Re: Wishlist: credential file update/access collision avoidance?

On 10/4/2011 3:05 AM, Love Hörnquist Åstrand wrote:
> 30 sep 2011 kl. 21:45 skrev Russ Allbery:
>
>> Harry Coin<[email protected]>  writes:
>>
>>> Doesn't the library just error/fail report to the daemon/service that
>>> the credentials cache is missing/invalid/unreadable during the time
>>> k5start is writing the refreshed credentials?  Am I wrong to worry that
>>> these false/avoidable error messages will occur in a fashion hard to
>>> reproduce reliably?
>> Well, ideally the Kerberos library uses file locking when updating a
>> Kerberos ticket cache, so another process will just block on the lock for
>> a short period of time.  I don't know if this actually happens.
> Heimdal uses whole file locking when adding/deleting entries, and uses rename-over (where it works) to make atomic updates of the file caches.
>
> Do you have any instances where this doesn't work, would appreciate reproduce test cases.
>
> Love
>
>
Well there's the whole (where it works) thing you mention.   My world is 
all about high duty cycle and high availability.  I'm given to fret 
about things like a process or computer suddenly dying while holding a 
lock over a network, temporary files that live longer than most 
computers because the process that would have cleaned them up died 
mid-way, and so forth.     I sense many here see no important problem 
with the occasional once-in-a-while hard-to-reproduce glitch where the 
answer is simply to retry and if it works there is no issue.    I have 
no objection to this of course, if it works in your world better for you.

Anyhow I suggested what I did because I only have single writers to any 
one credentials cache, and the plan I offered totally avoids cross OS 
platform issues like holding up processes owing to dodgy network based 
file locks, indeed the entire matter of forcing avoidable delay by 
requiring file locks at all.  Nevermind the entire category of managing 
changing file ownerships and permissions.   Sort of 'ZFS meets 
credentials caches' -- you don't care if a process dies mid-stream, all 
else just works and restarting it all does as well.