On 11/06/12 23:25 +0800, Gao,Yan wrote:
Hi Angus,
On 06/11/12 19:06, Angus Salkeld wrote:
> On 11/06/12 13:59 +0800, Gao,Yan wrote:
>> Hi,
>> I'm sill looking at how to fix the ACLs support of pacemaker.
>>
>> AFAICS, if a server is ran by root, when a client connects to it, the
>> "/dev/shm/qb-*" file will be chown to the client's uid/gid. While
if a
>> server is ran by an ordinary user and being connected by another
>> ordinary user, since the server doesn't have the permission to chown
>> the file to another user, and the file mode is 0600, so the client will
>> get "permission denied ".
>>
>> Cib daemon runs as "uid: hacluster, gid: root", and we want all the
>> users in "haclient" group have access to CIB. Is there any way for cib
>> daemon to know the file path or the fd for a request, so that it can
>> change the mode/group of the file? Or are there any other solutions for
>> this?
>
> One option is to change qb_rb_chown() to do the following:
> if (myuid == owner) {
> // no need to change anything
> return 0;
> }
> if (myuid == 0) {
> // normal chown (as it does now)
> } else if (mygid == 0 || mygid == group) {
> // chgrp && chmod 0660
> }
>
> Do you think this will solve your problem?
This leads to the direction. :) One issue is:
The "group" passed into qb_rb_chown() is the client's egid. Usually the
client's egid is the user's main group, which could be something like
"users" group instead of "haclient" group, while it's quite
possible
that "hacluster" user doesn't belong to "users" group. An
ordinary user
is not allowed to change the group of a file to a group he doesn't
belong to, even his egid is 0.
well we could introduce a function that you call in the autheticate callback
something like:
qb_ipcs_connection_auth_set(conn, gid, uid, mode);
Then you could set what you want. I'll have a look at getting you a patch.
-Angus
Is it possible to set the group of the file to the specified "haclient"
group, otherwise ACLs would require users having same specified _main_
group.
Besides, we'll need similar changes to qb_ipcs_us_connect():958:
res = chown(r->request, c->euid, c->egid);
Yip.
Regards,
Gao,Yan
--
Gao,Yan <ygao(a)suse.com>
Software Engineer
China Server Team, SUSE.
_______________________________________________
quarterback-devel mailing list
quarterback-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/quarterback-devel