On Mon, 2012-09-10 at 15:51 +0200, Zdeněk Pavlas wrote: > Just an idea.. Yum-cron can download updates to user cachedir without > holding the /var/run/yum.pid lock. 'yum update' then just preloads > RPMs from the user cachedir.
Yeh, this is what I'd suggested to Nick (download to a user dir. and then move). Hopefully with the gen/ stuff we've done it can be used for all data. But doing it this way "when run as root we try to copy from N sources" seems like a bad idea. It opens a few forms of attack that are kind of annoying to defend against, Eg. I'm not sure how safe glob is and at the worst case an annoying user creates 10k user dirs. and populates them with junk of the correct names. It also might cause some problems depending on how long it takes to go from user => root (Eg. download stuff and then tmpwatch deletes it before it moves). Esp. for yum-cron (where we are running as root, but can drop privs. for some operations -- like downloads) I think it makes more sense to have a "here is a bunch of data, see if you can move it" type API. So yum-cron downloads everything as a user and then runs as root giving it's specific user dir. to that process ... and then deletes it's user dir. (or links it back, maybe, as an optimization for it's next run). Could even be an extension on the current "preload_md" infrastructure, maybe. This way we only have one set of things to check, and the check happens at non-interactive time ... the only real downside is that a random user running yum and download metadata/pkgs. won't be picked up by any root yum runs (without extra code somewhere). But I don't think that's a huge problem (esp. for packages). _______________________________________________ Yum-devel mailing list [email protected] http://lists.baseurl.org/mailman/listinfo/yum-devel
