From: Cyril Hrubis <chrubis@suse.cz>
To: Li Wang <liwang@redhat.com>
Cc: Petr Vorel <pvorel@suse.cz>,
ltp@lists.linux.it, Mimi Zohar <zohar@linux.ibm.com>,
linux-integrity@vger.kernel.org, selinux@vger.kernel.org,
Jan Stancek <jstancek@redhat.com>
Subject: Re: [PATCH v3 1/4] shell: Add tst_sudo.c helper
Date: Tue, 9 Dec 2025 14:19:48 +0100 [thread overview]
Message-ID: <aTgh9CIRfVWniUZD@yuki.lan> (raw)
In-Reply-To: <CAEemH2e6ivP0rzfTBp5LnZ8n-oe7moqfHszgs2QyYVMUTUQ_wQ@mail.gmail.com>
Hi!
> > I feel that the filename tst_sudo.c is a bit misleading. The helper
> > doesn’t
> > replicate sudo behavior (authentication, privilege escalation), it simply
> > drops from root to a fixed UID/GID before executing a command.
> >
> > So readers may expect a “sudo-like” elevation wrapper when, however
> > it’s a privilege-dropping trampoline.
> >
> > What about renaming it to:
> > tst_runas.c,
> > tst_runas_nobody.c, or
> > tst_drop_privs.c?
> >
>
>
> Personally, I prefer the tst_runas_nody.c because it reflects the
> default privilege,
> but due it supports the more env so contains "su" maybe better:
> tst_su_switch.c, tst_su_cmd.c
Maybe just tst_runas.c I think that 'runas' in the name is probably the
best description.
--
Cyril Hrubis
chrubis@suse.cz
WARNING: multiple messages have this Message-ID (diff)
From: Cyril Hrubis <chrubis@suse.cz>
To: Li Wang <liwang@redhat.com>
Cc: selinux@vger.kernel.org, linux-integrity@vger.kernel.org,
ltp@lists.linux.it
Subject: Re: [LTP] [PATCH v3 1/4] shell: Add tst_sudo.c helper
Date: Tue, 9 Dec 2025 14:19:48 +0100 [thread overview]
Message-ID: <aTgh9CIRfVWniUZD@yuki.lan> (raw)
In-Reply-To: <CAEemH2e6ivP0rzfTBp5LnZ8n-oe7moqfHszgs2QyYVMUTUQ_wQ@mail.gmail.com>
Hi!
> > I feel that the filename tst_sudo.c is a bit misleading. The helper
> > doesn’t
> > replicate sudo behavior (authentication, privilege escalation), it simply
> > drops from root to a fixed UID/GID before executing a command.
> >
> > So readers may expect a “sudo-like” elevation wrapper when, however
> > it’s a privilege-dropping trampoline.
> >
> > What about renaming it to:
> > tst_runas.c,
> > tst_runas_nobody.c, or
> > tst_drop_privs.c?
> >
>
>
> Personally, I prefer the tst_runas_nody.c because it reflects the
> default privilege,
> but due it supports the more env so contains "su" maybe better:
> tst_su_switch.c, tst_su_cmd.c
Maybe just tst_runas.c I think that 'runas' in the name is probably the
best description.
--
Cyril Hrubis
chrubis@suse.cz
--
Mailing list info: https://lists.linux.it/listinfo/ltp
next prev parent reply other threads:[~2025-12-09 13:19 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-27 8:26 [PATCH v3 0/4] tst_sudo.c, ima_{conditionals, measurements}.sh enhancements Petr Vorel
2025-11-27 8:26 ` [LTP] " Petr Vorel
2025-11-27 8:26 ` [PATCH v3 1/4] shell: Add tst_sudo.c helper Petr Vorel
2025-11-27 8:26 ` [LTP] " Petr Vorel
2025-11-27 11:57 ` Li Wang via ltp
2025-11-27 12:11 ` Li Wang via ltp
2025-11-27 12:55 ` Petr Vorel
2025-11-27 12:55 ` [LTP] " Petr Vorel
2025-12-09 13:19 ` Cyril Hrubis [this message]
2025-12-09 13:19 ` Cyril Hrubis
2025-12-09 18:44 ` Petr Vorel
2025-12-09 18:44 ` [LTP] " Petr Vorel
2025-11-27 8:26 ` [PATCH v3 2/4] tst_test.sh: Add TST_USR_{G,U}ID variables Petr Vorel
2025-11-27 8:26 ` [LTP] " Petr Vorel
2025-11-27 8:26 ` [PATCH v3 3/4] ima_{conditionals,measurements}.sh: Use tst_sudo Petr Vorel
2025-11-27 8:26 ` [LTP] [PATCH v3 3/4] ima_{conditionals, measurements}.sh: " Petr Vorel
2025-11-27 8:26 ` [PATCH v3 4/4] ima_conditionals.sh: Split test by request Petr Vorel
2025-11-27 8:26 ` [LTP] " Petr Vorel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aTgh9CIRfVWniUZD@yuki.lan \
--to=chrubis@suse.cz \
--cc=jstancek@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=liwang@redhat.com \
--cc=ltp@lists.linux.it \
--cc=pvorel@suse.cz \
--cc=selinux@vger.kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.