[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: chroot'd operation, userid



--On Thursday, October 26, 2006 2:24 PM -0700 Howard Chu <hyc@symas.com> wrote:

Kurt D. Zeilenga wrote:

We've talked about this in the past - why don't we restructure things
so that the user and group are read from the config, along with the
listeners? I.e., defer dropping root privs until after the config has
been read.


Personally, I prefer our current approach.  Everything on the
command line is done from the user/group/root of the parent,
everything in the config file is done from the command line
specified user/group/root.

Placing user/group/root in the config file makes it confused
as to what is processed under which user/group/root.  For
instance, in a custom backend with custom directives, would
these be processed before or after the change?


I was only talking about user and group and listeners, I would leave root
on the command line. As for when they take effect, we'd require that they
get issued before any backend or database directives. With back-config
they would be in the global section and naturally execute before anything
else.


So with Howard's clarification, is there still objection?

In the meantime, in the 2.3 release, it may be worthwhile to note something in the man pages, like:

--- openldap-old/doc/man/man8/slapindex.8 2006-01-03 23:16:06.000000000 +0100
+++ openldap2.3-2.3.27/doc/man/man8/slapindex.8 2006-10-24 20:21:16.000000000 +0200
@@ -90,6 +90,10 @@
should not be running (at least, not in read-write
mode) when you do this to ensure consistency of the database.
.LP
+slapindex ought to be run as the same user that
+.BR slapd (8)
+uses to ensure correct database permissions.
+.LP
This command provides ample opportunity for the user to obtain
and drink their favorite beverage.
.SH EXAMPLES

--Quanah

--
Quanah Gibson-Mount
Principal Software Developer
ITS/Shared Application Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html