[naviserver-tracker] [ naviserver-Feature Requests-1119365 ] Watchdog/binder process

[SourceForge.net <no...@so...>]

Feature Requests item #1119365, was opened at 2005-02-09 15:43
Message generated for change (Comment added) made by seryakov
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=719009&aid=1119365&group_id=130646

Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Vlad Seryakov (seryakov)
Assigned to: Nobody/Anonymous (nobody)
Summary: Watchdog/binder process

Initial Comment:
I find current binder and -b command line option not
very usefull and easy to administer. Can we revert back
to 3.x binder and combine it with simple watchdog
process, so on start ns forks watchdog/biner process,
check for exit status and accepts
requests for socket allocation.

----------------------------------------------------------------------

>Comment By: Vlad Seryakov (seryakov)
Date: 2005-02-09 21:00

Message:
Logged In: YES 
user_id=184124

Here is the new syntax i added to the binder:

addr:port[/protocol]
port[/protocol]
0/icmp[/count]

where protocol can be tcp,udp,unix,icmp is special case of
raw socket, added by count.


----------------------------------------------------------------------

Comment By: Stephen Deasey (sdeasey)
Date: 2005-02-09 20:55

Message:
Logged In: YES 
user_id=87254


Adding support for socket types other than TCP to the binder
sounds like a great idea.


----------------------------------------------------------------------

Comment By: Vlad Seryakov (seryakov)
Date: 2005-02-09 19:55

Message:
Logged In: YES 
user_id=184124

I agree, i use inittab for aolserver myself calling bach
script which parses nsd.tcl for address/port keyworkd and
builds -b options on the fly. In case of inittab, no need in
watchdog as well.
It is not even on my wish list, i just figured if watchdog
is to berunning as root, then it can include binder support.
Let's put aside binder as separate process issue for a
while, but i'd like to add to regular 4.x binder what i did
for supporting UDP/TCP/UNIX/RAW sockets. They still need to
be pre-bound but then can be used from within AS, this is
how snmp and dns modules uses those sockets.


----------------------------------------------------------------------

Comment By: Stephen Deasey (sdeasey)
Date: 2005-02-09 19:52

Message:
Logged In: YES 
user_id=87254


Hmm...  I guess you could split the config into multiple
pieces, let admins manage everything except address and port
to bind to.  But would we mandate that in the defautl
set-up, or just hope people didn't screw up in practice?


----------------------------------------------------------------------

Comment By: Stephen Deasey (sdeasey)
Date: 2005-02-09 19:49

Message:
Logged In: YES 
user_id=87254


I think the issue here is that you need root privs to bind
to port 80.  The address and port are specified in the
config file.  The config file is a Tcl script.

So to allow someone to change your webserver config file you
need to give away root privs on your server.  I'm not super
keen on this :-)

IIRC in 3.x there was a lot of code to make sure that the
config script was evaled in a safe interp, and the
motivation for the binder was code reduction/simplification.

This also impacts the chroot functionality.  Idealy you want
to chroot as the last thing you do before dropping root
privs so that you can open all your fileslink to libraries
etc., and not have to recreate a complete copy of your
environment in the jail.  But you need to know which
directory that is, and that's in the config file, which is a
script...

Personaly, I use daemontools to manage my servers.  You need
to create a simple wrapper script for this to work and I
find that is the ideal place to set some environment
variables for the IP, PORT etc.  I can pass those along on
the command line and extract them from the env in the tcl
config script with [env get IP] and so on.

The binder is a neat solution, but in practice it trips a
lot of people up and it's just a pain.  Giving away root is
not a great solution though...  :-(



----------------------------------------------------------------------

Comment By: Zoran Vasiljevic (vasiljevic)
Date: 2005-02-09 17:23

Message:
Logged In: YES 
user_id=95086

Honestly, I did forget already how 3.x did the binding :-What we do in 4.0 is to bind on all interfaces 
(I modified that in our private version).
But I'm open to all variants. I suppose I should look 
back in 3.x code how that was done... 
Or, you have a crystal-clear picture already in which 
case I will simply believe you ;-)
As soon as we create the sandbox, we can start hacking
this in. 



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=719009&aid=1119365&group_id=130646