-------- In message <cantn4crhs9tgag9oxkewycfjq4mm5nbdgyvnc+5cxh70ski...@mail.gmail.com> , Martin Blix Grydeland writes: >--001a114031a08be765050f6e0046 >Content-Type: text/plain; charset=UTF-8 > >On 18 February 2015 at 20:19, Poul-Henning Kamp <[email protected]> wrote: > >> In message <[email protected]>, Poul-Henning >> Kamp >> writes: >> >> > Move creation of workdir into jail code, and use the master HIGH/LOW >> > around socket operations which may be on reserved ports. >> >> This is all presuming jail=unix which means Varnish was started as root. >> >> I am uncertain if creating/opening the storage files should be done >> at "MASTER_HIGH" (= root) or "MASTER_LOW" (= varnish user) privilege >> level. > >We've been looking at the option of having block device as storage instead >of going through the filesystem. These devices usually have special rules >setting up the permissions and such on each boot [...]
Yes, that's one of the many reasons why I think that storage files belong in the "command line domain", and neither CLI users nor anybody else should needs or can beneficially use access to the storage files "out of band". -- Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 [email protected] | TCP/IP since RFC 956 FreeBSD committer | BSD since 4.3-tahoe Never attribute to malice what can adequately be explained by incompetence. _______________________________________________ varnish-dev mailing list [email protected] https://www.varnish-cache.org/lists/mailman/listinfo/varnish-dev
