Permissions in udev don't work when klibc is used ?

Permissions in udev don't work when klibc is used ?

[Remco]

I don't know if this has come up before but I noticed that permissions don't 
work when klibc is used. The "create_node" function will report unknown users 
and groups, using calls to "getpwnam" and "getgrnam".
(compiled this way:
ln -s /lib/modules/$(uname -r)/build  klibc/klibc/
make USE_KLIBC=true USE_LOG=true DEBUG=true -j4)

I also noticed that "klibc_fixups.h" contains the "getgrnam" and "getpwnam" 
functions and lets them return NULL all of the time when USE_KLIBC is "true", 
which seem to be the cause of the failure.

I suppose "getgrnam" and "getpwnam" simply haven't been incorporated in klibc 
yet and that the lack of these two functions has been "fixed" this way, or am 
I missing something ?


P.S:
Unless I overlooked it, maybe a fair warning should be in place to tell people 
that permissions don't work when using klibc. (If my findings are correct off 
course)



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id\x1356&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: Permissions in udev don't work when klibc is used ?

[Kay Sievers]

On Mon, 2004-02-23 at 11:18, Remco wrote:
> I don't know if this has come up before but I noticed that permissions don't 
> work when klibc is used. The "create_node" function will report unknown users 
> and groups, using calls to "getpwnam" and "getgrnam".
> (compiled this way:
> ln -s /lib/modules/$(uname -r)/build  klibc/klibc/
> make USE_KLIBC=true USE_LOG=true DEBUG=true -j4)
> 
> I also noticed that "klibc_fixups.h" contains the "getgrnam" and "getpwnam" 
> functions and lets them return NULL all of the time when USE_KLIBC is "true", 
> which seem to be the cause of the failure.
> 
> I suppose "getgrnam" and "getpwnam" simply haven't been incorporated in klibc 
> yet and that the lack of these two functions has been "fixed" this way, or am 
> I missing something ?
> 
> 
> P.S:
> Unless I overlooked it, maybe a fair warning should be in place to tell people 
> that permissions don't work when using klibc. (If my findings are correct off 
> course)

Hey, how about reading the man pages?

"If  udev  was  built using klibc or is used before the user database is
accessible (e.g.  initrd(4)), only numeric owner and group  values  may
be used."

thanks,
Kay




-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id\x1356&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: Permissions in udev don't work when klibc is used ?

[Remco]

On Monday 23 February 2004 11:47, you wrote:
> On Mon, 2004-02-23 at 11:18, Remco wrote:
> > P.S:
> > Unless I overlooked it, maybe a fair warning should be in place to tell
> > people that permissions don't work when using klibc. (If my findings are
> > correct off course)
>
> Hey, how about reading the man pages?
>
> "If  udev  was  built using klibc or is used before the user database is
> accessible (e.g.  initrd(4)), only numeric owner and group  values  may
> be used."
>
> thanks,
> Kay


O.k., I found that, however, it wasn't the obvious place for me to look.
I looked for the word "permission" in the udev source tree and checked the 
Changlog, FAQ, README and TODO but none of these documents gave an 
explanation. (yes, udev.8 was among the documents found, but I didn't read it 
at that point) Personally, I tend to read man pages after I install a 
package, as I expect them to guide me through an installed, to be configured,  
package, not one to be installed. (This may be a bad assumption)

Since one has to decide whether to use klibc or not before starting to 
compile, I expected any (dis)advantages of each approach to be mentioned in 
an INSTALL or README.

Besides that, if permissions are important enough, I think the one line in the 
man page doesn't stand out enough to point out that permissions might not 
work as expected under certain circumstances. (I simply expected user and 
group names to work)


Just trying to understand udev permissions a little better, so please correct 
me if I'm wrong:

- permissions will always be set when using numeric owner (uid) and group 
(gid) values.

- for user and group names to work a "name conversion system" (user database + 
api to use it) needs to be in place. (e.g. /etc/passwd, /etc/group, ldap and 
glibc, nss-api, nss_ldap) 
klibc hasn't got such a system / api (or it's not fully functional ?) so only 
uid-s / gid-s are possible when linking against klibc.
A name conversion system might (or will ?) not be available when using initrd. 
(what about early userspace, or am I touching the TODO area too much now ?)



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id\x1356&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: Permissions in udev don't work when klibc is used ?

[Kay Sievers]

On Mon, 2004-02-23 at 15:01, Remco wrote:
> On Monday 23 February 2004 11:47, you wrote:
> > On Mon, 2004-02-23 at 11:18, Remco wrote:
> > > P.S:
> > > Unless I overlooked it, maybe a fair warning should be in place to tell
> > > people that permissions don't work when using klibc. (If my findings are
> > > correct off course)
> >
> > Hey, how about reading the man pages?
> >
> > "If  udev  was  built using klibc or is used before the user database is
> > accessible (e.g.  initrd(4)), only numeric owner and group  values  may
> > be used."
> >
> > thanks,
> > Kay
> 
> 
> O.k., I found that, however, it wasn't the obvious place for me to look.
> I looked for the word "permission" in the udev source tree and checked the 
> Changlog, FAQ, README and TODO but none of these documents gave an 
> explanation. (yes, udev.8 was among the documents found, but I didn't read it 
> at that point) Personally, I tend to read man pages after I install a 
> package, as I expect them to guide me through an installed, to be configured,  
> package, not one to be installed. (This may be a bad assumption)
> 
> Since one has to decide whether to use klibc or not before starting to 
> compile, I expected any (dis)advantages of each approach to be mentioned in 
> an INSTALL or README.
> 
> Besides that, if permissions are important enough, I think the one line in the 
> man page doesn't stand out enough to point out that permissions might not 
> work as expected under certain circumstances. (I simply expected user and 
> group names to work)

Yes, I agree. But remember udev is so very young and not perfect.
We worked hard on more important features the last weeks, so this was
simply not handled.
I will post a patch tonight, that extends klibc_fixups.* which is able
to parse /etc/passdw, /etc/group. It already works on my box.

So just wait a few hours :)

thanks,
Kay



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id\x1356&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: Permissions in udev don't work when klibc is used ?

[Remco]

On Monday 23 February 2004 15:30, you wrote:
> > Since one has to decide whether to use klibc or not before starting to
> > compile, I expected any (dis)advantages of each approach to be mentioned
> > in an INSTALL or README.
> >
> > Besides that, if permissions are important enough, I think the one line
> > in the man page doesn't stand out enough to point out that permissions
> > might not work as expected under certain circumstances. (I simply
> > expected user and group names to work)
>
> Yes, I agree. But remember udev is so very young and not perfect.
> We worked hard on more important features the last weeks, so this was
> simply not handled.
> I will post a patch tonight, that extends klibc_fixups.* which is able
> to parse /etc/passdw, /etc/group. It already works on my box.
>
> So just wait a few hours :)
>
> thanks,
> Kay


Thank you very much,

Keep up the good work !



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id\x1356&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: Permissions in udev don't work when klibc is used ?

[Olaf Hering]

 On Mon, Feb 23, Remco wrote:

> - for user and group names to work a "name conversion system" (user database + 
> api to use it) needs to be in place. (e.g. /etc/passwd, /etc/group, ldap and 
> glibc, nss-api, nss_ldap) 
> klibc hasn't got such a system / api (or it's not fully functional ?) so only 
> uid-s / gid-s are possible when linking against klibc.
> A name conversion system might (or will ?) not be available when using initrd. 
> (what about early userspace, or am I touching the TODO area too much now ?)

You can build your udev.permissions via sed, grep, awk or whatever via
getent passwd and getenv group and convert the names to numbers. No need
to pollute klibc with 'useless' stuff.


# provide numbers because klibc has no getpwnam function
# everything would belong to root
PT="`mktemp -q /tmp/udev.mkinitramfs.passwd.$$.XXXXXX`"
GT="`mktemp -q /tmp/udev.mkinitramfs.group.$$.XXXXXX`"
getent passwd | sed -e 's@^\([^:]\+\):[^:]*:\([^:]*\):.*@\1:\2@' > $PT
getent group | sed -e 's@^\([^:]\+\):[^:]*:\([^:]*\):.*@\1:\2@' > $GT
I=$IFS
IFS=:
while read a b c d e ; do
case "$a" in
	\#*|"") echo comment ;;
	*)
	dev=$a
	owner="`sed -e \"/^$b:/s@^.*:@@p;d\" < $PT`"
	group="`sed -e \"/^$c:/s@^.*:@@p;d\" < $GT`"
	if [ "$owner" = "" ] ; then owner=0 ; fi
	if [ "$group" = "" ] ; then group=0 ; fi
	mode=$d
	echo "$dev:$owner:$group:$mode" >> "$INITRD$udev_permissions"
	;;
esac
done < "$udev_permissions"
IFS=$I
rm -fv $PT $GT

If you find a faster solution, let us know.

-- 
USB is for mice, FireWire is for men!

sUse lINUX ag, nÃœRNBERG


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id\x1356&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: Permissions in udev don't work when klibc is used ?

[Kay Sievers]

On Mon, Feb 23, 2004 at 05:39:42PM +0100, Olaf Hering wrote:
>  On Mon, Feb 23, Remco wrote:
> 
> > - for user and group names to work a "name conversion system" (user database + 
> > api to use it) needs to be in place. (e.g. /etc/passwd, /etc/group, ldap and 
> > glibc, nss-api, nss_ldap) 
> > klibc hasn't got such a system / api (or it's not fully functional ?) so only 
> > uid-s / gid-s are possible when linking against klibc.
> > A name conversion system might (or will ?) not be available when using initrd. 
> > (what about early userspace, or am I touching the TODO area too much now ?)
> 
> You can build your udev.permissions via sed, grep, awk or whatever via
> getent passwd and getenv group and convert the names to numbers. No need
> to pollute klibc with 'useless' stuff.

I want to keep the difference between glibc and klibc as small as
possible. It's easy to do with just a few lines and it's better than
a magic update script and a udev.permissions without user readable content.

And initrd just needs a copy of the system files.

Hey, you've complained a lot about 'useless' stuff the last time.
Maybe you just just want to make the whole udev thing a big shell
script for you :)


thanks,
Kay


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id\x1356&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: Permissions in udev don't work when klibc is used ?

[Olaf Hering]

 On Mon, Feb 23, Kay Sievers wrote:

> On Mon, Feb 23, 2004 at 05:39:42PM +0100, Olaf Hering wrote:
> >  On Mon, Feb 23, Remco wrote:
> > 
> > > - for user and group names to work a "name conversion system" (user database + 
> > > api to use it) needs to be in place. (e.g. /etc/passwd, /etc/group, ldap and 
> > > glibc, nss-api, nss_ldap) 
> > > klibc hasn't got such a system / api (or it's not fully functional ?) so only 
> > > uid-s / gid-s are possible when linking against klibc.
> > > A name conversion system might (or will ?) not be available when using initrd. 
> > > (what about early userspace, or am I touching the TODO area too much now ?)
> > 
> > You can build your udev.permissions via sed, grep, awk or whatever via
> > getent passwd and getenv group and convert the names to numbers. No need
> > to pollute klibc with 'useless' stuff.
> 
> I want to keep the difference between glibc and klibc as small as
> possible. It's easy to do with just a few lines and it's better than
> a magic update script and a udev.permissions without user readable content.

the whole purpose of klibc is to bring up the system via initramfs. this
does not include user handling.

> And initrd just needs a copy of the system files.

sure, in a preprocessed form.

> Hey, you've complained a lot about 'useless' stuff the last time.
> Maybe you just just want to make the whole udev thing a big shell
> script for you :)

Well, its somehow like the editor discussion. My point is that klibc
does not have to care about names, only numbers. Because if you go that
route and add the whole glibc userhandling stuff then you can use glibc
in the first place. klibc is small, lets keep it that way.

-- 
USB is for mice, FireWire is for men!

sUse lINUX ag, n√úRNBERG


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id\x1356&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: Permissions in udev don't work when klibc is used ?

[Darren Salt]

I demand that Kay Sievers may or may not have written...

[snip: user/group names, klibc]
> I want to keep the difference between glibc and klibc as small as possible.
> It's easy to do with just a few lines and it's better than a magic update
> script and a udev.permissions without user readable content.

This seems reasonable...

> And initrd just needs a copy of the system files.

And when they're updated (assuming that the change, be it in a udev
configuration file or /etc/passwd or /etc/group or similar) affects
ownership)? Automatically rebuild the image, rerun lilo? :-)

Not that it really matters: ISTM that an early udev could populate the
initial /dev (almost) entirely from sysfs, using default settings of
root:root 0600. Once into early userspace, a "full" udev would be run, with
one of the effects being to set access rights to something more appropriate.

(I don't use an initrd for non-rescue non-install boots, and plan to (try to)
continue this even if/when It Is Decreed That Thou Shalt Use An Initrd, It Is
No Longer Optional. I just don't *want* an initrd...)

-- 
| Darren Salt | d youmustbejoking,demon,co,uk | nr. Ashington,
| Debian,     | s zap,tartarus,org            | Northumberland
| RISC OS     | @                             | Toon Army
|   <URL:http://www.youmustbejoking.demon.co.uk/progs.packages.html>

tartar sauce: n. # rm -rf /usr/{local/,}src/*


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id\x1356&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: Permissions in udev don't work when klibc is used ?

[Kay Sievers]

On Mon, 2004-02-23 at 19:55, Olaf Hering wrote:
>  On Mon, Feb 23, Kay Sievers wrote:
> 
> > On Mon, Feb 23, 2004 at 05:39:42PM +0100, Olaf Hering wrote:
> > >  On Mon, Feb 23, Remco wrote:
> > > 
> > > > - for user and group names to work a "name conversion system" (user database + 
> > > > api to use it) needs to be in place. (e.g. /etc/passwd, /etc/group, ldap and 
> > > > glibc, nss-api, nss_ldap) 
> > > > klibc hasn't got such a system / api (or it's not fully functional ?) so only 
> > > > uid-s / gid-s are possible when linking against klibc.
> > > > A name conversion system might (or will ?) not be available when using initrd. 
> > > > (what about early userspace, or am I touching the TODO area too much now ?)
> > > 
> > > You can build your udev.permissions via sed, grep, awk or whatever via
> > > getent passwd and getenv group and convert the names to numbers. No need
> > > to pollute klibc with 'useless' stuff.
> > 
> > I want to keep the difference between glibc and klibc as small as
> > possible. It's easy to do with just a few lines and it's better than
> > a magic update script and a udev.permissions without user readable content.
> 
> the whole purpose of klibc is to bring up the system via initramfs. this
> does not include user handling.
> 
> > And initrd just needs a copy of the system files.
> 
> sure, in a preprocessed form.
> 
> > Hey, you've complained a lot about 'useless' stuff the last time.
> > Maybe you just just want to make the whole udev thing a big shell
> > script for you :)
> 
> Well, its somehow like the editor discussion. My point is that klibc
> does not have to care about names, only numbers. Because if you go that
> route and add the whole glibc userhandling stuff then you can use glibc
> in the first place. klibc is small, lets keep it that way.

No, I don't think so.
klibc is also used for the normal udev not only in initramfs
and we should avoid all possible differences between the libc's.
klibc isnt't touched directly, _udev_ reads the passwd!

thanks and over,
Kay



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id\x1356&alloc_id438&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel