From ebfd0ba17e0d4b220725018d16e294e8e22a1745 Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Thu, 15 Jan 2015 20:51:39 +0000 Subject: Move Unix domain socket and access control stuff to s6. Move seekablepipe to s6-portable-utils. Version: 2.0.1.0, release candidate --- doc/index.html | 26 +-- doc/libs6net/accessrules.html | 331 ------------------------------------ doc/libs6net/index.html | 2 - doc/localservice.html | 151 ---------------- doc/s6-accessrules-cdb-from-fs.html | 141 --------------- doc/s6-accessrules-fs-from-cdb.html | 60 ------- doc/s6-connlimit.html | 96 ----------- doc/s6-ioconnect.html | 84 --------- doc/s6-ipcclient.html | 65 ------- doc/s6-ipcserver-access.html | 172 ------------------- doc/s6-ipcserver-socketbinder.html | 72 -------- doc/s6-ipcserver.html | 173 ------------------- doc/s6-ipcserverd.html | 131 -------------- doc/s6-sudo.html | 59 ------- doc/s6-sudoc.html | 80 --------- doc/s6-sudod.html | 165 ------------------ doc/s6-tcpserver-access.html | 18 +- doc/seekablepipe.html | 36 ---- 18 files changed, 13 insertions(+), 1849 deletions(-) delete mode 100644 doc/libs6net/accessrules.html delete mode 100644 doc/localservice.html delete mode 100644 doc/s6-accessrules-cdb-from-fs.html delete mode 100644 doc/s6-accessrules-fs-from-cdb.html delete mode 100644 doc/s6-connlimit.html delete mode 100644 doc/s6-ioconnect.html delete mode 100644 doc/s6-ipcclient.html delete mode 100644 doc/s6-ipcserver-access.html delete mode 100644 doc/s6-ipcserver-socketbinder.html delete mode 100644 doc/s6-ipcserver.html delete mode 100644 doc/s6-ipcserverd.html delete mode 100644 doc/s6-sudo.html delete mode 100644 doc/s6-sudoc.html delete mode 100644 doc/s6-sudod.html delete mode 100644 doc/seekablepipe.html (limited to 'doc') diff --git a/doc/index.html b/doc/index.html index 3b65640..c6d61fa 100644 --- a/doc/index.html +++ b/doc/index.html @@ -45,7 +45,7 @@ compiled with IPv6 support, s6-networking is IPv6-ready.
  • execline version 2.0.1.1 or later
  • s6 version -2.0.1.0 or later
    • +2.0.2.0 or later
  • s6-dns version 2.0.0.2 or later
    • @@ -60,7 +60,7 @@ compiled with IPv6 support, s6-networking is IPv6-ready.

    Download

    @@ -102,7 +102,7 @@ relevant page.
  • The s6-taiclockd program
    • -

    UCSPI implementation

    +

    UCSPI TCP implementation

    -

    TCP and Unix access control

    +

    TCP access control

    - -

    suidless privilege gain

    - -

    IDENT protocol implementation

    @@ -148,7 +132,6 @@ relevant page.

    Miscellaneous utilities

    @@ -157,7 +140,6 @@ relevant page.
    diff --git a/doc/libs6net/accessrules.html b/doc/libs6net/accessrules.html deleted file mode 100644 index ea996b7..0000000 --- a/doc/libs6net/accessrules.html +++ /dev/null @@ -1,331 +0,0 @@ - - - - - s6-networking: the accessrules library interface - - - - - - -

    -libs6net
    -s6-networking
    -Software
    -skarnet.org -

    - -

    The accessrules library interface

    - -

    - The following functions and structures are declared in the s6-networking/accessrules.h header, -and implemented in the libs6net.a or libs6net.so library. -

    - -

    General information

    - -

    - s6net_accessrules is an access control library. It looks up -a key in a user-specified database, then returns a code depending on -whether the database allows access (in which case additional information -can also be returned), denies access, or does not contain the key. -

    - -

    - accessrules has been designed to be easily extensible to any -database format and any key format. -

    - -

    - Check the s6-networking/accessrules.h header for the exact definitions. -

    - -

    Data structures

    - - - -

    Function types

    - -

    Backend lookups

    - -

    - A s6net_accessrules_backend_func_t is the type of a function -that takes a single key, looks it up in a database, and returns the result. -Namely: -

    - -

    -s6net_accessrules_result_t f (char const *key, unsigned int keylen, void *handle, s6net_accessrules_params_t *params) -

    - -

    - f looks up key key of length keylen in the database -represented by handle in an implementation-defined way. It returns a -number that says the key has been allowed, denied or not found, or an error -occurred. If the key has been allowed, f stores additional information -from the database into *params. -

    - -

    - Two s6net_accessrules_backend_func_t functions are natively implemented: -

    - - - -

    Frontend key checking

    - -

    - A s6net_accessrules_keycheck_func_t is the type of a function that -takes a user-level key, makes a list of corresponding backend-level keys and -calls a s6net_accessrules_backend_func_t function until it finds -a match. Namely: -

    - -

    -s6net_accessrules_result_t f (void const *key, void *handle, s6net_accessrules_params_t *params, s6net_accessrules_backend_func_t *backend) -

    - -

    - f derives a list of low-level keys to check from key. -Then, for each key k of length klen in this list, it calls -(*backend)(k, klen, handle, params), returning *backend's result if it -is not S6NET_ACCESSRULES_NOTFOUND. If no match can be found in the whole list, -f finally returns S6NET_ACCESSRULES_NOTFOUND. -

    - -

    - Five s6net_accessrules_keycheck_func_t functions are natively implemented: -

    - - - -

    Ready-to-use functions

    - - Those functions are mostly macros; they're built by associating a frontend -function with a backend function. - -

    - s6net_accessrules_result_t s6net_accessrules_uidgid_cdb -(unsigned int u, unsigned int g, struct cdb *c, -s6net_accessrules_params_t *params)
    -Checks the *c CDB database for an authorization for uid u -and gid g. If the result is S6NET_ACCESSRULES_ALLOW, additional -information may be stored into params. -

    - -

    - s6net_accessrules_result_t s6net_accessrules_uidgid_fs -(unsigned int u, unsigned int g, char const *dir, -s6net_accessrules_params_t *params)
    -Checks the dir base directory for an authorization for uid u -and gid g. If the result is S6NET_ACCESSRULES_ALLOW, additional -information may be stored into params. -

    - -

    - s6net_accessrules_result_t s6net_accessrules_reversedns_cdb -(char const *name, struct cdb *c, -s6net_accessrules_params_t *params)
    -Checks the *c CDB database for an authorization for the -name FQDN. If the result is S6NET_ACCESSRULES_ALLOW, additional -information may be stored into params. -

    - -

    - s6net_accessrules_result_t s6net_accessrules_reversedns_fs -(char const *name, char const *dir, -s6net_accessrules_params_t *params)
    -Checks the dir base directory for an authorization for the -name FQDN. If the result is S6NET_ACCESSRULES_ALLOW, additional -information may be stored into params. -

    - -

    - s6net_accessrules_result_t s6net_accessrules_ip4_cdb -(char const *ip4, struct cdb *c, -s6net_accessrules_params_t *params)
    -Checks the *c CDB database for an authorization for the -ip4 IPv4 address (4 network byte order characters). -If the result is S6NET_ACCESSRULES_ALLOW, additional -information may be stored into params. -

    - -

    - s6net_accessrules_result_t s6net_accessrules_ip4_fs -(char const *ip4, char const *dir, -s6net_accessrules_params_t *params)
    -Checks the dir base directory for an authorization for the -ip4 IPv4 address (4 network byte order characters). -If the result is S6NET_ACCESSRULES_ALLOW, additional -information may be stored into params. -

    - -

    - s6net_accessrules_result_t s6net_accessrules_ip6_cdb -(char const *ip6, struct cdb *c, -s6net_accessrules_params_t *params)
    -Checks the *c CDB database for an authorization for the -ip6 IPv6 address (16 network byte order characters). -If the result is S6NET_ACCESSRULES_ALLOW, additional -information may be stored into params. -

    - -

    - s6net_accessrules_result_t s6net_accessrules_ip6_fs -(char const *ip6, char const *dir, -s6net_accessrules_params_t *params)
    -Checks the dir base directory for an authorization for the -ip6 IPv6 address (16 network byte order characters). -If the result is S6NET_ACCESSRULES_ALLOW, additional -information may be stored into params. -

    - -

    - s6net_accessrules_result_t s6net_accessrules_ip46_cdb -(ip46_t *ip, struct cdb *c, -s6net_accessrules_params_t *params)
    -Checks the *c CDB database for an authorization for the -ip IP address. -If the result is S6NET_ACCESSRULES_ALLOW, additional -information may be stored into params. -

    - -

    - s6net_accessrules_result_t s6net_accessrules_ip46_fs -(ip46_t const *ip, char const *dir, -s6net_accessrules_params_t *params)
    -Checks the dir base directory for an authorization for the -ip IP address. -If the result is S6NET_ACCESSRULES_ALLOW, additional -information may be stored into params. -

    - - - diff --git a/doc/libs6net/index.html b/doc/libs6net/index.html index 4fb35ff..36440ac 100644 --- a/doc/libs6net/index.html +++ b/doc/libs6net/index.html @@ -53,8 +53,6 @@ own header.

    diff --git a/doc/localservice.html b/doc/localservice.html deleted file mode 100644 index af7aafb..0000000 --- a/doc/localservice.html +++ /dev/null @@ -1,151 +0,0 @@ - - - - - s6-networking: what is a local service - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    Local services

    - -

    - A local service is a daemon that listens to incoming connections -on a Unix domain socket. Clients of the service are programs connecting to -this socket: the daemon performs operations on their behalf. -

    - -

    - The service is called local because it is not accessible to -clients from the network. -

    - -

    - A widely known example of a local service is the syslogd daemon. -On most implementations, it listens to the /dev/log socket. -Its clients connect to it and send their logs via the socket. The -openlog() function is just a wrapper arround the connect() -system call, the syslog() function a wrapper around write(), -and so on. -

    - -

    Benefits

    - -

    Privileges

    - -

    - The most important benefit of a local service is that it permits -controlled privilege gains without using setuid programs. -The daemon is run as user S; a client running as user C and connecting to -the daemon asks it to perform operations: those will be done as user S. -

    - -

    - Standard Unix permissions on the listening socket can be used to implement -some basic access control: to restrict access to clients belonging to group -G, change the socket to user S and group G, and give it 0420 permissions. -This is functionally equivalent to the basic access control for setuid -programs: a program having user S, group G and permissions 4750 will be -executable by group G and run with S rights. -

    - -

    - But modern systems implement the -getpeereid() -system call or library function. This function allows the server to know the -client's credentials: so fine-grained access control is possible. On those -systems, local services can do as much authentication as setuid programs, -in a much more controlled environment. -

    - -

    fd-passing

    - -

    - The most obvious difference between a local service and a network service -is that a local service does not serve network clients. But local services -have another nice perk: while network services usually only provide you -with a single channel (a TCP or UDP socket) of communication between the -client and the server, forcing you to multiplex your data into that -channel, local services allow you to have as many -communication channels as you want. -

    - -

    -(The SCTP transport layer provides a way for network services to use -several communication channels. Unfortunately, it is not widely deployed -yet, and a lot of network services still depend on TCP.) -

    - -

    - The fd-passing mechanism is Unix domain socket black magic -that allows one peer of the socket to send open file descriptors to -the other peer. So, if the server opens a pipe and sends one end of -this pipe to a client via this mechanism, there is effectively a -socket and a pipe between the client and the server. -

    - -

    UCSPI

    - -

    - The UCSPI protocol -is an easy way of abstracting clients and servers from the network. -A server written as a UCSPI server, just as it can be run -under inetd or s6-tcpserver, can be run under -s6-ipcserver: choose a socket -location and you have a local service. -

    - -

    - Fine-grained access control can be added by inserting -s6-ipcserver-access in -your server command line after s6-ipcserver. -

    - -

    - A client written as an UCSPI client, i.e. assuming it has descriptor -6 (resp. 7) open and reading from (resp. writing to) the server socket, -can be run under s6-ipcclient. -

    - -

    Use in skarnet.org software

    - -

    - skarnet.org libraries often use a separate process to handle -asynchronicity and background work in a way that's invisible to -the user. Among them are: -

    - - - -

    - Those processes are usually spawned from a client, via the corresponding -*_startf*() library call. But they can also be spawned from a -s6-ipcserver program in a local service configuration. In both cases, they -need an additional control channel to be passed from the server to -the client: the main socket is used for synchronous commands from the client -to the server and their answers, whereas the additional channel, which is -now implemented as a socket as well (but created by the server on-demand -and not bound to a local path), is used for asynchronous -notifications from the server to the client. The fd-passing mechanism -is used to transfer the additional channel from the server to the client. -

    - - - diff --git a/doc/s6-accessrules-cdb-from-fs.html b/doc/s6-accessrules-cdb-from-fs.html deleted file mode 100644 index 26105b1..0000000 --- a/doc/s6-accessrules-cdb-from-fs.html +++ /dev/null @@ -1,141 +0,0 @@ - - - - - s6-networking: the s6-accessrules-cdb-from-fs program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-accessrules-cdb-from-fs program

    - -

    -s6-accessrules-cdb-from-fs compiles a directory -containing a ruleset suitable for -s6-ipcserver-access or -s6-tcpserver-access into a -CDB file. -

    - -

    Interface

    - -
    -     s6-accessrules-cdb-from-fs cdbfile dir
-
    - - - -

    Ruleset directory format

    - -

    - To be understood by s6-accessrules-cdb-from-fs, -s6-ipcserver-access, or -s6-tcpserver-access, -dir must have a specific format. -

    - -

    - dir contains a series of directories: -

    - - - -

    -Depending on the application, other directories can appear in dir -and be compiled into cdbfile, but -s6-tcpserver-access only -uses the first three, and -s6-ipcserver-access only -uses the last two. -

    - -

    - Each of those directories contains a set of rules. A rule is -a subdirectory named after the set of keys it matches, and containing -actions that will be executed if the rule is the first matching rule -for the tested key. -

    - -

    - The syntax for the rule name is dependent on the nature of keys, and -fully documented on the -accessrules -library page. For instance, a subdirectory named 192.168.0.0_27 -in the ip4 directory will match every IPv4 address in the -192.168.0.0/27 network that does not match a more precise rule. -

    - -

    - The syntax for the actions, however, is the same for every type of key. -A rule subdirectory can contain the following elements: -

    - - - -

    Notes

    - - - - - diff --git a/doc/s6-accessrules-fs-from-cdb.html b/doc/s6-accessrules-fs-from-cdb.html deleted file mode 100644 index 91ec98e..0000000 --- a/doc/s6-accessrules-fs-from-cdb.html +++ /dev/null @@ -1,60 +0,0 @@ - - - - - s6-networking: the s6-accessrules-fs-from-cdb program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-accessrules-fs-from-cdb program

    - -

    -s6-accessrules-fs-from-cdb decompiles a CDB database -containing a ruleset suitable for -s6-ipcserver-access or -s6-tcpserver-access and -that has been compiled with -s6-accessrules-cdb-from-fs. -

    - -

    Interface

    - -
    -     s6-accessrules-fs-from-cdb dir cdbfile
-
    - -     - -

    Notes

    - - - - - diff --git a/doc/s6-connlimit.html b/doc/s6-connlimit.html deleted file mode 100644 index 5008b4d..0000000 --- a/doc/s6-connlimit.html +++ /dev/null @@ -1,96 +0,0 @@ - - - - - s6-networking: the s6-connlimit program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-connlimit program

    - -

    -s6-connlimit is a small utility to perform IP-based -control on the number of client connections to a TCP socket, and -uid-based control on the number of client connections to a Unix -domain socket. -

    - -

    Interface

    - -
    -     s6-connlimit prog...
-
    - - - -

    Usage

    - -

    - The s6-tcpserver4 and -s6-tcpserver6 define the PROTO environment -variable to "TCP", and spawn every child server with the TCPCONNNUM environment -variable set to the number of connections from the same IP address. - The s6-tcpserver-access program -can set environment variables depending on the client's IP address. If the -s6-tcpserver-access database is configured to set the TCPCONNMAX environment -variable for a given set of IP addresses, and s6-tcpserver-access execs into -s6-connlimit, then s6-connlimit will drop connections if there already are -${TCPCONNMAX} connections from the same client IP address. -

    - -

    - The s6-ipcserver and -s6-ipcserver-access programs can -be used the same way, with "IPC" instead of "TCP", to limit the number -of client connections by UID. -

    - -

    Example

    - -

    - The following command line: -

    - -
    -     s6-tcpserver4 -v2 -c1000 -C40 1.2.3.4 80 \
-     s6-tcpserver-access -v2 -RHl0 -i dir \
-     s6-connlimit \
-     prog...
-
    - -

    - will run a server listening to IPv4 address 1.2.3.4, on port 80, -serving up to 1000 concurrent connections, and up to 40 concurrent -connections from the same IP address, no matter what the IP address. -For every client connection, it will look up the database set up -in dir; if the connection is accepted, it will run prog.... -

    - -

    - If the dir/ip4/5.6.7.8_32/env/TCPCONNMAX file -exists and contains the string 30, then at most 30 concurrent -connections from 5.6.7.8 will execute prog..., instead of the -default of 40. -

    - - - diff --git a/doc/s6-ioconnect.html b/doc/s6-ioconnect.html deleted file mode 100644 index 5e2b6c6..0000000 --- a/doc/s6-ioconnect.html +++ /dev/null @@ -1,84 +0,0 @@ - - - - - s6-networking: the s6-ioconnect program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-ioconnect program

    - -

    -s6-ioconnect performs full-duplex data transmission -between two sets of open file descriptors. -

    - -

    Interface

    - -
    -     s6-ioconnect [ -t millisecs ] [ -r fdr ] [ -w fdw ] [ -0 ] [ -1 ] [ -6 ] [ -7 ]
-
    - - - -

    Options

    - - - -

    Notes

    - - - - - diff --git a/doc/s6-ipcclient.html b/doc/s6-ipcclient.html deleted file mode 100644 index 2bb66aa..0000000 --- a/doc/s6-ipcclient.html +++ /dev/null @@ -1,65 +0,0 @@ - - - - - s6-networking: the s6-ipcclient program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-ipcclient program

    - -

    -s6-ipcclient is an -UCSPI client tool for -Unix domain sockets. It connects to a socket, then executes into -a program. -

    - -

    Interface

    - -
    -     s6-ipcclient [ -q | -Q | -v ] [ -p bindpath ] [ -l localname ] path prog...
-
    - - - -

    Environment variables

    - -

    - prog... is run with -the following variables set: -

    - - - -

    Options

    - - - - - diff --git a/doc/s6-ipcserver-access.html b/doc/s6-ipcserver-access.html deleted file mode 100644 index 515138c..0000000 --- a/doc/s6-ipcserver-access.html +++ /dev/null @@ -1,172 +0,0 @@ - - - - - s6-networking: the s6-ipcserver-access program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-ipcserver-access program

    - -

    -s6-ipcserver-access is a command-line access -control tool for Unix domain sockets on systems where the -getpeereid() system call can be implemented. -It is meant to be run after -s6-ipcserverd and before -the application program on the s6-ipcserver command line. -

    - -

    Interface

    - -
    -     s6-ipcserver-access [ -v verbosity ] [ -E | -e ] [ -l localname ] [ -i rulesdir | -x rulesfile ] prog...
-
    - - - -

    Environment variables

    - -

    -s6-ipcserver-access expects to inherit some environment variables from -its parent: -

    - - - -

    - Additionally, it exports the following variables before executing into -prog...: -

    - - - -

    - Also, the access rules database can instruct s6-ipcserver-access to set -up, or unset, more environment variables, depending on the client address. -

    - -

    Options

    - - - -

    Access rule checking

    - -

    - s6-ipcserver-access checks its client connection against -a ruleset. This ruleset can be implemented: -

    - - - -

    - The exact format of the ruleset is described on the -s6-accessrules-cdb-from-fs page. -

    - -

    -s6-ipcserver-access first reads the client UID uid and -GID gid from the -${PROTO}REMOTEEUID and ${PROTO}REMOTEEGID environment variables, and checks -them with the -s6net_accessrules_keycheck_uidgid() -function. In other words, it tries to match: - -

    - -

    - in that order. If no S6NET_ACCESSRULES_ALLOW result can be obtained, -the connection is denied. -

    - -

    Environment and executable modifications

    - -

    - s6-ipcserver-access interprets non-empty env subdirectories -and exec files -it finds in the first matching rule of the ruleset, as explained -in the s6-accessrules-cdb-from-fs -page. -

    - - - - - diff --git a/doc/s6-ipcserver-socketbinder.html b/doc/s6-ipcserver-socketbinder.html deleted file mode 100644 index 2c8d993..0000000 --- a/doc/s6-ipcserver-socketbinder.html +++ /dev/null @@ -1,72 +0,0 @@ - - - - - s6-networking: the s6-ipcserver-socketbinder program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-ipcserver-socketbinder program

    - -

    -s6-ipcserver-socketbinder binds a Unix domain -socket, then executes a program. -

    - -

    Interface

    - -
    -     s6-ipcserver-socketbinder [ -d | -D ] [ -b backlog ] path prog...
-
    - - - -

    Options

    - - - -

    Notes

    - - - - - diff --git a/doc/s6-ipcserver.html b/doc/s6-ipcserver.html deleted file mode 100644 index 4b52888..0000000 --- a/doc/s6-ipcserver.html +++ /dev/null @@ -1,173 +0,0 @@ - - - - - s6-networking: the s6-ipcserver program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-ipcserver program

    - -

    -s6-ipcserver is an -UCSPI server tool for -Unix domain sockets, i.e. a super-server. -It accepts connections from clients, and forks a -program to handle each connection. -

    - -

    Interface

    - -
    -     s6-ipcserver [ -1 ] [ -q | -Q | -v ] [ -d | -D ] [ -P | -p ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gidlist ] [ -g gid ] [ -u uid ] [ -U ] path prog...
-
    - - - -

    Implementation

    - - - - -

    Options

    - - - -

    Implementation

    - - - -

    Notes

    - - - - - diff --git a/doc/s6-ipcserverd.html b/doc/s6-ipcserverd.html deleted file mode 100644 index 916de12..0000000 --- a/doc/s6-ipcserverd.html +++ /dev/null @@ -1,131 +0,0 @@ - - - - - s6-networking: the s6-ipcserverd program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-ipcserverd program

    - -

    -s6-ipcserverd is the serving part of the -s6-ipcserver super-server. -It assumes that its stdin is a bound and listening Unix -domain socket, and -it accepts connections from clients connecting to it, forking a -program to handle each connection. -

    - -

    Interface

    - -
    -     s6-ipcserverd [ -1 ] [ -v verbosity ] [ -P | -p ] [ -c maxconn ] [ -C localmaxconn ] prog...
-
    - - - -

    Environment variables

    - -

    - For each connection, an instance of prog... is spawned with -the following variables set: -

    - - - -

    - If client credentials lookup has been disabled, IPCREMOTEEUID and -IPCREMOTEEUID will be set, but empty. -

    - - -

    Options

    - - - -

    Signals

    - - - -

    Notes

    - - - - - diff --git a/doc/s6-sudo.html b/doc/s6-sudo.html deleted file mode 100644 index 603ad8a..0000000 --- a/doc/s6-sudo.html +++ /dev/null @@ -1,59 +0,0 @@ - - - - - s6-networking: the s6-sudo program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-sudo program

    - -

    -s6-sudo connects to a Unix domain socket and passes -its standard file descriptors, command-line arguments and -environment to a program running on the server side, potentially -with different privileges. -

    - -

    Interface

    - -
    -     s6-sudo [ -q | -Q | -v ] [ -p bindpath ] [ -l localname ] [ -e ] [ -t timeoutconn ] [ -T timeoutrun ] path [ args... ]
-
    - - - -

    Options

    - - - - - diff --git a/doc/s6-sudoc.html b/doc/s6-sudoc.html deleted file mode 100644 index def09a9..0000000 --- a/doc/s6-sudoc.html +++ /dev/null @@ -1,80 +0,0 @@ - - - - - s6-networking: the s6-sudoc program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-sudoc program

    - -

    -s6-sudoc talks to a peer s6-sudod -program over a Unix socket, passing it command-line arguments, environment -variables and standard descriptors. -

    - -

    Interface

    - -
    -     s6-sudoc [ -e ] [ -t timeoutconn ] [ -T timeoutrun ] [ args... ]
-
    - - - -

    Options

    - - - -

    Notes

    - - - - - diff --git a/doc/s6-sudod.html b/doc/s6-sudod.html deleted file mode 100644 index c783736..0000000 --- a/doc/s6-sudod.html +++ /dev/null @@ -1,165 +0,0 @@ - - - - - s6-networking: the s6-sudod program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The s6-sudod program

    - -

    -s6-sudod receives command-line arguments, environment variables -and standard descriptors from a peer s6-sudoc -program over a Unix socket, then forks another program. -

    - -

    Interface

    - -
    -     s6-sudod [ -0 ] [ -1 ] [ -2 ] [ -s ] [ -t timeout ] [ sargv... ]
-
    - - - -

    Environment

    - -

    -s6-sudod transmits its own environment to its child, plus the environment sent -by s6-sudoc, filtered in the following manner: -for every variable sent by s6-sudoc, if the -variable is present but empty in s6-sudod's environment, then -its value is overriden by the value given by s6-sudoc. A variable that is -already nonempty, or that doesn't exist, in s6-sudod's environment, will not -be transmitted to the child. -

    - -

    Options

    - - - -

    Usage example

    - -

    - The typical use of s6-sudod is in a -local service with a -s6-ipcserver process listening on a Unix -socket, a s6-ipcserver-access process -performing client authentication and access control, and possibly a -s6-envdir -process setting up the environment variables that will be accepted by -s6-sudod. The following script, meant to be a run script in a -service directory, -will set up a privileged program: -

    - -
    -#!/command/execlineb -P
-fdmove -c 2 1
-s6-envuidgid serveruser
-s6-ipcserver -U -- serversocket
-s6-ipcserver-access -v2 -l0 -i rules --
-exec -c
-s6-envdir env
-s6-sudod
-sargv
-
    - - - -

    - This means that user clientuser running -s6-sudo serversocket cargv will be -able, if authorized by the configuration in rules, to run -sargv cargv as user serveruser, with stdin, -stdout, stderr and the environment variables properly listed in env -transmitted to sargv. -

    - -

    Notes

    - - - - - diff --git a/doc/s6-tcpserver-access.html b/doc/s6-tcpserver-access.html index a89d9e3..435c92d 100644 --- a/doc/s6-tcpserver-access.html +++ b/doc/s6-tcpserver-access.html @@ -163,13 +163,13 @@ needed to perform searches in a CDB than in the filesystem.

    The exact format of the ruleset is described on the -s6-accessrules-cdb-from-fs page. +s6-accessrules-cdb-from-fs page.

    s6-tcpserver-access first gets the remote address ip of the client and converts it to canonical form. Then it checks it with the -s6net_accessrules_keycheck_ip46() +s6_accessrules_keycheck_ip46() function. In other words, it tries to match broader and broader network prefixes of ip, from ip4/ip_32 to ip4/0.0.0.0_0 if ip is v4, or from @@ -177,10 +177,10 @@ prefixes of ip, from ip4/ip_32 to is v6. If the result is:

    -
  • S6NET_ACCESSRULES_ERROR: it immediately exits 111.
    • -
  • S6NET_ACCESSRULES_DENY: it immediately exits 1.
    • -
  • S6NET_ACCESSRULES_ALLOW: it grants access.
    • -
  • S6NET_ACCESSRULES_NOTFOUND: more information is needed.
    • +
  • S6_ACCESSRULES_ERROR: it immediately exits 111.
    • +
  • S6_ACCESSRULES_DENY: it immediately exits 1.
    • +
  • S6_ACCESSRULES_ALLOW: it grants access.
    • +
  • S6_ACCESSRULES_NOTFOUND: more information is needed.

    • @@ -188,12 +188,12 @@ is v6. If the result is: is denied. But if s6-tcpserver-access is authorized to perform DNS lookups, then it gets the remote name of the client, remotehost, and checks it with the -s6net_accessrules_keycheck_reversedns() +s6_accessrules_keycheck_reversedns() function. In other words, it tries to match shorter and shorter suffixes of remotehost, from reversedns/remotehost to reversedns/@. This time, the connection is denied is the result is anything else than -S6NET_ACCESSRULES_ALLOW. +S6_ACCESSRULES_ALLOW.

    @@ -208,7 +208,7 @@ query on remotehost does not match ip. s6-tcpserver-access interprets non-empty env subdirectories and exec files it finds in the matching rule of the ruleset, as explained -in the s6-accessrules-cdb-from-fs +in the s6-accessrules-cdb-from-fs page.

    diff --git a/doc/seekablepipe.html b/doc/seekablepipe.html deleted file mode 100644 index cd17b2e..0000000 --- a/doc/seekablepipe.html +++ /dev/null @@ -1,36 +0,0 @@ - - - - - s6-networking: the seekablepipe program - - - - - - -

    -s6-networking
    -Software
    -skarnet.org -

    - -

    The seekablepipe program

    - -seekablepipe turns the reading end of a pipe into a seekable -file descriptor, using a temporary file. - -

    Interface

    - -
    -     writer | seekablepipe tmpfile reader [ args ... ]
-
    - -

    -seekablepipe writes writer's output to tmpfile, -which is unlinked as soon as it is created. Then it execs into -reader, reading from a file descriptor on tmpfile. -

    - - - -- cgit v1.2.3