[Cluster-devel] [PATCH] config: allow cman to configure uid/gid for corosync IPC

[Fabio M. Di Nitto <fdinitto@redhat.com>]

Resolves: rhbz#733345

Signed-off-by: Fabio M. Di Nitto <fdinitto@redhat.com>
---
 cman/daemon/cman-preconfig.c         |    1 +
 config/tools/xml/cluster.rng.in.head |   22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+), 0 deletions(-)

diff --git a/cman/daemon/cman-preconfig.c b/cman/daemon/cman-preconfig.c
index 4b8419e..64f505f 100644
--- a/cman/daemon/cman-preconfig.c
+++ b/cman/daemon/cman-preconfig.c
@@ -1532,6 +1532,7 @@ static int cmanpre_readconfig(struct objdb_iface_ver0 *objdb, const char **error
 		ret = copy_tree_to_root(objdb, "amf", 0);
 		ret = copy_tree_to_root(objdb, "aisexec", 0);
 		ret = copy_tree_to_root(objdb, "service", 1);
+		ret = copy_tree_to_root(objdb, "uidgid", 0);
 	}
 
 	objdb->object_find_create(cluster_parent_handle, "cman", strlen("cman"), &find_handle);
diff --git a/config/tools/xml/cluster.rng.in.head b/config/tools/xml/cluster.rng.in.head
index 7696533..1afa9e8 100644
--- a/config/tools/xml/cluster.rng.in.head
+++ b/config/tools/xml/cluster.rng.in.head
@@ -7,6 +7,7 @@ xmlns:rha="http://redhat.com/~pkennedy/annotation_namespace/cluster_conf_annot_n
 cluster
 - cman
 - totem
+- uidgid
 - quorumd
 - fence_daemon
 - fence_xvmd
@@ -169,6 +170,27 @@ To validate your cluster.conf against this schema, run:
  </optional>
 <!-- end cman block -->
 
+<!-- uidgid block -->
+ <optional>
+  <zeroOrMore>
+   <element name="uidgid" rha:description="Access control to corosync IPC">
+    <optional>
+     <attribute name="uid" rha:description="This is an unprivileged username,
+         as globally available to the system via /etc/passwd, including nis/ldap,
+         allowed to connect to corosync IPC. This value cannot be updated@runtime,
+         a full cman restart is required." rha:default="" rha:samble="userfoo"/>
+    </optional>
+    <optional>
+     <attribute name="gid" rha:description="This is an unprivileged group name,
+         as globally available to the system via /etc/group, including nis/ldap,
+         allowed to connect to corosync IPC. This value cannot be updated@runtime,
+         a full cman restart is required." rha:default="" rha:samble="groupfoo"/>
+    </optional>
+   </element>
+  </zeroOrMore>
+ </optional>
+<!-- end uidgid block -->
+
 <!-- totem block -->
  <optional>
   <element name="totem" rha:description="OpenAIS msg transport
-- 
1.7.4.4