On Tue, 2011-06-28 at 19:13 -0700, James McKenzie wrote:
> On 6/28/11 6:37 PM, Genes MailLists wrote:
> > On 06/28/2011 08:17 PM, Daniel J Walsh wrote:
> >>> Does this work as regular user for you? For me - selinux makes it crash.
> >> run ausearch -m avc -ts recent
> >>
> >> And see if it generates any output.
> >>
> >> SELinux error messages are written to /var/log/audit/audit.log
> >>
> >>
> >>
> > Thanks Dan - Nope no selinux logs on this one best I can tell. If I
> > run as user I get:
> >
> > $ needs-restarting
> > Traceback (most recent call last):
> > File "/usr/bin/needs-restarting", line 137, in<module>
> > sys.exit(main(sys.argv))
> > File "/usr/bin/needs-restarting", line 117, in main
> > for fn in get_open_files(pid):
> > File "/usr/bin/needs-restarting", line 84, in get_open_files
> > for line in maps.readlines():
> > IOError: [Errno 13] Permission denied
> >
> >
> > Its odd - line 117 in needs-restarting is this fragment:
> >
> >
> > for pid in return_running_pids(uid=myuid):
> > try:
> > pid_start = os.stat('/proc/' + pid)[stat.ST_CTIME]
> > except OSError, e:
> > continue
> > found_match = False
> > for fn in get_open_files(pid):
> >
> > Works fine as root.
> Usually ordinary users are prohibited from accessing /proc/<whatever>
> from what I remember. That is why root works and joe-blow does not.
>
> James McKenzie
>
In fact most of the contents of /proc/<pid> are world-readable. Try 'ls
-l /proc/<some-pid>'. Specifically, the smaps file is world-readable,
which is what needs-restarting uses to get the names of open files. It
essentially builds a table from the internal equivalent of "grep
fd: /proc/*/smaps".
I invariably run needs-restarting under my own user id just after
updating, and I have never seen the above traceback.
poc
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
