From patchwork Thu Sep 3 23:33:43 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Zhou X-Patchwork-Id: 514297 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from archives.nicira.com (li376-54.members.linode.com [96.126.127.54]) by ozlabs.org (Postfix) with ESMTP id D8B8414028F for ; Fri, 4 Sep 2015 09:38:46 +1000 (AEST) Received: from archives.nicira.com (localhost [127.0.0.1]) by archives.nicira.com (Postfix) with ESMTP id F02FF10BF1; Thu, 3 Sep 2015 16:34:14 -0700 (PDT) X-Original-To: dev@openvswitch.com Delivered-To: dev@openvswitch.com Received: from mail-pa0-f53.google.com (mail-pa0-f53.google.com [209.85.220.53]) by archives.nicira.com (Postfix) with ESMTPS id 443F210BF0 for ; Thu, 3 Sep 2015 16:34:14 -0700 (PDT) Received: by pacwi10 with SMTP id wi10so4660266pac.3 for ; Thu, 03 Sep 2015 16:34:03 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Aa9g14+C4mOY3coFgswRw1i+bgA5nUCTtYVm1OX+9z4=; b=fDrHlLSRuiOVqrNgXFtcHIyhiFp0Usolf0M7IX8GTNucQTUzFPBbk1ha9ML2rYwkPh /5lW29GapNk89fvdXX4zKLHoZ8LngzOKX2kSTfg+SfGR7of1dSIGcM4EGrvU3I8x6U9e +jCbeCTuuW7mmEzktJgQGkfhv1P7kXwzsfS4HWxFQwT1COiY5AQkN3qhoUEIEoeyYsei qePLOEYzEpr+sRnFRAzf58XwquVEyxXQd/PvnHcvQUY+OJpLJho0DHwy5Uo9QlSSzi/z A6thnPkx2kJhw4WDUnCs0pexgQ1q2Q08++o4e0gusSQVWNbib6bgZiZal2HN8T4yHGaT TgOg== X-Gm-Message-State: ALoCoQk6z7iyypb9EeKlUVstdwZ02ftk7VPRkRnhGwbpcQDWv28h0cPJK1mq75hpr5tefjLDqSco X-Received: by 10.68.131.138 with SMTP id om10mr1151258pbb.3.1441323243829; Thu, 03 Sep 2015 16:34:03 -0700 (PDT) Received: from ubuntu.localdomain ([208.91.1.34]) by smtp.gmail.com with ESMTPSA id vv2sm247828pab.21.2015.09.03.16.34.02 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 03 Sep 2015 16:34:03 -0700 (PDT) From: Andy Zhou To: dev@openvswitch.com Date: Thu, 3 Sep 2015 16:33:43 -0700 Message-Id: <1441323223-11889-3-git-send-email-azhou@nicira.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1441323223-11889-1-git-send-email-azhou@nicira.com> References: <1441323223-11889-1-git-send-email-azhou@nicira.com> Subject: [ovs-dev] [PATCH 3/3] ovsdb-server: support --user option X-BeenThere: dev@openvswitch.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dev-bounces@openvswitch.org Sender: "dev" Add support for running ovsdb-server as a non-root user, specified by the --user option. If specified, all I/O access and all sub-processes will be perfromed as the new user. VMware-BZ: #1499254 Signed-off-by: Andy Zhou --- NEWS | 1 + lib/daemon.man | 8 ++++++++ ovsdb/ovsdb-server.c | 6 +++++- 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index ca22c8e..5192ac1 100644 --- a/NEWS +++ b/NEWS @@ -21,6 +21,7 @@ Post-v2.4.0 targets to run a new system testsuite. These tests can be run inside a Vagrant box. See INSTALL.md for details - Dropped support for GRE64 tunnel. + - Added --user option to ovsdb-server. v2.4.0 - 20 Aug 2015 diff --git a/lib/daemon.man b/lib/daemon.man index 4ab9823..d7e2968 100644 --- a/lib/daemon.man +++ b/lib/daemon.man @@ -50,3 +50,11 @@ core dumps into the current working directory and the root directory is not a good directory to use. .IP This option has no effect when \fB\-\-detach\fR is not specified. +. +.TP +\fB\-\-user\fR +Causes \fB\*(PN\fR to run as a new user specified in "user:group". Short +forms "user" and ":group" are also allowed, with current user or group +are assumed respectively. Only root process accepts this argument. +.IP +Currently only ovsdb-server actually implements this option. diff --git a/ovsdb/ovsdb-server.c b/ovsdb/ovsdb-server.c index 4088d85..fdeecd2 100644 --- a/ovsdb/ovsdb-server.c +++ b/ovsdb/ovsdb-server.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2009, 2010, 2011, 2012, 2013, 2014 Nicira, Inc. +/* Copyright (c) 2009, 2010, 2011, 2012, 2013, 2014, 2015 Nicira, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -221,6 +221,10 @@ main(int argc, char *argv[]) process_init(); parse_options(&argc, &argv, &remotes, &unixctl_path, &run_command); + /* Drop root privileges and become the new user as soon as possible. + * OVSDB server does not need root privileges. If --user option is + * not specified, the following function is essentially no-op. */ + daemon_become_new_user(); /* Create and initialize 'config_tmpfile' as a temporary file to hold * ovsdb-server's most basic configuration, and then save our initial