On Sep 21, 2006, at 2:43 PM, Robert Joosten wrote:
rpc.lockd remains unreliable; avoid using it if practical.
Hmmm, is there a way to run pxe-boxes without rpc.lockd and then still
able to run adduser and so on ?
Safely? No. But then, flock() doesn't work via NFS even if
rpc.lockd is running, so you aren't any worse off.
Details follow: adduser invokes pw underneath, and pw should share
the same password locking convention that vipw uses to avoid
simultaneous/conflicting updates to the password files. Both pw and
vipw use the pw_lock() routine from src/lib/libutil:
pw_lock(void)
{
if (*masterpasswd == '\0')
return (-1);
/*
* If the master password file doesn't exist, the system is
hosed.
* Might as well try to build one. Set the close-on-exec
bit so
* that users can't get at the encrypted passwords while
editing.
* Open should allow flock'ing the file; see 4.4BSD. XXX
*/
for (;;) {
struct stat st;
lockfd = open(masterpasswd, O_RDONLY, 0);
if (lockfd < 0 || fcntl(lockfd, F_SETFD, 1) == -1)
err(1, "%s", masterpasswd);
/* XXX vulnerable to race conditions */
if (flock(lockfd, LOCK_EX|LOCK_NB) == -1) {
if (errno == EWOULDBLOCK) {
errx(1, "the password db file is
busy");
} else {
err(1, "could not lock the passwd
file: ");
}
}
[ ... ]
Note the "XXX"es. And, as Mark said in the section I quoted in my
previous email on this thread:
flock() always returns as if it succeeded on NFS files, when in
fact it is a no-op. There is no way around this.
However, I believe that some systems have actually re-implemented the
BSD flock() call in terms of calling the POSIX lockf(), which would
attempt to use rpc.lockd and thus have some chance of working over
NFS. I believe this was done in Linux by Andy Walker and for MacOS X
by Justin Walker (odd naming coincidence, there), IIRC; perhaps some
of these changes have made their way back to the other BSDs.
--
-Chuck
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
