diff options
| author | Laurent Bercot <ska-skaware@skarnet.org> | 2015-01-15 20:51:39 +0000 |
|---|---|---|
| committer | Laurent Bercot <ska-skaware@skarnet.org> | 2015-01-15 20:51:39 +0000 |
| commit | ebfd0ba17e0d4b220725018d16e294e8e22a1745 (patch) | |
| tree | 4b29683050ce9e8f24f1920f1be38b2f837ef5ad /doc/s6-ipcserver.html | |
| parent | 20c7d8e1b328155145ce9e8648435e127b60c208 (diff) | |
| download | s6-networking-ebfd0ba17e0d4b220725018d16e294e8e22a1745.tar.xz | |
Move Unix domain socket and access control stuff to s6.
Move seekablepipe to s6-portable-utils.
Version: 2.0.1.0, release candidate
Diffstat (limited to 'doc/s6-ipcserver.html')
| -rw-r--r-- | doc/s6-ipcserver.html | 173 |
1 files changed, 0 insertions, 173 deletions
diff --git a/doc/s6-ipcserver.html b/doc/s6-ipcserver.html deleted file mode 100644 index 4b52888..0000000 --- a/doc/s6-ipcserver.html +++ /dev/null @@ -1,173 +0,0 @@ -<html> - <head> - <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> - <meta http-equiv="Content-Language" content="en" /> - <title>s6-networking: the s6-ipcserver program</title> - <meta name="Description" content="s6-networking: the s6-ipcserver program" /> - <meta name="Keywords" content="s6-networking s6-ipcserver ipcserver ucspi unix server super-server" /> - <!-- <link rel="stylesheet" type="text/css" href="http://skarnet.org/default.css" /> --> - </head> -<body> - -<p> -<a href="index.html">s6-networking</a><br /> -<a href="http://skarnet.org/software/">Software</a><br /> -<a href="http://skarnet.org/">skarnet.org</a> -</p> - -<h1> The <tt>s6-ipcserver</tt> program </h1> - -<p> -<tt>s6-ipcserver</tt> is an -<a href="http://cr.yp.to/proto/ucspi.txt">UCSPI server tool</a> for -Unix domain sockets, i.e. a super-server. -It accepts connections from clients, and forks a -program to handle each connection. -</p> - -<h2> Interface </h2> - -<pre> - s6-ipcserver [ -1 ] [ -q | -Q | -v ] [ -d | -D ] [ -P | -p ] [ -c <em>maxconn</em> ] [ -C <em>localmaxconn</em> ] [ -b <em>backlog</em> ] [ -G <em>gidlist</em> ] [ -g <em>gid</em> ] [ -u <em>uid</em> ] [ -U ] <em>path</em> <em>prog...</em> -</pre> - -<ul> - <li> s6-ipcserver binds a Unix domain socket to <em>path</em>. </li> - <li> It can drop its root privileges. </li> - <li> It closes its stdin and stdout. </li> - <li> For every client connection to this socket, it -forks. The child sets some environment variables, then -executes <em>prog...</em> with stdin reading from the socket and -stdout writing to it. </li> - <li> Depending on the verbosity level, it logs what it does to stderr. </li> - <li> It runs until killed by a signal. Depending on the received -signal, it may kill its children before exiting. </li> - <li> s6-ipcserver actually doesn't do any of this itself. It is -a wrapper, rewriting the command line and executing into a chain -of programs that perform those duties. </li> -</ul> - -<h2> Implementation </h2> - -<ul> - <li> s6-ipcserver parses the options and arguments it is given, and -builds a new command line with them. It then executes into that new -command line. </li> - <li> The first program s6-ipcserver executes into is -<a href="s6-ipcserver-socketbinder.html">s6-ipcserver-socketbinder</a>. -It will create and bind a Unix domain socket to <em>path</em>, then -execute into the rest of the command line. </li> - <li> If a privilege-dropping operation has been requested, the -program that s6-ipcserver-socketbinder executes into is -<a href="http://skarnet.org/software/s6/s6-applyuidgid.html">s6-applyuidgid</a>. -It will drop the root privileges, then execute into the rest of the -command line. </li> - <li> The next program in the chain is -<a href="s6-ipcserverd.html">s6-ipcserverd</a>. It is executed into -by s6-applyuidgid, or directly by s6-ipcserver-socketbinder if no -privilege-dropping operation has been requested. s6-ipcserverd is -the long-lived process, the "daemon" itself, accepting connections -from clients. </li> - <li> For every client, s6-ipcserverd will spawn an instance of -<em>prog...</em>, the remainder of the command line. </li> -</ul> - - -<h2> Options </h2> - -<ul> - <li> <tt>-1</tt> : write <em>path</em>, followed by a newline, -to stdout, before -closing it, right after binding and listening to the Unix socket. -If stdout is suitably redirected, this can be used by monitoring -programs to check when the server is ready to accept connections. </li> - <li> <tt>-q</tt> : be quiet. </li> - <li> <tt>-Q</tt> : be normally verbose. This is the default. </li> - <li> <tt>-v</tt> : be verbose. </li> - <li> <tt>-d</tt> : allow instant rebinding to the same path -even if it has been used not long ago - this is the SO_REUSEADDR flag to -<a href="http://pubs.opengroup.org/onlinepubs/9699919799/functions/setsockopt.html">setsockopt()</a> -and is generally used with server programs. This is the default. Note that -<em>path</em> will be deleted if it already exists at program start time. </li> - <li> <tt>-D</tt> : disallow instant rebinding to the same path. </li> - <li> <tt>-P</tt> : disable client credentials lookups. The -IPCREMOTEEUID and IPCREMOTEEGID environment variables will be unset -in every instance of <em>prog...</em>. This is the portable option, -because not every system supports credential lookup across Unix domain -sockets; but it is not as secure. </li> - <li> <tt>-p</tt> : enable client credentials lookups. This -is the default; it works at least on Linux, Solaris, and -*BSD systems. On systems that do not support it, every connection -attempt will fail with a warning message. </li> - <li> <tt>-c <em>maxconn</em></tt> : accept at most -<em>maxconn</em> concurrent connections. Default is 40. It is -impossible to set it higher than 1000. </li> - <li> <tt>-C <em>localmaxconn</em></tt> : accept at most -<em>localmaxconn</em> connections from the same user ID. -Default is 40. It is impossible to set it higher than <em>maxconn</em>. </li> - <li> <tt>-b <em>backlog</em></tt> : set a maximum of -<em>backlog</em> backlog connections on the socket. Extra -connection attempts will rejected by the kernel. </li> - <li> <tt>-G <em>gidlist</em></tt> : change s6-ipcserver's -supplementary group list to <em>gidlist</em> after binding the socket. -This is only valid when run as root. <em>gidlist</em> must be a -comma-separated list of numerical group IDs. </li> - <li> <tt>-g <em>gid</em></tt> : change s6-ipcserver's groupid -to <em>gid</em> after binding the socket. This is only valid when run -as root. </li> - <li> <tt>-u <em>uid</em></tt> : change s6-ipcserver's userid -to <em>uid</em> after binding the socket. This is only valid when run -as root. </li> - <li> <tt>-U</tt> : change s6-ipcserver's user id, group id and -supplementary group list -according to the values of the UID, GID and GIDLIST environment variables -after binding the socket. This is only valid when run as root. -This can be used with the -<a href="http://skarnet.org/software/s6/s6-envuidgid.html">s6-envuidgid</a> -program to easily script a service that binds to a privileged socket -then drops its privileges to those of a named non-root account. </li> -</ul> - -<h2> Implementation </h2> - -<ul> - <li> s6-ipcserver parses the options and arguments it is given, and -builds a new command line with them. It then executes into that new -command line. </li> - <li> The first program s6-ipcserver executes into is -<a href="s6-ipcserver-socketbinder.html">s6-ipcserver-socketbinder</a>. -It will create and bind a Unix domain socket to <em>path</em>, then -execute into the rest of the command line. </li> - <li> If a privilege-dropping operation has been requested, the -program that s6-ipcserver-socketbinder executes into is -<a href="http://skarnet.org/software/s6/s6-applyuidgid.html">s6-applyuidgid</a>. -It will drop the root privileges, then execute into the rest of the -command line. </li> - <li> The next program in the chain is -<a href="s6-ipcserverd.html">s6-ipcserverd</a>. It is executed into -by s6-applyuidgid, or directly by s6-ipcserver-socketbinder if no -privilege-dropping operation has been requested. s6-ipcserverd is -the long-lived process, the "daemon" itself, accepting connections -from clients. </li> - <li> For every client, s6-ipcserverd will spawn an instance of -<em>prog...</em>, the remainder of the command line. </li> -</ul> - -<h2> Notes </h2> - -<ul> - <li> s6-ipcserver does not interpret its options itself. It just -dispatches them to the appropriate program on the command line that -it builds. </li> - <li> In previous releases of s6-networking, s6-ipcserver was -monolithic: it did the work of s6-ipcserver-socketbinder, -s6-applyuidgid and s6-ipcserverd itself. The functionality has now -been split into several different programs because some service startup -schemes require the daemon to get its socket from an external -program instead of creating and binding it itself. The most obvious -application of this is upgrading a long-lived process without -losing existing connections. </li> -</ul> - -</body> -</html> |