[SSSD] Pass fd's around via /proc/$pid/fd/ ... / was: Re: sssd.conf ownership

Roland Mainz rmainz at redhat.com
Fri Nov 28 10:41:09 UTC 2014



----- Original Message -----
> From: "Jakub Hrozek" <jhrozek at redhat.com>
> To: sssd-devel at lists.fedorahosted.org
> Sent: Friday, November 28, 2014 11:04:32 AM
> Subject: Re: [SSSD] Pass fd's around via /proc/$pid/fd/ ... / was: Re: sssd.conf ownership
> 
> On Thu, Nov 27, 2014 at 09:11:59AM -0500, Roland Mainz wrote:
> > 
> > 
> > ----- Original Message -----
> > > From: "Jakub Hrozek" <jhrozek at redhat.com>
> > > To: sssd-devel at lists.fedorahosted.org
> > > Sent: Saturday, November 22, 2014 2:24:17 PM
> > > Subject: Re: [SSSD] sssd.conf ownership
> > > 
> > > On Fri, Nov 21, 2014 at 04:26:58PM -0500, Stephen Gallagher wrote:
[snip]
> > > > Why exactly would it need to be chown()ed? I'm unclear on that point.
> > > > Presumably, SSSD is still being launched as root and then dropping
> > > > privileges (otherwise it wouldn't be able to perform the chown). So to
> > > > me it seems like it makes sense to just open the file read-only prior
> > > > to
> > > > dropping privileges, then pass the filehandle along.
> > > 
> > > Passing a fd would be best, but infortunately the augeas API we use to
> > > change the configuration only works with path names ...
> > 
> > Erm... you can use /proc/$pid/fd/ ...
> > 
> > ... example:
> > -- snip --
> > $ ksh -c 'printf "chickenmonster666\n" >xxx ; redirect {fd}<"xxx" ;
> > fdpath="/proc/$$/fd/$fd" ; env - fdpath="$fdpath" /usr/bin/bash -c "cat
> > $fdpath" ; true'
> > chickenmonster666
> > -- snip --
> > (the last "true" is needed to prevent ksh93 from doing a tail-call
> > optimisation and |exec()| the last command in the command line in place of
> > the ksh93 process... this would not work in this case because the
> > /proc/$pid/fd/ files only live as long as the parent process lives (but
> > you can |openat()| the fds via /proc)).
> 
> Interesting idea, maybe worth playing with. Do you know of any codebase
> that uses this trick?

At least AT&T's libast (the AT&T Advanced Software Technology, the basic utility&&platform abstraction library used in almost all AT&T software ranging from DSL modem up to mainframe software), Solaris OS/Net (kernel&&{basic operating system,POSIX}-utilities, the kernel can use /dev/fd or /proc for javaexec and shbinexec exec modules to execute JAVA jar or compiled shell script code and userland utilities use it to pass fd's around (not only to child processes) since POSIX does not allow fd's to be inherited like bash allows it) and JAVA use this.

For libast it's exposed in the shell (e.g. install http://www.nrubsig.org/people/gisburn/work/redhat/ast_utils_rpm_review/astutils-20140721-2.fc20.x86_64.rpm) via the ~{fd_num} expansion (like $ cd ~user #) for all platforms which have /proc or /dev/fd/:
-- snip --
$ /usr/ast/bin/sh -c 'redirect {n}</etc ; print ~{n} ; cd ~{n} ; pwd -P ; true'
/proc/2164/fd/11
/etc
-- snip --

----

Bye,
Roland

-- 
  __ .  . __
 (o.\ \/ /.o) rmainz at redhat.com
  \__\/\/__/  IPA/Kerberos5 team
  /O /==\ O\  
 (;O/ \/ \O;)
 



More information about the sssd-devel mailing list