linux-lvm.redhat.com archive mirror
 help / color / mirror / Atom feed
From: Christoph Pleger <christoph.pleger@cs.uni-dortmund.de>
To: LVM general discussion and development <linux-lvm@redhat.com>
Cc: Alasdair G Kergon <agk@redhat.com>
Subject: Re: [linux-lvm] lvcreate from a setuid-root binary
Date: Mon, 19 Nov 2018 16:17:18 +0100	[thread overview]
Message-ID: <9f8cbe2ad03bf8e3dff7538a844a58cb@cs.uni-dortmund.de> (raw)
In-Reply-To: <20181119131940.GA13390@localhost.localdomain>

Hello,

On 2018-11-19 14:19, Bryn M. Reeves wrote:
> On Fri, Nov 16, 2018 at 02:43:10PM +0100, Christoph Pleger wrote:
>> The beginning is that I want to create a user-specific logical volume 
>> when a
>> user logs in to a service that authenticates its users through pam and 
>> that
>> does not run as root.
> 
> Couldn't you use a pam_scripts ses_open/ses_close hook to do this?
> 
> That way you can get rid of any suid binary and rely on the well
> tested PAM stack to carry out the set up (and optionally clean up)
> for the users at login/out time.

Hm, I do not see how the scripts called by pam_scripts can be executed 
with another user id than the process that called pam_authenticate()?

Regards
   Christoph

  reply	other threads:[~2018-11-19 15:17 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-11-15 16:39 [linux-lvm] lvcreate from a setuid-root binary Christoph Pleger
2018-11-15 17:57 ` Alasdair G Kergon
2018-11-16 13:43   ` Christoph Pleger
2018-11-16 15:32     ` Zdenek Kabelac
2018-11-16 16:12       ` Christoph Pleger
2018-11-16 17:21         ` Roger Heflin
2018-11-16 15:41     ` Stuart D. Gathman
2018-11-21  9:56       ` Christoph Pleger
2018-11-21  9:58         ` Vladislav Bogdanov
2018-11-21 10:23           ` Christoph Pleger
2018-11-17  0:24     ` Alasdair G Kergon
2018-11-19  8:55       ` Christoph Pleger
2018-11-19 13:01         ` Alasdair G Kergon
2018-11-19 13:19     ` Bryn M. Reeves
2018-11-19 15:17       ` Christoph Pleger [this message]
2018-11-19 15:35 ` Christoph Pleger
     [not found] <1044845531.2858991.1542636286779.ref@mail.yahoo.com>
2018-11-19 14:04 ` matthew patton
2018-11-19 15:03   ` Christoph Pleger
     [not found] <1479542688.2901829.1542643514135.ref@mail.yahoo.com>
2018-11-19 16:05 ` matthew patton
     [not found] <1657965510.4711397.1542904883060.ref@mail.yahoo.com>
2018-11-22 16:41 ` matthew patton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=9f8cbe2ad03bf8e3dff7538a844a58cb@cs.uni-dortmund.de \
    --to=christoph.pleger@cs.uni-dortmund.de \
    --cc=agk@redhat.com \
    --cc=linux-lvm@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).