5 commits - init.d/sanlock src/limits.conf src/main.c src/sanlock.log src/sanlock_internal.h src/sysconfig.sanlock

[David Teigland]

 init.d/sanlock         |    4 +-
 src/limits.conf        |    2 -
 src/main.c             |   67 +++++++++++++++++++++++++++++++++++++++++++++++++
 src/sanlock_internal.h |    2 +
 src/sysconfig.sanlock  |    5 ---
 5 files changed, 71 insertions(+), 9 deletions(-)

New commits:
commit ae2b4f95c06e91ee6958e3f48a37c74bd6b7cc41
Author: David Teigland <teigland(a)redhat.com&gt;
Date:   Thu May 24 10:00:43 2012 -0500

    init: root user
    
    Don't need sanlock:sanlock owner for run dir.
    
    Signed-off-by: David Teigland <teigland(a)redhat.com&gt;

diff --git a/init.d/sanlock b/init.d/sanlock
index 5f049a6..b2cf012 100644
--- a/init.d/sanlock
+++ b/init.d/sanlock
@@ -34,7 +34,7 @@ start() {
 	[ -x $exec ] || exit 5
 
 	if [ ! -d /var/run/$prog ]; then
-		install -d -o $SANLOCKUSER -g $SANLOCKUSER -m 775 /var/run/$prog
+		install -d -m 775 /var/run/$prog
 		[ -x /sbin/restorecon ] && restorecon /var/run/$prog
 	fi
 


commit 19362c0e16174d074e7ace48331ba4e2e184475c
Author: David Teigland <teigland(a)redhat.com&gt;
Date:   Thu May 24 09:59:43 2012 -0500

    sysconfig: remove user option
    
    sanlock will always run as root.
    
    Signed-off-by: David Teigland <teigland(a)redhat.com&gt;

diff --git a/src/sysconfig.sanlock b/src/sysconfig.sanlock
index 1c14d4f..89b6fa3 100644
--- a/src/sysconfig.sanlock
+++ b/src/sysconfig.sanlock
@@ -1,8 +1,3 @@
-# SANLOCKUSER -- the daemon should run as this user
-#
-# To run as root user instead of sanlock user
-#SANLOCKUSER="root"
-
 # SANLOCKOPTS -- set the command line options for the sanlock daemon
 # See sanlock man page for full list of command line options.
 #


commit b8137b97ee3e55d64a9f279bf1b4836b6ba2f619
Author: David Teigland <teigland(a)redhat.com&gt;
Date:   Thu May 24 09:58:26 2012 -0500

    sanlock: remove limits.conf
    
    Not needed since we're back to running as root.
    
    Signed-off-by: David Teigland <teigland(a)redhat.com&gt;

diff --git a/src/limits.conf b/src/limits.conf
deleted file mode 100644
index f6fcedf..0000000
--- a/src/limits.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-sanlock - memlock -1
-sanlock - rtprio -1


commit f4f9cddcef656e51055267905382d74f3b2c84c7
Author: David Teigland <teigland(a)redhat.com&gt;
Date:   Thu May 24 09:57:39 2012 -0500

    Revert "sanlock.log: empty file to install from rpm"
    
    Not needed since we're back to running as root.
    
    This reverts commit 1fe89953ba73f61c63e8d555ec7f69f0345bd4a1.

diff --git a/src/sanlock.log b/src/sanlock.log
deleted file mode 100644
index e69de29..0000000


commit defe1cadea058dcd4b186ec7f3bef8ff9aa94692
Author: Federico Simoncelli <fsimonce(a)redhat.com&gt;
Date:   Thu May 24 13:38:52 2012 +0000

    sanlock: set the supplementary groups at startup
    
    This is mostly required to access leases that resides on NFS exports
    with the root_squash option enabled. The sanlock process will acquire
    all the supplementary groups of the sanlock user.
    
    Signed-off-by: Federico Simoncelli <fsimonce(a)redhat.com&gt;

diff --git a/init.d/sanlock b/init.d/sanlock
index 7004f1f..5f049a6 100644
--- a/init.d/sanlock
+++ b/init.d/sanlock
@@ -39,7 +39,7 @@ start() {
 	fi
 
 	echo -n $"Starting $prog: "
-	daemon --user=$SANLOCKUSER $prog daemon $SANLOCKOPTS
+	daemon $prog daemon $SANLOCKOPTS
 	retval=$?
 	echo
 	[ $retval -eq 0 ]
diff --git a/src/main.c b/src/main.c
index 82c39af..f8c74af 100644
--- a/src/main.c
+++ b/src/main.c
@@ -1182,6 +1182,69 @@ static void setup_host_name(void)
 		 uuid, name.nodename);
 }
 
+static void setup_groups(void)
+{
+	int rv, i, j, h;
+	int pngroups, sngroups, ngroups_max;
+	gid_t *pgroup, *sgroup;
+
+	ngroups_max = sysconf(_SC_NGROUPS_MAX);
+	if (ngroups_max < 0) {
+		log_error("cannot get the max number of groups %i", errno);
+		return;
+	}
+
+	pgroup = malloc(ngroups_max * 2 * sizeof(gid_t));
+	if (!pgroup) {
+		log_error("cannot malloc the group list %i", errno);
+		exit(EXIT_FAILURE);
+	}
+
+	pngroups = getgroups(ngroups_max, pgroup);
+	if (pngroups < 0) {
+		log_error("cannot get the process groups %i", errno);
+		goto out;
+	}
+
+	sgroup = pgroup + ngroups_max;
+	sngroups = ngroups_max;
+
+	rv = getgrouplist(com.uname, com.gid, sgroup, &sngroups);
+	if (rv < -1) {
+		log_error("cannot get the user %s groups %i", com.uname, errno);
+		goto out;
+	}
+
+	for (i = 0, j = pngroups; i < sngroups; i++) {
+		if (j >= ngroups_max) {
+			log_error("too many groups for the user %s", com.uname);
+			break;
+		}
+
+		/* check if the groups is already present in the list */
+		for (h = 0; h < j; h++) {
+			if (pgroup[h] == sgroup[i]) {
+				goto skip_gid;
+			}
+		}
+
+		pgroup[j] = sgroup[i];
+		j++;
+
+ skip_gid:
+		; /* skipping the gid because it's already present */
+	}
+
+	rv = setgroups(j, pgroup);
+	if (rv < 0) {
+		log_error("cannot set the user %s groups %i", com.uname, errno);
+		goto out;
+	}
+
+ out:
+	free(pgroup);
+}
+
 static int do_daemon(void)
 {
 	struct sigaction act;
@@ -1223,6 +1286,8 @@ static int do_daemon(void)
 
 	setup_host_name();
 
+	setup_groups();
+
 	log_error("sanlock daemon started %s aio %d %d renew %d %d host %s time
%llu",
 		  RELEASE_VERSION,
 		  main_task.use_aio, main_task.io_timeout_seconds,
@@ -1635,9 +1700,11 @@ static int read_command_line(int argc, char *argv[])
 			parse_arg_resource(optionarg); /* com.res_args[] */
 			break;
 		case 'U':
+			com.uname = optionarg;
 			com.uid = user_to_uid(optionarg);
 			break;
 		case 'G':
+			com.gname = optionarg;
 			com.gid = group_to_gid(optionarg);
 			break;
 
diff --git a/src/sanlock_internal.h b/src/sanlock_internal.h
index 4565855..d3ab366 100644
--- a/src/sanlock_internal.h
+++ b/src/sanlock_internal.h
@@ -531,7 +531,9 @@ struct command_line {
 	int max_worker_threads;
 	int aio_arg;
 	int io_timeout_arg;
+	char *uname;			/* -U */
 	int uid;				/* -U */
+	char *gname;			/* -G */
 	int gid;				/* -G */
 	int pid;				/* -p */
 	char sort_arg;