Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-19 Thread Joel Becker
On Tue, May 19, 2009 at 08:38:39PM +0200, Fabio M. Di Nitto wrote: > The comment approach sure would be good for corosync as there are plenty > of areas that are not freed on exit. That's also why I didn't really > bother with "just one more" kind of thing. The important point is "is it fr

Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-19 Thread Fabio M. Di Nitto
On Tue, 2009-05-19 at 11:07 -0700, Joel Becker wrote: > On Tue, May 19, 2009 at 08:45:36AM +0200, Jim Meyering wrote: > > Fabio M. Di Nitto wrote: > > >> @@ -150,6 +162,10 @@ void corosync_request_shutdown (void) > > >> poll_stop (0); > > >> totempg_finalize (); > > >> coroi

Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-19 Thread Joel Becker
On Tue, May 19, 2009 at 08:45:36AM +0200, Jim Meyering wrote: > Fabio M. Di Nitto wrote: > >> @@ -150,6 +162,10 @@ void corosync_request_shutdown (void) > >> poll_stop (0); > >> totempg_finalize (); > >> coroipcs_ipc_exit (); > >> + > >> + /*Remove uidgid_list*/ > >> +

Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-18 Thread Jim Meyering
Fabio M. Di Nitto wrote: >> @@ -150,6 +162,10 @@ void corosync_request_shutdown (void) >> poll_stop (0); >> totempg_finalize (); >> coroipcs_ipc_exit (); >> + >> + /*Remove uidgid_list*/ >> + corosync_remove_uidgid_list (); > > Is there really a need to free this

Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-15 Thread Steven Dake
> > > > > > The loader should make sure to filter the config entries to load only > > > uidgid entries (maybe it's already there and I haven't noticed). > > > > Answered in some previous mail by Steve, that we don't care. But yes, > > this can be done. > > I have probably missed Steven's email

Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-15 Thread Fabio M. Di Nitto
On Fri, 2009-05-15 at 09:23 +0200, Jan Friesse wrote: > Fabio, > >> + > >> corosync_exit_error (AIS_DONE_EXIT); > >> } > >> > >> @@ -482,12 +498,18 @@ static coroipcs_handler_fn_lvalue > >> corosync_handler_fn_get (unsigned int service, > >> > >> static int corosync_security_valid (i

Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-15 Thread Jan Friesse
Fabio, Fabio M. Di Nitto wrote: > Hi Jan, > > I have few comments... > > On Thu, 2009-05-14 at 11:49 +0200, Jan Friesse wrote: > >> >> >> >> >> differences >> between files >> attachment >> (corosync-support-for-uidgid-try2.patch) >> >> diff --git a/trunk/exec/main.c b/trunk/exec/main.c >> inde

Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-14 Thread Steven Dake
We decided on /etc/corosync as the dir, not /etc/ais for the uidgid.d directory. Other then that looks good regards -steve On Thu, 2009-05-14 at 11:49 +0200, Jan Friesse wrote: > Attached is second version of patch. > > Read from dir uses better name for function (no security but rather > uidgi

Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-14 Thread Fabio M. Di Nitto
Hi Jan, I have few comments... On Thu, 2009-05-14 at 11:49 +0200, Jan Friesse wrote: > > > > > > differences > between files > attachment > (corosync-support-for-uidgid-try2.patch) > > diff --git a/trunk/exec/main.c b/trunk/exec/main.c > index db22e96..2b4 100644 > --- a/trunk/exec/mai

Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-14 Thread Jan Friesse
Attached is second version of patch. Read from dir uses better name for function (no security but rather uidgid) so it's included too. Take it as a version, which will be back-ported to RHEL 5. Regards, Honza Steven Dake wrote: > rename "security" as an objdb key to "uidgid". > > The uid || g

Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-13 Thread Fabio M. Di Nitto
On Wed, 2009-05-13 at 18:21 +0200, Jan Friesse wrote: > Third question. I'm not sure, if I should implement some reloading stuff > or not. Because in current implementation, ug_config.uid/gid are never > reloaded, and only logstuff is reloaded. > > Fourth think. From my point of view. ug_config.ui

Re: [Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-13 Thread Steven Dake
rename "security" as an objdb key to "uidgid". The uid || gid should be valid, not requiring an and operation. On Wed, 2009-05-13 at 18:21 +0200, Jan Friesse wrote: > Attached is first version of support for multiple security items (uid-gid). > > First question what I have. I'm currently testing

[Openais] [corosync trunk] [patch] Initial support for security (uid-gid)

2009-05-13 Thread Jan Friesse
Attached is first version of support for multiple security items (uid-gid). First question what I have. I'm currently testing uid and gid as a pair, so user process must have gid and uid (not only uid or gid). Is that correct, or you will rather see something, what will check uid OR gid? (From my