao,Yan wrote:
> On 06/13/12 10:15, Andrew Beekhof wrote:
>>
>> On 13/06/2012, at 12:05 PM, Angus Salkeld wrote:
>>
>>> On 13/06/12 11:48 +1000, Andrew Beekhof wrote:
>>>>
>>>> On 13/06/2012, at 11:34 AM, Gao,Yan wrote:
>>>>
>>>>> Hi Andrew,
>>>>>
>>>>> On 06/13/12 07:18, Andrew Beekhof wrote:
>>>>>>
>>>>>> On 12/06/2012, at 10:45 PM, Gao,Yan wrote:
>>>>>>
>>>>>>> On 06/12/12 19:56, Gao,Yan wrote:
>>>>>>>> Hi Angus,
>>>>>>>> Thanks a lot for introducing this! I also added the
following patch,
>>>>>>>> modified "examples/ipcserver.c", and it works
for both QB_IPC_SHM and
>>>>>>>> QB_IPC_SOCKET mode in the example.
>>>>>>>>
>>>>>>>> I encountered weird behaviors for pacemaker cib though.
Chmod works
>>>>>>>> fine, but the group of file has never been changed. The
only difference
>>>>>>>> I can think of is that cib's uid
"hacluster" comes from setuid() by
>>>>>>>> root. But it still doesn't make sense to me that
it's not allowed to
>>>>>>>> change the group of a file to "hacluster"'s
main group...
>>>>>>> So it is, "hacluster" got from setuid() by root
cannot change the group
>>>>>>> of a file to "hacluster"'s main group --
"haclient", unless we also
>>>>>>> setgid to "haclient" before setuid to
"hacluster", otherwise "root" must
>>>>>>> belong to "haclient" group.
>>>>>>
>>>>>> Really? That would surprise me greatly.
>>>>> Me too. :-\ It seems setuid() doesn't change any of the group
>>>>> information of the process unless setgid() _before_ that -- setgid()
>>>>> after setuid() is not allowed either.
>>>>
>>>> I thought "unpriv client -> root server" and "root
client -> unpriv server" both worked already.
>>>> I might have fallen behind, could you restate the problem?
>>>
>>> I think the issue here is the server is non-root-user:root-group And
>>> the client is non-root-user:non-root-group.
>>>
>>> So server can't chown the file it created to be the uid of the client.
>>>
>>> What we are trying to do now is:
>>> chgrp the file to a common group and chmod to 0660.
>>
>> Ok, 0660 i can handle :-)
>>
>>>
>>> This works for me (for 2 different users with a common group).
> Works for me too, if they are in a common group, and if no one comes
> from setuid().
>
>>> But Yan is struggling with the server as it gets the group id
>>> via setgid().
>>
>> The server will know the group name/id at startup, could we put it in a
connection setting somewhere?
>> We will always use haclient as the the common group.
> Yes. But the problem is if root is not in the "haclient" group also,
> after it setuid() to "hacluster", chown() the file to "haclient"
will
> return EPERM.
So there are three options in my mind:
1. Add root into "haclient" group on installation.
Or:
2. cib daemon setgid() to haclient before setuid() to hacluster
I like this best, but can we still connect to CPG?
Or:
3. Mode 0666. Authenticate users in connection_accept().
Regards,
Gao,Yan
>>>
>>>>
>>>>>
>>>>>> How does chgrp manage this?
>>>>> It invokes fchownat() system call. And it behaves in the same way as
>>>>> chown() for this.
>>>>
>>>> Can we not do this too?
>>>>
>>>>>
>>>>>>
>>>>>>> Another way is to change the file mode to
>>>>>>> 0666, and determine permissions in connection_accept().
>>>>>>>
>>>>>>> Andrew, opinions?
>>>>>>
>>>>>> Leaving the permissions wide open doesn't sound very
appealing.
>>>>> Hmm, not very ideal indeed.
>>>>>
>>>>> Regards,
>>>>> Gao,Yan
>>>>> --
>>>>> Gao,Yan <ygao(a)suse.com>
>>>>> Software Engineer
>>>>> China Server Team, SUSE.
>>>>
>>>> _______________________________________________
>>>> quarterback-devel mailing list
>>>> quarterback-devel(a)lists.fedorahosted.org
>>>>
https://fedorahosted.org/mailman/listinfo/quarterback-devel
>>> _______________________________________________
>>> quarterback-devel mailing list
>>> quarterback-devel(a)lists.fedorahosted.org
>>>
https://fedorahosted.org/mailman/listinfo/quarterback-devel
>>
>> _______________________________________________
>> quarterback-devel mailing list
>> quarterback-devel(a)lists.fedorahosted.org
>>
https://fedorahosted.org/mailman/listinfo/quarterback-devel
>
>
--
Gao,Yan <ygao(a)suse.com>
Software Engineer
China Server Team, SUSE.
_______________________________________________
quarterback-devel mailing list
quarterback-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/quarterback-devel