Re: Parfait and UoM (java) RPM packages
"Nathan Scott" <[email protected]>
| Newsgroups | gmane.comp.sysutils.pcp |
|---|---|
| Message-ID | <[email protected]> |
Hi Marko, ----- Original Message ----- > >> [...] > >> *) Btw, what's the recommended way to enable MMV for non-root users? I did This is described in the pmdammv(1) man page ''INSTALLATION'' section - I've had a few goes at trying to document this all clearly, so please send through any clarifications you can suggest - thanks! > >> # mkdir -p /var/lib/pcp/tmp/mmv > >> # chgrp testuser /var/lib/pcp/tmp/mmv > >> # chmod g+rwx /var/lib/pcp/tmp/mmv > >> [...] pmcd and its little friend pmda_mmv.so will need read access to that directory (i.e. $PCP_USER and/or $PCP_GROUP from /etc/pcp.conf) . > > The > > current mmv ./Install script includes this bit: > > > > if [ ! -e "$PCP_TMP_DIR/mmv" ] > > then > > echo "creating $PCP_TMP_DIR/mmv" > > mkdir -p -m 1777 "$PCP_TMP_DIR/mmv" > > fi Use of this script is covered in pmdammv(1) - see the paragraph about back- compat and the Install script. As seems to have been realised overnight on IRC ... <fche> I wonder if the mmv ./Install script is not actually being run somehow, and that pmda is enabled by some other means (and thus Install initialization skipped) ... this is correct - pmdammv is installed by default (just like pmdalinux, pmdapmcd, pmdaproc, etc) which means the Install script is typically never run. An observant by-stander may notice many of those PMDAs don't even have Install scripts. However - and as documented in the man page - we do not make a decision on the users behalf about the MMV security model they should be using. As a result, this ... > > which makes the mmv directory world-writeable. The sticky bit should > > prevent users from overwriting each other's files. There are other > > security concerns (DoS, namespace squatting, etc.) that are not addressed. ... is very misleading - these issues are indeed addressed, depending on the model chosen. In situations that require such mitigation, hostile users can be prevented from being able to interact with pmdammv at all, preventing all of the concerns above. Unfortunately, each approach had its tradeoffs and there's no one perfect way to go. More secure means a more involved setup (and local knowledge needed), whereas the sticky bit approach is less secure (in general, but fine for ~99% of PCP users I imagine) and far, far easier to get people up and running. We used to default to the latter, but some years back we opted to force new installations of PCP to decide, due to the potential security implications for the 1%-ers. HTH. cheers. -- Nathan -=-=-=-=-=-=-=-=-=-=-=- pcp mailing list [email protected] https://groups.io/g/pcp/messages -=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#14554): https://groups.io/g/pcp/message/14554 View All Messages In Topic (16): https://groups.io/g/pcp/topic/2895998 Mute This Topic: https://groups.io/mt/2895998?uid=174580 New Topic: https://groups.io/g/pcp/post Change Your Subscription: https://groups.io/g/pcp/editsub?uid=174580 Group Home: https://groups.io/g/pcp Contact Group Owner: [email protected] Terms of Service: https://groups.io/static/tos Unsubscribe: https://groups.io/g/pcp/leave/354243/563757577/xyzzy -=-=-=-=-=-=-=-=-=-=-=-