search

opensciencegrid / xrootd-multiuser

A filesystem plugin to allow Xrootd write as a different Unix user
Apache License 2.0
2 stars 12 forks source link

Use thread-specific setgroups syscall to set supplementary groups on individual threads #47

Closed jthiltges closed 1 year ago

jthiltges commented 1 year ago

Code builds, but is untested at present

jthiltges commented 1 year ago

@matyasselmeci I just finished some cleanup and light testing and pushed a new revision. It seems to set and clear supplementary gids as intended.

Note that it clears the supplementary gids, rather than saving and restoring them. In local testing, the (cmsd|xrootd)-privileged daemons didn't show any supplementary groups defined.

matyasselmeci commented 1 year ago

I built an xrootd-multiuser RPM with this as a patch: https://opensciencegrid.atlassian.net/browse/SOFTWARE-5608 it passed automated tests (which test multiuser but not groups); we'll find an origin to try it out on. Code looks good to me but I'm not an expert in this codebase so maybe Derek should take a look too.

brianhlin commented 1 year ago

We also tested this with the PATh Facility dev origin and verified that it works! https://opensciencegrid.atlassian.net/browse/SOFTWARE-5608

brianhlin commented 1 year ago

Fixes #44 , #41

ppaschos commented 1 year ago

are we ready to test this on the osdf origins?

On Tue, Aug 15, 2023 at 8:48 AM Brian Lin @.***> wrote:

Merged #47 https://urldefense.com/v3/__https://github.com/opensciencegrid/xrootd-multiuser/pull/47__;!!BpyFHLRN4TMTrA!77pHxklOjbEfgvzRDZLt8DYkn8IWMabNdjUn68l6tls6_QxyKjXAmJePa1CW7M7mmXlXgbWviVWv1FB6R9KsdsFShFA$ into master.

— Reply to this email directly, view it on GitHub https://urldefense.com/v3/__https://github.com/opensciencegrid/xrootd-multiuser/pull/47*event-10097243686__;Iw!!BpyFHLRN4TMTrA!77pHxklOjbEfgvzRDZLt8DYkn8IWMabNdjUn68l6tls6_QxyKjXAmJePa1CW7M7mmXlXgbWviVWv1FB6R9KsqidJsU4$, or unsubscribe https://urldefense.com/v3/__https://github.com/notifications/unsubscribe-auth/AFZESXO3RB3LDK2VRWQP6X3XVN44JANCNFSM6AAAAAAZPMQ4EM__;!!BpyFHLRN4TMTrA!77pHxklOjbEfgvzRDZLt8DYkn8IWMabNdjUn68l6tls6_QxyKjXAmJePa1CW7M7mmXlXgbWviVWv1FB6R9KstFXJQN8$ . You are receiving this because you are subscribed to this thread.Message ID: <opensciencegrid/xrootd-multiuser/pull/47/issue_event/10097243686@ github.com>

-- Pascal Paschos, Ph.D. OSG/PATh Collaboration Support *Enrico Fermi Institute - *University of Chicago ph: 773-702-4679

brianhlin commented 1 year ago

The version we released earlier this week actually already contains this patch. I tested it with the dev PATh Facility origin and will be deploying it on the PATh Facility prod origin later. What other origins do you need this deployed on?

ppaschos commented 1 year ago

the osdf origin on ap23.uc.osg-htc.org: /ospool/uc-shared/project.

On Tue, Aug 15, 2023 at 4:36 PM Brian Lin @.***> wrote:

The version we released earlier this week actually already contains this patch. I tested it with the dev PATh Facility origin and will be deploying it on the PATh Facility prod origin later. What other origins do you need this deployed on?

— Reply to this email directly, view it on GitHub https://urldefense.com/v3/__https://github.com/opensciencegrid/xrootd-multiuser/pull/47*issuecomment-1679649594__;Iw!!BpyFHLRN4TMTrA!_1ImdCHT-Qcl8f58C4Xa2tSMqp0vSqH7akh69BgytfGKWWuraxSKjE9O2k0DzOgjjbaMMcyaa6YaiFt-YQ7RIQCbagQ$, or unsubscribe https://urldefense.com/v3/__https://github.com/notifications/unsubscribe-auth/AFZESXMYNH4UVWCYH5YXDTTXVPTVBANCNFSM6AAAAAAZPMQ4EM__;!!BpyFHLRN4TMTrA!_1ImdCHT-Qcl8f58C4Xa2tSMqp0vSqH7akh69BgytfGKWWuraxSKjE9O2k0DzOgjjbaMMcyaa6YaiFt-YQ7Rw_t0csQ$ . You are receiving this because you commented.Message ID: @.***>

-- Pascal Paschos, Ph.D. OSG/PATh Collaboration Support *Enrico Fermi Institute - *University of Chicago ph: 773-702-4679

ppaschos commented 1 year ago

you were out during the collab meeting in madison so check here for the relevant drive behind this:

https://docs.google.com/document/d/1--a-GHaTZ09uzISZwOMXqL_l3taxUY3iOHpeke9VWJI/edit#heading=h.xwhwh6x18r2i

On Tue, Aug 15, 2023 at 4:46 PM Paschalis Paschos @.***> wrote:

the osdf origin on ap23.uc.osg-htc.org: /ospool/uc-shared/project.

On Tue, Aug 15, 2023 at 4:36 PM Brian Lin @.***> wrote:

The version we released earlier this week actually already contains this patch. I tested it with the dev PATh Facility origin and will be deploying it on the PATh Facility prod origin later. What other origins do you need this deployed on?

— Reply to this email directly, view it on GitHub https://urldefense.com/v3/__https://github.com/opensciencegrid/xrootd-multiuser/pull/47*issuecomment-1679649594__;Iw!!BpyFHLRN4TMTrA!_1ImdCHT-Qcl8f58C4Xa2tSMqp0vSqH7akh69BgytfGKWWuraxSKjE9O2k0DzOgjjbaMMcyaa6YaiFt-YQ7RIQCbagQ$, or unsubscribe https://urldefense.com/v3/__https://github.com/notifications/unsubscribe-auth/AFZESXMYNH4UVWCYH5YXDTTXVPTVBANCNFSM6AAAAAAZPMQ4EM__;!!BpyFHLRN4TMTrA!_1ImdCHT-Qcl8f58C4Xa2tSMqp0vSqH7akh69BgytfGKWWuraxSKjE9O2k0DzOgjjbaMMcyaa6YaiFt-YQ7Rw_t0csQ$ . You are receiving this because you commented.Message ID: @.***>

-- Pascal Paschos, Ph.D. OSG/PATh Collaboration Support *Enrico Fermi Institute - *University of Chicago ph: 773-702-4679

-- Pascal Paschos, Ph.D. OSG/PATh Collaboration Support *Enrico Fermi Institute - *University of Chicago ph: 773-702-4679