Usage of less privileged account about znapzend HOT 13 CLOSED

Problem solved.
The error disappears when a local variable for storing the result of the function is used.

from znapzend.

what do you mean with the local variable ?

from znapzend.

I got the error in sendRecvSnapshots with
...
my @recvCmd = $self->$buildRemoteRefArray($remote, [$mbuffer, @{$self->mbufferParam},
$mbufferSize, '-4', '-I', $mbufferPort], [$self->pfexec, 'zfs', 'recv', $recvOpt, $dstDataSet]);
...
and changed it to

my $pfexec = $self->pfexec;
my @recvCmd = $self->$buildRemoteRefArray($remote, [$mbuffer, @{$self->mbufferParam},
$mbufferSize, '-4', '-I', $mbufferPort], [$pfexec, 'zfs', 'recv', $recvOpt, $dstDataSet]);

from znapzend.

very odd that this should make a difference

from znapzend.

Unfortunately I am not a perl guru and have no idea how exxplain it.
If I compare it with other languages I would assume that the usage of the function is by reference and not by value.
And
my $pfexec = $self->pfexec;
is not a reference to the function but the result of the function.
Adn this works.
And the problem coccurs only in the forked subroutine and not in the other parts of the code.

from znapzend.

are you using an old version of perl ? from what I know of perl, this does not make a lot of sense ...

by adding the () you could enforce the notion that this is a function to be called. But as you can see in the line above where mbufferParam is called, this seems to work just fine

my @recvCmd = $self->$buildRemoteRefArray($remote, [$mbuffer, @{$self->mbufferParam},
$mbufferSize, '-4', '-I', $mbufferPort], [$self->pfexec(), 'zfs', 'recv', $recvOpt, $dstDataSet]);

from znapzend.

I deleted my branch upstream1 but there are 2 comments from you.

Of course pfexec can always be used and does not harm. It is necessary where write operations are used.
But in BSD or Linux pfexec does not exist and instead sudo must be used.

Following your comments I changed:

1. pfexec is now defined as
   $self->oracleMode ? qw(pfexec) : qw();

I changed alle occurences where $self->pfexec is used as function arguments for $buildRemote to:
my @ssh = $self->$buildRemote($remote, [@{$self->pfexec}, @cmd, $zpool]);
This produces the aforementioned error
[Mon Dec 15 12:40:00 2014] [warn] taking snapshot on pool1/nfs/nfs1 failed: Can't use string ("pfexec") as an ARRAY ref while "strict refs" in use at /opt/bin/../lib/ZnapZend/ZFS.pm line 200.

3. and after reading some chapters in "Programming Perl" pfexec is now defined as
   $self->oracleMode ? [qw(pfexec)] : [qw()];

=> SUCCESS
Snapshots are created and send/recv to the remote site works.

from znapzend.

1. returns an array (not an array reference)
2. you try to dereference the array which will fail since it is not an array reference but an array

either you do 3) or you remove the dereference operator in 2)

edit:
just seen that you have 1) as an attribute (has...), that can't be an array but only a reference to an array. so only 3) will work.

from znapzend.

It works now with 3) and is the same handling as with mbufferParams.
How to proceed?

from znapzend.

hooking this into oracleMode is unfortunate, since oracleMode actually contains stuff which fixes oracle brokenness ... while this might be something more generic ... useful for all solaris/illumos incarnations and if it was called sudo for others as well ...

maybe make it a separate option ? @hadfl ?

from znapzend.

what's the point of passwordless pfexec/sudo?

what about running it as an unpriviledged user with delegated zfs permissions?

from znapzend.

We need remote login and zfs privileges.

With the default (secure) configuration in Oracle Solaris root can’t login via ssh.
A less privileged account must be used.
This may be the case in secure environments with other Oss too.

The privileges for this account can be defined

•   with the global privileges ‘ZFS Storage Management’ and ‘ZFS File System Management’ for the system
  

•   or with zfs acl specific for zfs datasets/filesystems.
  

Von: Dominik Hassler [mailto:[email protected]]
Gesendet: Montag, 15. Dezember 2014 15:10
An: oetiker/znapzend
Cc: Grüninger, Andreas (LGL Extern)
Betreff: Re: [znapzend] Usage of less privileged account (#109)

what's the point of passwordless pfexec/sudo?

what about running it as an unpriviledged user with delegated zfs permissions?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/109#issuecomment-66998535.

from znapzend.

--> #113

--features=pfexec in your case...

from znapzend.