osaf/libs/core/leap/os_defs.c | 24 ++----------------------
1 files changed, 2 insertions(+), 22 deletions(-)
OpenSAF as non root cannot be started in a linux container. SMFD cannot write
its PID file.
When opensaf is running as non root in a container, the setuid/setgid feature
in ncs_os_process_execute_timed() causes problem. The new user/group is picked
up from the installed binaries. If they happen to not be the same as the
configured ones for opensaf, AMF started programs cannot write PID files.
This feature is removed also reducing the amount of system calls between fork
and exec which has been a problem.
diff --git a/osaf/libs/core/leap/os_defs.c b/osaf/libs/core/leap/os_defs.c
--- a/osaf/libs/core/leap/os_defs.c
+++ b/osaf/libs/core/leap/os_defs.c
@@ -955,6 +955,8 @@ uint32_t ncs_os_process_execute_timed(NC
osaf_mutex_lock_ordie(&s_cloexec_mutex);
if ((pid = fork()) == 0) {
+ /* child part */
+
/*
** Make sure forked processes have default scheduling class
** independent of the callers scheduling class.
@@ -989,28 +991,6 @@ uint32_t ncs_os_process_execute_timed(NC
syslog(LOG_ERR, "%s: freopen stderr failed -
%s", __FUNCTION__, strerror(errno));
}
- /* RUNASROOT gives the OpenSAF user a possibility to maintain
the < 4.2 behaviour.
- * For example the UML environment needs this because of its
simplified user management.
- * OpenSAF processes will otherwise be started as the real host
user and will
- * have problems e.g. writing PID files to the root owned
directory.
- */
-#ifndef RUNASROOT
- /* Check owner user ID of file and change group and user
accordingly */
- {
- struct stat buf;
- if (stat(req->i_script, &buf) == 0) {
- if (setgid(buf.st_gid) == -1)
- syslog(LOG_ERR, "setgid %u failed -
%s", buf.st_gid, strerror(errno));
- if (setuid(buf.st_uid) == -1)
- syslog(LOG_ERR, "setuid %u failed -
%s", buf.st_uid, strerror(errno));
- } else {
- syslog(LOG_ERR, "Could not stat %s - %s",
req->i_script, strerror(errno));
- exit(128);
- }
- }
-#endif
-
- /* child part */
if (execvp(req->i_script, req->i_argv) == -1) {
syslog(LOG_ERR, "%s: execvp '%s' failed - %s",
__FUNCTION__, req->i_script, strerror(errno));
exit(128);
------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
_______________________________________________
Opensaf-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensaf-devel
