|
 |
4de095 |
From 7e0a61d1c10f30e694f5f536b374c72f774b50a1 Mon Sep 17 00:00:00 2001
|
|
|
4de095 |
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <fidencio@redhat.com>
|
|
|
4de095 |
Date: Sun, 8 Jan 2017 23:27:57 +0100
|
|
|
4de095 |
Subject: [PATCH 158/160] SERVER: Set the process group during server_setup()
|
|
|
4de095 |
MIME-Version: 1.0
|
|
|
4de095 |
Content-Type: text/plain; charset=UTF-8
|
|
|
4de095 |
Content-Transfer-Encoding: 8bit
|
|
|
4de095 |
|
|
|
4de095 |
By calling setpgid() in server_setup() we are able to kill the process
|
|
|
4de095 |
in the watchdog by simply doing kill(-getpid(), SIGTERM).
|
|
|
4de095 |
|
|
|
4de095 |
However, in order to have it working properly the SELinux policy for
|
|
|
4de095 |
SSSD has to be updated and unless SSSD is ran with SELinux on permissive
|
|
|
4de095 |
mode, each of the responders and the monitor will trigger a similar
|
|
|
4de095 |
message:
|
|
|
4de095 |
|
|
|
4de095 |
Jan 09 14:31:50 client1.ipa.example audit[11630]: AVC avc: denied
|
|
|
4de095 |
{ setpgid } for pid=11630 comm="sssd_pac"
|
|
|
4de095 |
scontext=system_u:system_r:sssd_t:s0
|
|
|
4de095 |
tcontext=system_u:system_r:sssd_t:s0 tclass=process permissive=0
|
|
|
4de095 |
|
|
|
4de095 |
It's important to say that till SELinux policy is fixed, we might end up
|
|
|
4de095 |
leaking some processes.
|
|
|
4de095 |
|
|
|
4de095 |
Related:
|
|
|
4de095 |
https://fedorahosted.org/sssd/ticket/3266
|
|
|
4de095 |
|
|
|
4de095 |
Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
|
|
|
4de095 |
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
|
|
|
4de095 |
(cherry picked from commit 087162b85e191af51637904702813969b35eaadc)
|
|
|
4de095 |
(cherry picked from commit 442985a7af2262fab57f56c7a8cd40af10081610)
|
|
|
4de095 |
---
|
|
|
4de095 |
src/monitor/monitor.c | 6 +++---
|
|
|
4de095 |
src/util/server.c | 11 +++++++++++
|
|
|
4de095 |
2 files changed, 14 insertions(+), 3 deletions(-)
|
|
|
4de095 |
|
|
|
4de095 |
diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
|
|
|
4de095 |
index 0f01580e01b6a0a9ab507a54183e5813133be5a9..17e980dbf165634491a05012399945f2d21c2056 100644
|
|
|
4de095 |
--- a/src/monitor/monitor.c
|
|
|
4de095 |
+++ b/src/monitor/monitor.c
|
|
|
4de095 |
@@ -1606,7 +1606,7 @@ static void monitor_quit(struct mt_ctx *mt_ctx, int ret)
|
|
|
4de095 |
"Terminating [%s][%d]\n", svc->name, svc->pid);
|
|
|
4de095 |
do {
|
|
|
4de095 |
errno = 0;
|
|
|
4de095 |
- kret = kill(svc->pid, SIGTERM);
|
|
|
4de095 |
+ kret = kill(-svc->pid, SIGTERM);
|
|
|
4de095 |
if (kret < 0) {
|
|
|
4de095 |
error = errno;
|
|
|
4de095 |
DEBUG(SSSDBG_CRIT_FAILURE, "Couldn't kill [%s][%d]: [%s]\n",
|
|
|
4de095 |
@@ -1627,7 +1627,7 @@ static void monitor_quit(struct mt_ctx *mt_ctx, int ret)
|
|
|
4de095 |
"[%d][%s] while waiting for [%s]\n",
|
|
|
4de095 |
error, strerror(error), svc->name);
|
|
|
4de095 |
/* Forcibly kill this child */
|
|
|
4de095 |
- kill(svc->pid, SIGKILL);
|
|
|
4de095 |
+ kill(-svc->pid, SIGKILL);
|
|
|
4de095 |
break;
|
|
|
4de095 |
}
|
|
|
4de095 |
} else if (pid != 0) {
|
|
|
4de095 |
@@ -1642,7 +1642,7 @@ static void monitor_quit(struct mt_ctx *mt_ctx, int ret)
|
|
|
4de095 |
DEBUG(SSSDBG_FATAL_FAILURE,
|
|
|
4de095 |
"Child [%s] did not exit cleanly\n", svc->name);
|
|
|
4de095 |
/* Forcibly kill this child */
|
|
|
4de095 |
- kill(svc->pid, SIGKILL);
|
|
|
4de095 |
+ kill(-svc->pid, SIGKILL);
|
|
|
4de095 |
}
|
|
|
4de095 |
killed = true;
|
|
|
4de095 |
}
|
|
|
4de095 |
diff --git a/src/util/server.c b/src/util/server.c
|
|
|
4de095 |
index 013e572e6284b16534910088f7801219251896d8..d333c3c3c771c38005183831fc7a4b004a59a6c3 100644
|
|
|
4de095 |
--- a/src/util/server.c
|
|
|
4de095 |
+++ b/src/util/server.c
|
|
|
4de095 |
@@ -460,6 +460,17 @@ int server_setup(const char *name, int flags,
|
|
|
4de095 |
struct logrotate_ctx *lctx;
|
|
|
4de095 |
char *locale;
|
|
|
4de095 |
int watchdog_interval;
|
|
|
4de095 |
+ pid_t my_pid;
|
|
|
4de095 |
+
|
|
|
4de095 |
+ my_pid = getpid();
|
|
|
4de095 |
+ ret = setpgid(my_pid, my_pid);
|
|
|
4de095 |
+ if (ret != EOK) {
|
|
|
4de095 |
+ ret = errno;
|
|
|
4de095 |
+ DEBUG(SSSDBG_MINOR_FAILURE,
|
|
|
4de095 |
+ "Failed setting process group: %s[%d]. "
|
|
|
4de095 |
+ "We might leak processes in case of failure\n",
|
|
|
4de095 |
+ sss_strerror(ret), ret);
|
|
|
4de095 |
+ }
|
|
|
4de095 |
|
|
|
4de095 |
ret = chown_debug_file(NULL, uid, gid);
|
|
|
4de095 |
if (ret != EOK) {
|
|
|
4de095 |
--
|
|
|
4de095 |
2.9.3
|
|
|
4de095 |
|