[SSSD] [PATCH] UTIL: Ignore insufficient permission for some proc files

Jakub Hrozek jhrozek at redhat.com
Mon Apr 14 17:44:53 UTC 2014


On Mon, Apr 14, 2014 at 06:57:17PM +0200, Jakub Hrozek wrote:
> On Mon, Mar 17, 2014 at 11:01:03PM +0100, Lukas Slebodnik wrote:
> > On (17/03/14 22:47), Jakub Hrozek wrote:
> > >On Mon, Mar 17, 2014 at 10:39:07PM +0100, Lukas Slebodnik wrote:
> > >> On (17/03/14 22:16), Jakub Hrozek wrote:
> > >> >On Mon, Mar 17, 2014 at 01:32:39PM +0100, Lukas Slebodnik wrote:
> > >> >> On (17/03/14 08:05), Stephen Gallagher wrote:
> > >> >> >On 03/17/2014 04:02 AM, Lukas Slebodnik wrote:
> > >> >> >> ehlo,
> > >> >> >>
> > >> >> >> Attached patch fixes problem with find-uid test on altlinux. Alexey
> > >> >> >> Shabalin reported this in another thread.
> > >> >> >>
> > >> >> >
> > >> >> >
> > >> >> >I've seen that intermittently when building with systemd in Koji as
> > >> >> >well. I think there's a more fundamental problem here, and I'd
> > >> >> >recommend not just papering over it. It's likely either a systemd bug
> > >> >> >or a misunderstanding about how it interacts when building in a chroot.
> > >> >> >
> > >> >> proc fylesystem is not mount with option hidepid=1 on fedora.
> > >> >> maybe, you hit another bug.
> > >> >>
> > >> >> LS
> > >> >
> > >> >I was thinking about this on my way home and I wonder if we could wrap
> > >> >Lukas's change in an #ifdef either based on a define passed during build
> > >> >(-DSSS_PROC_HIDEPID) or automatically detected if possible. I agree with
> > >> >Stephen that we shouldn't hide any potential issues by simply skipping
> > >> >the EPERM error code.
> > >>
> > >> I can reproduce failed test with "hidepid=1" only if I run find_uid-tests
> > >> as ordinary user. Test will pass if I run it as a root.
> > >
> > >Build systems typically operate as a non-privileged user.
> > >
> > Test will pass in this case and it has no effect for a a normal running sssd.
> > 
> > >>
> > >> What kind of potential issues do you mean?
> > >
> > >No particular issue, I'm just not a big fan of hiding an error.
> > And one more time:
> > 
> >          Issue is logged in function get_uid_from_pid
> >          DEBUG(SSSDBG_CRIT_FAILURE,
> >                "open failed [%d][%s].\n", error, strerror(error));
> > 
> > In case of any problem, it would be easy to find a reason.
> > 
> > LS
> 
> Sorry this thread was stale for so long, more important issues kept
> taking precedence.
> 
> Would we see this debug message during build? I thought (at least on
> Fedora with recent automake) you'd only see PASS/FAIL.

Replying to self...

sssd_be runs as root, so if we get EPERM in the backend, something is
really wrong.

What about ignoring EPERM in unit tests only as they run unprivileged?
What is the problem you see with this approach?



More information about the sssd-devel mailing list