search for: change_user

...s probably root, this always adds the gid "0" to the list of supplementary groups for the process as per this strace for a change to my user account (with 7 supplementary groups): setgroups(8, [0, 10, 14, 18, 54, 1002, 1004, 474]) = 0 This method is called by SUIDManager''s change_user method, which is called in critical places such as lib/puppet/util.rb:308 in execute_posix (as used by lots of things including Exec resources). #12458 - Only euid changed, not egid Overview =============================== The second problem occurs when only a target user is given to the S...

...nn, void *handle, int readonly); diff --git a/server/main.c b/server/main.c index 5623149..935d422 100644 --- a/server/main.c +++ b/server/main.c @@ -857,6 +857,7 @@ start_serving (void) for (i = 0; i < nr_socks; ++i) socks[i] = FIRST_SOCKET_ACTIVATION_FD + i; change_user (); + backend->ready_to_serve (backend); write_pidfile (); accept_incoming_connections (socks, nr_socks); free_listening_sockets (socks, nr_socks); /* also closes them */ @@ -866,6 +867,7 @@ start_serving (void) /* Handling a single connection on stdin/stdout. */ if (list...

This fixes the long-standing crash on close when nbdkit exits. I did try first to fix threads so we're using a proper thread pool, but that's difficult to implement. So this does the minimal change needed to fix the crash instead. There are still two segfaults that happen during running the test suite. One is deliberately caused (tests/test-captive.sh). The other appears to be an

...server/internal.h | 2 ++ server/cleanup.c | 8 +++++++- server/Makefile.am | 3 ++- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/server/internal.h b/server/internal.h index d0da213..825dd3e 100644 --- a/server/internal.h +++ b/server/internal.h @@ -139,6 +139,8 @@ extern void change_user (void); /* cleanup.c */ extern void cleanup_free (void *ptr); #define CLEANUP_FREE __attribute__((cleanup (cleanup_free))) +extern void cleanup_extents_free (void *ptr); +#define CLEANUP_EXTENTS_FREE __attribute__((cleanup (cleanup_extents_free))) extern void cleanup_unlock (pthread_mutex_t **p...

...uot;using socket activation, nr_socks = %zu", nr_socks); + socks = malloc (sizeof (int) * nr_socks); + if (socks == NULL) { + perror ("malloc"); + exit (EXIT_FAILURE); + } + for (i = 0; i < nr_socks; ++i) + socks[i] = FIRST_SOCKET_ACTIVATION_FD + i; + change_user (); + write_pidfile (); + accept_incoming_connections (socks, nr_socks); + free_listening_sockets (socks, nr_socks); /* also closes them */ + return; + } + /* Handling a single connection on stdin/stdout. */ if (listen_stdin) { change_user (); @@ -752,3 +806,60 @@ parsegroup...

...2,6 +42,7 @@ #define NBDKIT_API_VERSION 2 #include "nbdkit-plugin.h" #include "nbdkit-filter.h" +#include "cleanup.h" #ifdef __APPLE__ #define UNIX_PATH_MAX 104 @@ -135,17 +136,6 @@ extern unsigned int get_socket_activation (void); /* usergroup.c */ extern void change_user (void); -/* cleanup.c */ -extern void cleanup_free (void *ptr); -#define CLEANUP_FREE __attribute__((cleanup (cleanup_free))) -extern void cleanup_extents_free (void *ptr); -#define CLEANUP_EXTENTS_FREE __attribute__((cleanup (cleanup_extents_free))) -extern void cleanup_unlock (pthread_mutex_t **...

...ot;, O_RDONLY) != STDIN_FILENO || + open ("/dev/null", O_WRONLY) != STDOUT_FILENO) { + perror ("open"); + exit (EXIT_FAILURE); + } + /* Select the correct thread model based on config. */ lock_init_thread_model (); @@ -918,7 +954,7 @@ start_serving (void) change_user (); write_pidfile (); threadlocal_new_server_thread (); - handle_single_connection (0, 1); + handle_single_connection (orig_in, orig_out); return; } -- 2.26.0

...t; put parentheses or even spaces /usr/local/lib/ruby/gems/1.8/gems/activerecord-1.10.1/lib/active_record/vendor/mysql411.rb:106: warning: discarding old connect /usr/local/lib/ruby/gems/1.8/gems/activerecord-1.10.1/lib/active_record/vendor/mysql411.rb:163: warning: method redefined; discarding old change_user /usr/local/lib/ruby/gems/1.8/gems/activerecord-1.10.1/lib/active_record/connection_adapters/abstract_adapter.rb:422:in `log'': Packets out oforder: 1<>3: SHOW FIELDS FROM eagles (ActiveRecord::StatementInvalid) from /usr/local/lib/ruby/gems/1.8/gems/activerecord-1.10.1/lib/act...

...ot;, O_RDONLY) != STDIN_FILENO || + open ("/dev/null", O_WRONLY) != STDOUT_FILENO) { + perror ("open"); + exit (EXIT_FAILURE); + } + /* Select the correct thread model based on config. */ lock_init_thread_model (); @@ -918,7 +949,7 @@ start_serving (void) change_user (); write_pidfile (); threadlocal_new_server_thread (); - handle_single_connection (0, 1); + handle_single_connection (orig_in, orig_out); return; } diff --git a/tests/test-layers-plugin.c b/tests/test-layers-plugin.c index 8858bede..5a6b3020 100644 --- a/tests/test-layers-...

...wstyle.c | 10 +++++----- server/protocol.c | 16 +++++++++------- 5 files changed, 33 insertions(+), 14 deletions(-) diff --git a/server/internal.h b/server/internal.h index 50525f3..2281937 100644 --- a/server/internal.h +++ b/server/internal.h @@ -139,6 +139,10 @@ extern void change_user (void); /* connections.c */ struct connection; +enum { + SEND_MORE = 1, /* Hint to use MSG_MORE/corking to group send()s */ +}; + typedef int (*connection_recv_function) (struct connection *, void *buf, size_t len) __attribute__((__nonnull__ (1, 2))...

...nnect, .open = filter_open, .prepare = filter_prepare, diff --git a/server/main.c b/server/main.c index e9f95380..c432f5bd 100644 --- a/server/main.c +++ b/server/main.c @@ -959,6 +959,7 @@ start_serving (void) debug ("using socket activation, nr_socks = %zu", socks.size); change_user (); write_pidfile (); + top->after_fork (top); accept_incoming_connections (&socks); return; } @@ -967,6 +968,7 @@ start_serving (void) if (listen_stdin) { change_user (); write_pidfile (); + top->after_fork (top); threadlocal_new_server_thread ()...

This is my second attempt at this. The first version (also not working) was here: https://www.redhat.com/archives/libguestfs/2019-October/msg00062.html In part 1/2 I introduce a new .ready_to_serve plugin method which is called after forking and just before accepting any client connection. The idea would be that plugins could start background threads here. However this doesn't work well in

This is what I've been playing with in response to my earlier question about what to do with 'nbdkit -s sh -' (https://www.redhat.com/archives/libguestfs/2020-April/msg00032.html) I'm still open to ideas on a better name, and/or whether adding <stdbool.h> to our public include files is a good idea (if not, returning int instead of bool is tolerable). Eric Blake (2):

There's more that can be done (in particular, use of CLEANUP_FREE), but this is enough to at least see if I'm on the right track. I couldn't figure out an obvious difference between common/include and common/utils, but it looks like the former is for things that are inlineable via .h only, while the latter is when you need to link in a convenience library, so this landed in the

This is an incomplete port to Windows. Currently the server compiles and starts up successfully, but goes into an infinite loop when you connect to it. Nevertheless I think the approach is ready for feedback. This being Windows the changes go quite deep. Rich.

This time around, the numbers are indeed looking better than in v1; and I like the interface better. Eric Blake (2): server: Prefer send() over write() server: Group related transmission send()s server/internal.h | 7 +++- server/connections.c | 51 +++++++++++++++++++++++++--- server/crypto.c | 11 ++++--

In v2: - use int instead of bool in the public header - split the tests from the code - don't overload test-layers; instead, add new tests - add a missing fflush exposed by the new tests - other minor cleanups Eric Blake (3): server: Add nbdkit_stdio_safe server: Sanitize stdin/out before running plugin code server: More tests of stdin/out handling docs/nbdkit-plugin.pod |

The patches following do indeed allow you to compile nbdkit.exe, but it does not actually work yet. I'm posting this experimental series more as a work in progress and to get feedback. Note this does not require Windows itself to build or test. You can cross-compile it using mingw64-* packages on Fedora or Debian, and test it [spoiler alert: it fails] using Wine. Rich.

Not sure what version we're up to, but this reimplements extents using the new simpler structure described in this thread: https://www.redhat.com/archives/libguestfs/2019-March/msg00077.html I also fixed most of the things that Eric pointed out in the previous review, although I need to go back over his replies and check I've got everything. This needs a bit more testing. However the

I'm not sure exactly which version we're up to, but let's say it's version 4. I'm a lot happier with this version: - all filters have been reviewed and changed where I think that's necessary - can_extents is properly defined and implemented now - NBD protocol is followed - I believe it addresses all previous review points where possible The "only" thing