News for hackers. Stuff that matters.

A comment on Richard Stallman on why GNU su didn't support the “wheel” group. Parent comment

Re:Richard Stallman on why GNU su didn't support the “wheel”... by fiddlerwoaroof on Friday August 18, 2023 @07:21PM (#37183430)
You can do this on basically any modern unix by passing file descriptors over a unix socket: the “graphical editor” server would launch as a user that can’t access anything except a socket and then users would open files by pushing an open fd to the editor over its socket.
[ Parent | on HN ]
Re:Richard Stallman on why GNU su didn't support the “wheel”... by labster on Friday August 18, 2023 @09:18PM (#37184411)
While true and actually pretty cool, a comment like this is a pretty good explanation of why we haven’t had widespread adoption of Linux on the desktop. I can imagine the users’ eyes glazing over.
[ Parent | on HN ]
Re:Richard Stallman on why GNU su didn't support the “wheel”... by fiddlerwoaroof on Friday August 18, 2023 @10:01PM (#37184718)
I wouldn’t tell a user this, but developers of the desktop environments and distributions are leaving a lot of the design space unexplored.
[ Parent | on HN ]
Re:Richard Stallman on why GNU su didn't support the “wheel”... by gorgoiler on Friday August 18, 2023 @10:34PM (#37184920)
This sounds interesting but I don’t understand what the underlying mechanism is. For me, a file descriptor is just an int corresponding to something I can read from and write to and a socket just carries bytes. I don’t understand how an FD can be sent over a socket or, if it can, how that’s anything more than just sending an int?
[ Parent | on HN ]
Re:Richard Stallman on why GNU su didn't support the “wheel”... by wruza on Friday August 18, 2023 @10:50PM (#37184998)
https://en.wikipedia.org/wiki/Unix_domain_socket

In addition to sending data, processes may send file descriptors across a Unix domain socket connection using the sendmsg() and recvmsg() system calls. This allows the sending processes to grant the receiving process access to a file descriptor for which the receiving process otherwise does not have access.[2][3] This can be used to implement a rudimentary form of capability-based security.

[ Parent | on HN ]
Re:Richard Stallman on why GNU su didn't support the “wheel”... by fiddlerwoaroof on Friday August 18, 2023 @11:30PM (#37185210)
I’m not exactly sure of the terminology, but there’s an opaque object corresponding to the int that can be passed between processes via unix sockets. I believe nginx and other web servers do this to transfer open connections to the new server process on restart without interruption.
[ Parent | on HN ]
Re:Richard Stallman on why GNU su didn't support the “wheel”... by azlev on Friday August 18, 2023 @11:47PM (#37185307)
Ancillary data: https://linux.die.net/man/3/cmsg
[ Parent | on HN ]
Re:Richard Stallman on why GNU su didn't support the “wheel”... by ilyt on Saturday August 19, 2023 @12:10AM (#37185417)
It's special API that tells kernel to duplicate FD and give it to different process.

https://linux.die.net/man/7/unix

    SCM_RIGHTS
        Send or receive a set of open file descriptors from another process. The data
        portion  contains an integer array of the file descriptors. The passed file 
        descriptors behave as though they have been created with dup(2).
There are few interesting uses like for example, if you want to restart a network server, the old process can send its open, listening socket to the new process and thus achieve seamless switchover.

Other nifty thing with UNIX sockets is that you can just... read which user sent the message and as it is kernel adding that metadata you're 100% sure it came from that user. That's for example how you can set postgresql so say a certain user in the system can log as themselves without having to have a password.

[ Parent | on HN ]
Re:Richard Stallman on why GNU su didn't support the “wheel”... by rcxdude on Saturday August 19, 2023 @07:28AM (#37187674)
You can express most of this using the existing capabilities in linux, the issue is that the interfaces you use to do stuff need to change in order to actually make it usable (as opposed to just instantly disabled as soon as it becomes a problem, like apparmor).
[ Parent | on HN ]