User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-18 Thread Bertrand Delacretaz
Hi, On Thu, Dec 18, 2008 at 5:25 PM, Lars Trieloff (JIRA) wrote: > Key: SLING-788 > ...I would like to be able to script scheduled events in an easy fashion that > works just like > the /etc/cron.d/ directory on my Linux server: I put a shell script into > /etc/cron.d/daily and

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-18 Thread Lars Trieloff
I think admin is a good start. In Linux these scripts are usually run under the permissions of root, and are writeable by wheel, which is in fact, quite secure. In the future we might think about adding user-cron-dirs, just like we have user-specfic crontabs. regards, Lars On Thu, Dec 18, 2008 a

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-18 Thread Alexander Klimetschek
> On Thu, Dec 18, 2008 at 5:47 PM, Bertrand Delacretaz > wrote: >> Unixish systems solve this by using the identity of the user who owns >> the script (unless the setuid flag is set), and enforcing the way this >> identity can be set - but we don't have that kind of feature in JCR, >> or do we? W

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-18 Thread Felix Meschberger
Hi Lars Trieloff schrieb: > I think admin is a good start. In Linux these scripts are usually run > under the permissions of root, and are writeable by wheel, which is in > fact, quite secure. In the future we might think about adding > user-cron-dirs, just like we have user-specfic crontabs. Whi

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-19 Thread Alexander Klimetschek
On Thu, Dec 18, 2008 at 9:19 PM, Felix Meschberger wrote: > And I agree, that the /etc/cron.d scripts should be run as admin, where > special access rights (just like in *nix) should restrict who is allowed > to create entries. But IMHO Sling should not rely on the access rights of /etc/cron.d/*

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-19 Thread Felix Meschberger
Hi Alex, Alexander Klimetschek schrieb: > On Thu, Dec 18, 2008 at 9:19 PM, Felix Meschberger wrote: >> And I agree, that the /etc/cron.d scripts should be run as admin, where >> special access rights (just like in *nix) should restrict who is allowed >> to create entries. > > But IMHO Sling shou

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-19 Thread Alexander Klimetschek
On Fri, Dec 19, 2008 at 2:18 PM, Felix Meschberger wrote: > Yes, exactly. It is just like in unix, where we rely on the correct > system setup. Not exactly. To cite Bertrand: Unixish systems solve this by using the identity of the user who owns the script (unless the setuid flag is set), and enf

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-19 Thread Felix Meschberger
Hi, Alexander Klimetschek schrieb: > On Fri, Dec 19, 2008 at 2:18 PM, Felix Meschberger wrote: >> Yes, exactly. It is just like in unix, where we rely on the correct >> system setup. > > Not exactly. To cite Bertrand: > > Unixish systems solve this by using the identity of the user who owns > t

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-19 Thread Torgeir Veimo
On 19 Dec 2008, at 23:44, Felix Meschberger wrote: Really, so then we have be slightly different: +--- admin + crontab of admin +--- xyz + crontab of user xyz If you're sneaking in user management the back way, why not just define user director

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-19 Thread Tobias Bocanegra
On 12/19/08, Torgeir Veimo wrote: > > On 19 Dec 2008, at 23:44, Felix Meschberger wrote: > > > > > > Really, so then we have be slightly different: > > > > > > +--- admin > >+ crontab of admin > > +--- xyz > >+ crontab of user xyz > > > > > If you're sne

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-19 Thread Felix Meschberger
Hi Torgeir, Torgeir Veimo schrieb: > > On 19 Dec 2008, at 23:44, Felix Meschberger wrote: > >> >> Really, so then we have be slightly different: >> >> >> +--- admin >> + crontab of admin >> +--- xyz >> + crontab of user xyz > > > If you're sneaking i

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-19 Thread Lars Trieloff
I doubt that. On my Gentoo box with Vixie-Cron I can find following statements in the crontab: */10 * * * * roottest -x /usr/sbin/run-crons && /usr/sbin/run-crons which means it is more or less hardcoded that root runs the script, and relys on the correct system setup. regards, Lars On

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-19 Thread Bertrand Delacretaz
On Fri, Dec 19, 2008 at 4:38 PM, Lars Trieloff wrote: > I doubt that. On my Gentoo box with Vixie-Cron I can find following > statements in the crontab: > > */10 * * * * roottest -x /usr/sbin/run-crons && /usr/sbin/run-crons > > which means it is more or less hardcoded that root runs the sc

Re: User identity for event scripts (was: [jira] Created: (SLING-788)...)

2008-12-19 Thread Lars Trieloff
I think this is a good idea. Start with /home/admin or /home/a/admin for that matter and extend it later. the run-crons script does not switch users, the user running the scripts has been defined in the /etc/crontab file. In some way this resembles our setup: cron-daemon checks system crontab and