pcp
[Top] [All Lists]

Re: [pcp] proc pmda access control changes

To: Ken McDonell <kenj@xxxxxxxxxxxxxxxx>
Subject: Re: [pcp] proc pmda access control changes
From: Nathan Scott <nathans@xxxxxxxxxx>
Date: Wed, 24 Jul 2013 07:39:02 -0400 (EDT)
Cc: PCP Mailing List <pcp@xxxxxxxxxxx>
Delivered-to: pcp@xxxxxxxxxxx
In-reply-to: <51EFBB29.1000807@xxxxxxxxxxxxxxxx>
References: <51EFBB29.1000807@xxxxxxxxxxxxxxxx>
Reply-to: Nathan Scott <nathans@xxxxxxxxxx>
Thread-index: LQC+oBiQ2fpJGYYJKx2u2rYe78RfsA==
Thread-topic: proc pmda access control changes
Hi Ken,

----- Original Message -----
> qa/308 is failing for me, because of this, even as root ...
> 
> # pminfo -f proc.psinfo.ppid
> 
> proc.psinfo.ppid
> Error: No permission to perform requested operation
> 
> What magic sauce is needed to restore the promiscuous mode for the proc
> pmda?

See tests 022, 390, 580 for some examples using unix domain sockets.

For remote fetching though (which this test does), SASL authentication
is the only way now.  This is much harder to test (there are so many
different auth mechanisms) - I've started automated SASL testing but
its not generalised yet.  Will get back to you when I have an example,
for now I'd _notrun it.  There is no pmdaproc backdoor, credentials
must be presented ... should we consider adding one for back-compat?
I'd prefer not to, but guess we could go either way - it'd just take
a non-default command line option to disable the checks.

cheers.

--
Nathan

<Prev in Thread] Current Thread [Next in Thread>