Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 25250 - fcron doesn't deal correctly with users stored on SQL or LDAP
Summary: fcron doesn't deal correctly with users stored on SQL or LDAP
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Core system (show other bugs)
Hardware: All Linux
: High normal
Assignee: Cron Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-07-25 05:27 UTC by Sami Dalouche
Modified: 2005-10-27 16:55 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
initscript that uses a dependency (user,280 bytes, text/plain)
2003-12-05 02:32 UTC, James Harlow (RETIRED)
Details
initscript that provides a dependency (provider,291 bytes, text/plain)
2003-12-05 02:33 UTC, James Harlow (RETIRED)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Sami Dalouche 2003-07-25 05:27:50 UTC
Let's take an easy example : 
we have the following /etc/fcron/fcron.allow file:
root
samokk
mary

samokk and mary are users stored on some LDAP server, which are made available
thanks to pam-ldap and nss-ldap.

The problem is that when fcron runs, it doesn't find these users because the
LDAP/SQL server isn't up yet.

As a result, the only way to get fcron to work is to start it AFTER ldap / SQL
=> I added need slapd to my /etc/init.d/fcron file.
I think there should be some need slapd mysql postgresql or use slapd mysql
postgresql or something by default.


Reproducible: Always
Steps to Reproduce:
1.
2.
3.
Comment 1 James Harlow (RETIRED) gentoo-dev 2003-09-06 16:00:29 UTC
I don't think that can be done in the ebuild, since it would require everyone who ran fcron 
to run postrgresql, mysql, and ldap. Better would be to make postgresql, mysql and ldap 
provide a "virtual-auth" service and have fcron require that all the services that provided 
"virtual-auth" were started as a dependency - but I don't know if that's possible at the 
moment. I'll have a look at the scripts and see if it is. 
Comment 2 Seemant Kulleen (RETIRED) gentoo-dev 2003-11-14 19:48:08 UTC
hythloday, what did you find out?
Comment 3 James Harlow (RETIRED) gentoo-dev 2003-11-21 11:14:56 UTC
I couldn't get it to work - you can't have more than one service that provides the same service, and use foo doesn't seem to make the thing that provides foo start before it. Depend foo fails if nothing provides foo. Unless someone can come up with a clever hack, or there's soemthing you can do with runscript that I don't know about, I'm tempted to say it's not possible at the moment.
Comment 4 Seemant Kulleen (RETIRED) gentoo-dev 2003-11-21 22:58:51 UTC
hyth, make the initscripts provide virtual auth
then make fcron's initscript use virtual auth

then run depscan.sh and try
Comment 5 James Harlow (RETIRED) gentoo-dev 2003-12-05 02:32:17 UTC
Created attachment 21734 [details]
initscript that uses a dependency

copy this to /etc/init.d/user
Comment 6 James Harlow (RETIRED) gentoo-dev 2003-12-05 02:33:00 UTC
Created attachment 21735 [details]
initscript that provides a dependency

Copy this to /etc/init.d/provider
Comment 7 James Harlow (RETIRED) gentoo-dev 2003-12-05 02:34:23 UTC
Here's my test case:

ariel init.d # /sbin/depscan.sh
 * Caching service dependencies...                                       [ ok ]
ariel init.d # /etc/init.d/user start
 * Starting user...
Comment 8 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2004-12-08 03:51:47 UTC
This didn't work last year, but it does work now.

In fcron:
need virtual-auth
In slapd:
provide virtual-auth

There is one problem still...
We can't just add the above to everything, as if the user has a machine that doesn't need any virtual-auth, it might start one of the provider scripts in error.

Perhaps we should just document this and have it commented in for those that need it.
Comment 9 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2004-12-15 02:44:57 UTC
Alternatively, I came up with an idea.
Have a real service called virtual-auth that will parse it's config files and /etc/nsswitch.conf.

it could have a variable local_ldap, which if set to yes, and ldap is detected in nsswitch.conf, would have it depend on slapd.
(and do a similiar thing for other possibilies of nss-mysql, nss-postgres etc).

Comment 10 Jakub Moc (RETIRED) gentoo-dev 2005-07-21 16:31:12 UTC
Re-assign a stale bug to maintainer. If this is no longer an issue, then please
close.
Comment 11 Aaron Walker (RETIRED) gentoo-dev 2005-10-27 16:55:29 UTC
Added slapd mysql postgresql to the use declaration in the fcron init script. 
AFAIK that works as it is supposed to now (or at least it did when I just tested
it).