Re: Checkpassword and FD3 - the problem

"Jim Ramsay" <[email protected]> wrote:
> Why is the checkpassword interface so married to FD#3?  Why not stdin?

It's expected that the program that checkpassword runs will probably
use stdin, stdout, and stderr.  So the credentials must be passed on a
different descriptor.  Otherwise, the calling program would have to
tediously relay all data from the original stdin to the pipe that was
created to pass the credentials.

> Why can't I set the env variable "CHECKPASSWORDFD=125" and have it use that
> instead, or have some other configurable mechanism to force a different FD?

I think that would have been a better design.  It's not too hard to
make a general wrapper providing that behavior.  Insert the name of
this script just before checkpassword in the command line:
#! /bin/sh
set -e || exit "$?"
checkpassword=$1
shift
eval "
if (: <&3) 2> /dev/null; then
  exec $CHECKPASSWORDTEMPFD<&3
  restore3='3<&$CHECKPASSWORDTEMPFD $CHECKPASSWORDTEMPFD<&-'
else restore3=
fi
exec 3<&$CHECKPASSWORDFD"' \
"$checkpassword" \
/bin/sh -c "exec $restore3 \"\$@\"" x "$@"'

Beware that some shells don't allow redirection of descriptors greater
than 9.  Set $CHECKPASSWORDTEMPFD to another unused descriptor.


paul