gnu linux update question

[Patrick O'Callaghan]

On Tue, 2011-06-28 at 19:13 -0700, James McKenzie wrote:
> On 6/28/11 6:37 PM, Genes MailLists wrote:
> > On 06/28/2011 08:17 PM, Daniel J Walsh wrote:
> >>>    Does this work as regular user for you? For me -  selinux makes it crash.
> >> run ausearch -m avc -ts recent
> >>
> >> And see if it generates any output.
> >>
> >> SELinux error messages are written to /var/log/audit/audit.log
> >>
> >>
> >>
> >    Thanks Dan - Nope no selinux logs on this one best I can tell. If I
> > run as user I get:
> >
> >   $ needs-restarting
> > Traceback (most recent call last):
> >    File "/usr/bin/needs-restarting", line 137, in<module>
> >      sys.exit(main(sys.argv))
> >    File "/usr/bin/needs-restarting", line 117, in main
> >      for fn in get_open_files(pid):
> >    File "/usr/bin/needs-restarting", line 84, in get_open_files
> >      for line in maps.readlines():
> > IOError: [Errno 13] Permission denied
> >
> >
> >    Its odd - line 117 in needs-restarting is this fragment:
> >
> >
> >      for pid in return_running_pids(uid=myuid):
> >          try:
> >              pid_start = os.stat('/proc/' + pid)[stat.ST_CTIME]
> >          except OSError, e:
> >              continue
> >          found_match = False
> >          for fn in get_open_files(pid):
> >
> > Works fine as root.
> Usually ordinary users are prohibited from accessing /proc/<whatever> 
> from what I remember.  That is why root works and joe-blow does not.
> 
> James McKenzie
> 

In fact most of the contents of /proc/<pid> are world-readable. Try 'ls
-l /proc/<some-pid>'. Specifically, the smaps file is world-readable,
which is what needs-restarting uses to get the names of open files. It
essentially builds a table from the internal equivalent of "grep
fd: /proc/*/smaps".

I invariably run needs-restarting under my own user id just after
updating, and I have never seen the above traceback.

poc