Re: daemontools respin?

On Wed, Jun 09, 2010 at 09:19:11PM +0000, Wayne Marshall wrote:
> It is trivial to drop any existing daemontools service
> definitions into a perp installation. See the COMPATIBILITY
> section in perpetrate(5) for examples.

Well, I would believe simple, but this is a little above what I would
call trivial.  By drop-in replacements, I mean no changes necessary to
existing services.

> > My idea was that if the service directory was owned by
> > non-root, to setuid to the owner after changing into the
> > directory; and/or if the "run" file was owned by non-root, to
> > setuid to the owner after forking.
> 
> Well, the use case here still seems a little ambiguous.
> Generally, I think it would be inadvisable to have
> non-root-owned service directories under a root-priveleged
> svscan, unless the entire svscan instance/tree were
> non-priveleged.

The first use case would be where an admin could give a non-root user a
service directory, allowing full management of that one service (since
supervise would drop root on startup, the control files would be owned
as non-root).

The second use case (setuid on fork) would be for setting up services as
root to run as another user without doing a setuid in the run script.

In both cases, it was an idea and not a plan, and I was uncertain if
they would be at all useful.

-- 
Bruce Guenter <[email protected]>                http://untroubled.org/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (GNU/Linux)

iEYEARECAAYFAkwQXWgACgkQ6W+y3GmZgOgE0QCdH9XPettVBz8L2yAHGUYdpA8F
Q9cAoIn71dMPbyUOi08jmcX8XSAx/SPk
=4Hl5
-----END PGP SIGNATURE-----