Ack.
Thanks,
Ramesh.
On 9/26/2014 12:23 PM, Hans Feldt wrote:
> osaf/libs/core/leap/os_defs.c | 24 ++----------------------
> 1 files changed, 2 insertions(+), 22 deletions(-)
>
>
> OpenSAF as non root cannot be started in a linux container. SMFD cannot write
> its PID file.
>
> When opensaf is running as non root in a container, the setuid/setgid feature
> in ncs_os_process_execute_timed() causes problem. The new user/group is picked
> up from the installed binaries. If they happen to not be the same as the
> configured ones for opensaf, AMF started programs cannot write PID files.
>
> This feature is removed also reducing the amount of system calls between fork
> and exec which has been a problem.
>
> diff --git a/osaf/libs/core/leap/os_defs.c b/osaf/libs/core/leap/os_defs.c
> --- a/osaf/libs/core/leap/os_defs.c
> +++ b/osaf/libs/core/leap/os_defs.c
> @@ -955,6 +955,8 @@ uint32_t ncs_os_process_execute_timed(NC
> osaf_mutex_lock_ordie(&s_cloexec_mutex);
>
> if ((pid = fork()) == 0) {
> + /* child part */
> +
> /*
> ** Make sure forked processes have default scheduling class
> ** independent of the callers scheduling class.
> @@ -989,28 +991,6 @@ uint32_t ncs_os_process_execute_timed(NC
> syslog(LOG_ERR, "%s: freopen stderr failed -
> %s", __FUNCTION__, strerror(errno));
> }
>
> - /* RUNASROOT gives the OpenSAF user a possibility to maintain
> the < 4.2 behaviour.
> - * For example the UML environment needs this because of its
> simplified user management.
> - * OpenSAF processes will otherwise be started as the real host
> user and will
> - * have problems e.g. writing PID files to the root owned
> directory.
> - */
> -#ifndef RUNASROOT
> - /* Check owner user ID of file and change group and user
> accordingly */
> - {
> - struct stat buf;
> - if (stat(req->i_script, &buf) == 0) {
> - if (setgid(buf.st_gid) == -1)
> - syslog(LOG_ERR, "setgid %u failed -
> %s", buf.st_gid, strerror(errno));
> - if (setuid(buf.st_uid) == -1)
> - syslog(LOG_ERR, "setuid %u failed -
> %s", buf.st_uid, strerror(errno));
> - } else {
> - syslog(LOG_ERR, "Could not stat %s - %s",
> req->i_script, strerror(errno));
> - exit(128);
> - }
> - }
> -#endif
> -
> - /* child part */
> if (execvp(req->i_script, req->i_argv) == -1) {
> syslog(LOG_ERR, "%s: execvp '%s' failed - %s",
> __FUNCTION__, req->i_script, strerror(errno));
> exit(128);
------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
_______________________________________________
Opensaf-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensaf-devel
