On Thu, Mar 27, 2014 at 07:01:26AM -0700, Jeff Layton wrote: > On Thu, 27 Mar 2014 14:06:32 +0100 > Florian Weimer <fweimer@xxxxxxxxxx> wrote: > > > On 03/27/2014 02:02 PM, Jeff Layton wrote: > > > > >> This interface does not address the long-term lack of POSIX > > >> compliance in setuid and friends, which are required to be > > >> process-global and not thread-specific (as they are on the kernel > > >> side). > > >> > > >> glibc works around this by reserving a signal and running set*id on > > >> every thread in a special signal handler. This is just crass, and > > >> it is likely impossible to restore the original process state in > > >> case of partial failure. We really need kernel support to perform > > >> the process-wide switch in an all-or-nothing manner. > > >> > > > > > > I disagree. We're treading new ground here with this syscall. It's > > > not defined by POSIX so we're under no obligation to follow its > > > silly directives in this regard. Per-process cred switching doesn't > > > really make much sense in this day and age, IMO. Wasn't part of the > > > spec was written before threading existed > > > > Okay, then we need to add a separate set of system calls. > > > > I really, really want to get rid of that signal handler mess in > > glibc, with its partial failures. > > > > I agree, it's a hack, but hardly anyone these days really wants to > switch creds on a per-process basis. It's just that we're saddled with > a spec for those calls that was written before threads really existed. > > The kernel syscalls already do the right thing as far as I'm concerned. > What would be nice however is a blessed glibc interface to them > that didn't involve all of the signal handling stuff. Then samba et. al. > wouldn't need to call syscall() directly to get at them. Amen to that :-). However, after talking with Jeff and Jim at CollabSummit, I was 'encouraged' to make my opinions known on the list. To me, calling the creds handle a file descriptor just feels wrong. IT *isn't* an fd, you can't read/write/poll on it, and it's only done as a convenience to get the close-on-exec semantics and the fact that the creds are already hung off the fd's in kernel space. I'd rather any creads call use a different type, even if it's a typedef of 'int -> creds_handle_t', just to make it really clear it's *NOT* an fd. That way we can also make it clear this thing only has meaning to a thread group, and SHOULD NOT (and indeed preferably CAN NOT) be passed between processes. Cheers, Jeremy. -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
