On 06/13/12 10:15, Andrew Beekhof wrote:
On 13/06/2012, at 12:05 PM, Angus Salkeld wrote:
> On 13/06/12 11:48 +1000, Andrew Beekhof wrote:
>>
>> On 13/06/2012, at 11:34 AM, Gao,Yan wrote:
>>
>>> Hi Andrew,
>>>
>>> On 06/13/12 07:18, Andrew Beekhof wrote:
>>>>
>>>> On 12/06/2012, at 10:45 PM, Gao,Yan wrote:
>>>>
>>>>> On 06/12/12 19:56, Gao,Yan wrote:
>>>>>> Hi Angus,
>>>>>> Thanks a lot for introducing this! I also added the following
patch,
>>>>>> modified "examples/ipcserver.c", and it works for both
QB_IPC_SHM and
>>>>>> QB_IPC_SOCKET mode in the example.
>>>>>>
>>>>>> I encountered weird behaviors for pacemaker cib though. Chmod
works
>>>>>> fine, but the group of file has never been changed. The only
difference
>>>>>> I can think of is that cib's uid "hacluster" comes
from setuid() by
>>>>>> root. But it still doesn't make sense to me that it's not
allowed to
>>>>>> change the group of a file to "hacluster"'s main
group...
>>>>> So it is, "hacluster" got from setuid() by root cannot
change the group
>>>>> of a file to "hacluster"'s main group --
"haclient", unless we also
>>>>> setgid to "haclient" before setuid to
"hacluster", otherwise "root" must
>>>>> belong to "haclient" group.
>>>>
>>>> Really? That would surprise me greatly.
>>> Me too. :-\ It seems setuid() doesn't change any of the group
>>> information of the process unless setgid() _before_ that -- setgid()
>>> after setuid() is not allowed either.
>>
>> I thought "unpriv client -> root server" and "root client ->
unpriv server" both worked already.
>> I might have fallen behind, could you restate the problem?
>
> I think the issue here is the server is non-root-user:root-group And
> the client is non-root-user:non-root-group.
>
> So server can't chown the file it created to be the uid of the client.
>
> What we are trying to do now is:
> chgrp the file to a common group and chmod to 0660.
Ok, 0660 i can handle :-)
>
> This works for me (for 2 different users with a common group).
Works for me
too, if they are in a common group, and if no one comes
from setuid().
> But Yan is struggling with the server as it gets the group id
> via setgid().
The server will know the group name/id at startup, could we put it in a connection
setting somewhere?
We will always use haclient as the the common group.
Yes. But the problem is if
root is not in the "haclient" group also,
after it setuid() to "hacluster", chown() the file to "haclient" will
return EPERM.
Regards,
Gao,Yan
>
> -Angus
>
>>
>>>
>>>> How does chgrp manage this?
>>> It invokes fchownat() system call. And it behaves in the same way as
>>> chown() for this.
>>
>> Can we not do this too?
>>
>>>
>>>>
>>>>> Another way is to change the file mode to
>>>>> 0666, and determine permissions in connection_accept().
>>>>>
>>>>> Andrew, opinions?
>>>>
>>>> Leaving the permissions wide open doesn't sound very appealing.
>>> Hmm, not very ideal indeed.
>>>
>>> Regards,
>>> Gao,Yan
>>> --
>>> Gao,Yan <ygao(a)suse.com>
>>> Software Engineer
>>> China Server Team, SUSE.
>>
>> _______________________________________________
>> quarterback-devel mailing list
>> quarterback-devel(a)lists.fedorahosted.org
>>
https://fedorahosted.org/mailman/listinfo/quarterback-devel
> _______________________________________________
> quarterback-devel mailing list
> quarterback-devel(a)lists.fedorahosted.org
>
https://fedorahosted.org/mailman/listinfo/quarterback-devel
_______________________________________________
quarterback-devel mailing list
quarterback-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/quarterback-devel
--
Gao,Yan <ygao(a)suse.com>
Software Engineer
China Server Team, SUSE.