[Pam-developers] [PATCH] pam_namespace: don't use bashisms in default namespace.init script

Steve Langasek vorlon at debian.org
Wed Jan 15 17:54:37 UTC 2014


On Wed, Jan 15, 2014 at 09:25:04PM +0400, Dmitry V. Levin wrote:
> On Wed, Jan 15, 2014 at 08:52:53AM -0800, Steve Langasek wrote:
> > On Wed, Jan 15, 2014 at 03:47:06PM +0400, Dmitry V. Levin wrote:
> > > On Tue, Jan 14, 2014 at 07:49:00PM -0800, Steve Langasek wrote:
> > > > +				/* Pass maximum privs when we exec() */
> > > > +				(void) setuid (geteuid ());

> > > It's unlikely that setuid(geteuid()) would fail, but nevertheless,
> > > why the return code shouldn't be checked here?

> > Because there's nothing that we would do differently in the case that it
> > does fail; we would simply call the script with reduced privileges.

> OK then.  Could you add this to the comment before setuid call, please?
> Of course it wouldn't silence that warning from gcc (ignoring
> return value of 'setuid', declared with attribute warn_unused_result),
> but at least it will explain the idea.

Good point; I've changed this to explicitly check the retval instead (with
added comment to explain).

> > Unless you think this case is worth logging a warning for?

> No, because a more likely error of execle right after this setuid call
> is not logged anyway.

Right.

So, committed.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                    http://www.debian.org/
slangasek at ubuntu.com                                     vorlon at debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.fedorahosted.org/pipermail/pam-developers/attachments/20140115/d92bbb40/attachment.sig>


More information about the Pam-developers mailing list