Re: Parfait and UoM (java) RPM packages

Hi, Marko -

> Hmm, when starting first instance of the might HelloWorld test case and
> monitoring mmv.HelloWorld.java.uptime for a while, I see the expected
> uptime:
> [...]
> But when starting second instance, this happens:
> # pminfo -f mmv.HelloWorld.java.uptime
> [...]

> It seems that any user who is able (*) to start the same application can
> "override" the metrics for everyone else.
> 
> *) Btw, what's the recommended way to enable MMV for non-root users? I did
> # mkdir -p /var/lib/pcp/tmp/mmv
> # chgrp testuser /var/lib/pcp/tmp/mmv
> # chmod g+rwx /var/lib/pcp/tmp/mmv
> [...]

See [man pmdammv] for some discussion of the security aspects.  The
current mmv ./Install script includes this bit:

if [ ! -e "$PCP_TMP_DIR/mmv" ]
then
    echo "creating $PCP_TMP_DIR/mmv"
    mkdir -p -m 1777 "$PCP_TMP_DIR/mmv"
fi

which makes the mmv directory world-writeable.  The sticky bit should
prevent users from overwriting each other's files.  There are other
security concerns (DoS, namespace squatting, etc.) that are not addressed.


- FChE

-=-=-=-=-=-=-=-=-=-=-=-
pcp mailing list
[email protected]
https://groups.io/g/pcp/messages
-=-=-
Groups.io Links:

You receive all messages sent to this group.

View/Reply Online (#14548): https://groups.io/g/pcp/message/14548
View All Messages In Topic (12): https://groups.io/g/pcp/topic/2895998
Mute This Topic: https://groups.io/mt/2895998?uid=174580
New Topic: https://groups.io/g/pcp/post

Change Your Subscription: https://groups.io/g/pcp/editsub?uid=174580

Group Home: https://groups.io/g/pcp
Contact Group Owner: [email protected]

Terms of Service: https://groups.io/static/tos

Unsubscribe: https://groups.io/g/pcp/leave/354243/563757577/xyzzy
-=-=-=-=-=-=-=-=-=-=-=-