----- Original Message -----
From: "Jakub Hrozek" <jhrozek(a)redhat.com>
To: sssd-devel(a)lists.fedorahosted.org
Sent: Friday, November 28, 2014 11:04:32 AM
Subject: Re: [SSSD] Pass fd's around via /proc/$pid/fd/ ... / was: Re: sssd.conf
ownership
On Thu, Nov 27, 2014 at 09:11:59AM -0500, Roland Mainz wrote:
>
>
> ----- Original Message -----
> > From: "Jakub Hrozek" <jhrozek(a)redhat.com>
> > To: sssd-devel(a)lists.fedorahosted.org
> > Sent: Saturday, November 22, 2014 2:24:17 PM
> > Subject: Re: [SSSD] sssd.conf ownership
> >
> > On Fri, Nov 21, 2014 at 04:26:58PM -0500, Stephen Gallagher wrote:
[snip]
> > > Why exactly would it need to be chown()ed? I'm
unclear on that point.
> > > Presumably, SSSD is still being launched as root and then dropping
> > > privileges (otherwise it wouldn't be able to perform the chown). So
to
> > > me it seems like it makes sense to just open the file read-only prior
> > > to
> > > dropping privileges, then pass the filehandle along.
> >
> > Passing a fd would be best, but infortunately the augeas API we use to
> > change the configuration only works with path names ...
>
> Erm... you can use /proc/$pid/fd/ ...
>
> ... example:
> -- snip --
> $ ksh -c 'printf "chickenmonster666\n" >xxx ; redirect
{fd}<"xxx" ;
> fdpath="/proc/$$/fd/$fd" ; env - fdpath="$fdpath" /usr/bin/bash
-c "cat
> $fdpath" ; true'
> chickenmonster666
> -- snip --
> (the last "true" is needed to prevent ksh93 from doing a tail-call
> optimisation and |exec()| the last command in the command line in place of
> the ksh93 process... this would not work in this case because the
> /proc/$pid/fd/ files only live as long as the parent process lives (but
> you can |openat()| the fds via /proc)).
Interesting idea, maybe worth playing with. Do you know of any codebase
that uses this trick?
At least AT&T's libast (the AT&T Advanced Software Technology, the basic
utility&&platform abstraction library used in almost all AT&T software ranging
from DSL modem up to mainframe software), Solaris OS/Net (kernel&&{basic operating
system,POSIX}-utilities, the kernel can use /dev/fd or /proc for javaexec and shbinexec
exec modules to execute JAVA jar or compiled shell script code and userland utilities use
it to pass fd's around (not only to child processes) since POSIX does not allow
fd's to be inherited like bash allows it) and JAVA use this.
For libast it's exposed in the shell (e.g. install
http://www.nrubsig.org/people/gisburn/work/redhat/ast_utils_rpm_review/as...)
via the ~{fd_num} expansion (like $ cd ~user #) for all platforms which have /proc or
/dev/fd/:
-- snip --
$ /usr/ast/bin/sh -c 'redirect {n}</etc ; print ~{n} ; cd ~{n} ; pwd -P ;
true'
/proc/2164/fd/11
/etc
-- snip --
----
Bye,
Roland
--
__ . . __
(o.\ \/ /.o) rmainz(a)redhat.com
\__\/\/__/ IPA/Kerberos5 team
/O /==\ O\
(;O/ \/ \O;)