On 04/27/2014 09:01 AM, Sven Vermeulen wrote:
> On Thu, Apr 24, 2014 at 07:13:45PM -0500, Dustin C. Hatch wrote:
>> I have been struggling to get my hardened systems managed by Ansible for
>> quite some time now. I have almost everything working well now, except
>> service control. It seems like the run_init stuff in OpenRC behaves
>> strangely when /sbin/rc-service is called via exec(),
>> stdin/stdout/stderr are connected to pipes, and the whole thing is run
>> through sudo. I suspect it has something to do with the way run_init
>> tries to prompt for credentials (even though I have that "disabled").
> [...]
>> p = subprocess.Popen(['/sbin/rc-service', 'nfsmount', 'restart'],
>> stdin=subprocess.PIPE,
>> stdout=subprocess.PIPE,
>> stderr=subprocess.PIPE)
>> o, e = p.communicate()
>> print('exitcode: {}'.format(p.returncode))
>> print('stdout: {}'.format(o))
>> print('stderr: {}'.format(e))
>
> Try calling rc-service through run_init, so something like
>
> #v+
> p = subprocess.Popen(['/sbin/run_init', '/sbin/rc-service', 'nfsmount',
> 'restart']...)
> #v-
>
I really have no control over how rc-service gets called, since it is
handled by Ansible. I did try using run_init in my example code, but
that caused it to fail 100% of the time, not just when run by sudo. This
leads me to believe that the problem is in run_init itself.
Further testing finally revealed an error when I connected stdout and
stderr to pipes, but left stdin connected to the console:
tcgetattr:: Inappropriate ioctl for device
It would seem run_init is unconditionally trying to manipulate stdout as
if it were a TTY, which may be the problem.
> [...]
>> As you can see, this happens even when SELinux is not enforcing, so I
>> don't think it is policy related. I wonder if there is some way to stop
>> run_init from trying to prompt for authentication altogether, especially
>> when stdin/stdout/stderr is not a tty.
>>
>> Any thoughts or pointers would be appreciated.
>
> There's some magic involved, see my small write-up at
> http://blog.siphos.be/2013/04/not-needing-run_init-for-password-less-service-management/
>
Thanks, I've read that post a few times, and it does help me understand
how the transition takes place. I don't think this problem is directly
SELinux related anymore though, but rather a bug in run_init. I'll try
to track it down.
--
♫Dustin
http://dustin.hatch.name/
