Re: [linux-lvm] lvcreate from a setuid-root binary

2018-11-16 Thread Christoph Pleger
Hello, Let's stop there. The fact you're asking a question about setuid suggests you don't understand enough to be able to use it safely. I get security by checking the real user id at the beginning of the program and aborting the program if that uid does not belong to the only user who is

Re: [linux-lvm] lvcreate from a setuid-root binary

2018-11-21 Thread Christoph Pleger
Hello, On 2018-11-16 16:41, Stuart D. Gathman wrote: It's not very elegant, but the quick and dirty solution is to use sudo probably you had not yet read that far in this thread, but I already wrote that sudo does not work when called from pam_exec. To get the stderr and stdout results of

Re: [linux-lvm] lvcreate from a setuid-root binary

2018-11-21 Thread Christoph Pleger
Hello, May be silly question: Do you have selinux or equivalent enabled? I HAD apparmor enabled, but after the first failures (like described here) had occurred, I also suspected apparmor as a possible reason and disabled it. Unfortunately, that did not help. Regards Christoph

Re: [linux-lvm] lvcreate from a setuid-root binary

2018-11-19 Thread Christoph Pleger
Hello, On 2018-11-19 15:04, matthew patton wrote: program calls getpwuid() with the real user id of the calling user maybe I missed a critical post explaining why it has to be, but that's a job for a trivial sudo specification line. I can't think of any reason why sudo is not the answer to

Re: [linux-lvm] lvcreate from a setuid-root binary

2018-11-19 Thread Christoph Pleger
Hello, On 2018-11-19 14:19, Bryn M. Reeves wrote: On Fri, Nov 16, 2018 at 02:43:10PM +0100, Christoph Pleger wrote: The beginning is that I want to create a user-specific logical volume when a user logs in to a service that authenticates its users through pam and that does not run as root

Re: [linux-lvm] lvcreate from a setuid-root binary

2018-11-19 Thread Christoph Pleger
Hello, On 2018-11-15 17:39, Christoph Pleger wrote: Unfortunately - though these UIDs are all set to 0 - lvcreate still does not work for me. That is, it does work when I call my setuid-binary as a non-root user from the command line, but it does not work when I call my setuid-binary from PAM

Re: [linux-lvm] dmsetup says "Device does not exist", though it exists

2019-08-14 Thread Christoph Pleger
Hello, I have a volume group with 20 logical volumes. Only the last one of these volumes has a strange problem with dmsetup, shown by these commands and output on the command line: root@host:/home/linux# /sbin/dmsetup info -c -o name --noheadings /dev/vg/lv20 Device does not exist. Command

Re: [linux-lvm] dmsetup says "Device does not exist", though it exists

2019-08-14 Thread Christoph Pleger
Hello, So are you actually trying to access not a 'normal' LV - but an LV under snapshot ? No, /dev/vg/lv20 is a normal logical volume. But /dev/vg/lv15 has been under snapshot before. Now, I created a snapshot manually (before. it was created by an automatic backup mechanism) and saw

[linux-lvm] dmsetup says "Device does not exist", though it exists

2019-08-13 Thread Christoph Pleger
Hello, I have a volume group with 20 logical volumes. Only the last one of these volumes has a strange problem with dmsetup, shown by these commands and output on the command line: root@host:/home/linux# /sbin/dmsetup info -c -o name --noheadings /dev/vg/lv20 Device does not exist. Command

[linux-lvm] Programming interface

2019-08-21 Thread Christoph Pleger
Hello, Some time ago, we wrote an application that uses the lvm2app interface to manage volume groups and logical volumes. Of course, the application does not work anymore, now that lvm2app has been skipped. So, is there anywhere something like a guide how to rewrite code that used the

Re: [linux-lvm] Programming interface

2019-08-21 Thread Christoph Pleger
Hello, The 'new' idea was to use/provide 'DBus' API - however it's also not a lot of 'traction' :( and it's also missing lot of features and design... Surely you are not saying that the dbus interface will also disappear - because I am using that in another, less complicated application,