| 1 |
On 04/27/2014 09:01 AM, Sven Vermeulen wrote: |
| 2 |
> On Thu, Apr 24, 2014 at 07:13:45PM -0500, Dustin C. Hatch wrote: |
| 3 |
>> I have been struggling to get my hardened systems managed by Ansible for |
| 4 |
>> quite some time now. I have almost everything working well now, except |
| 5 |
>> service control. It seems like the run_init stuff in OpenRC behaves |
| 6 |
>> strangely when /sbin/rc-service is called via exec(), |
| 7 |
>> stdin/stdout/stderr are connected to pipes, and the whole thing is run |
| 8 |
>> through sudo. I suspect it has something to do with the way run_init |
| 9 |
>> tries to prompt for credentials (even though I have that "disabled"). |
| 10 |
> [...] |
| 11 |
>> p = subprocess.Popen(['/sbin/rc-service', 'nfsmount', 'restart'], |
| 12 |
>> stdin=subprocess.PIPE, |
| 13 |
>> stdout=subprocess.PIPE, |
| 14 |
>> stderr=subprocess.PIPE) |
| 15 |
>> o, e = p.communicate() |
| 16 |
>> print('exitcode: {}'.format(p.returncode)) |
| 17 |
>> print('stdout: {}'.format(o)) |
| 18 |
>> print('stderr: {}'.format(e)) |
| 19 |
> |
| 20 |
> Try calling rc-service through run_init, so something like |
| 21 |
> |
| 22 |
> #v+ |
| 23 |
> p = subprocess.Popen(['/sbin/run_init', '/sbin/rc-service', 'nfsmount', |
| 24 |
> 'restart']...) |
| 25 |
> #v- |
| 26 |
> |
| 27 |
|
| 28 |
I really have no control over how rc-service gets called, since it is |
| 29 |
handled by Ansible. I did try using run_init in my example code, but |
| 30 |
that caused it to fail 100% of the time, not just when run by sudo. This |
| 31 |
leads me to believe that the problem is in run_init itself. |
| 32 |
|
| 33 |
Further testing finally revealed an error when I connected stdout and |
| 34 |
stderr to pipes, but left stdin connected to the console: |
| 35 |
|
| 36 |
tcgetattr:: Inappropriate ioctl for device |
| 37 |
|
| 38 |
It would seem run_init is unconditionally trying to manipulate stdout as |
| 39 |
if it were a TTY, which may be the problem. |
| 40 |
|
| 41 |
> [...] |
| 42 |
>> As you can see, this happens even when SELinux is not enforcing, so I |
| 43 |
>> don't think it is policy related. I wonder if there is some way to stop |
| 44 |
>> run_init from trying to prompt for authentication altogether, especially |
| 45 |
>> when stdin/stdout/stderr is not a tty. |
| 46 |
>> |
| 47 |
>> Any thoughts or pointers would be appreciated. |
| 48 |
> |
| 49 |
> There's some magic involved, see my small write-up at |
| 50 |
> http://blog.siphos.be/2013/04/not-needing-run_init-for-password-less-service-management/ |
| 51 |
> |
| 52 |
|
| 53 |
Thanks, I've read that post a few times, and it does help me understand |
| 54 |
how the transition takes place. I don't think this problem is directly |
| 55 |
SELinux related anymore though, but rather a bug in run_init. I'll try |
| 56 |
to track it down. |
| 57 |
|
| 58 |
|
| 59 |
-- |
| 60 |
♫Dustin |
| 61 |
http://dustin.hatch.name/ |
Archives