Re: socket-based activation has unmaintainable security?
On 07/02/13 09:39, Philipp Kern wrote:
>> If you want to permit a daemon to bind to exactly one reserved
>> port and no others then it seems that the options are systemd (if
>> the daemon supports socket based activation) and SE Linux.
>
> (x)inetd, no?
For completeness: the systemd socket-activation protocol does not
strictly require systemd as your pid 1 (it's basically just a
generalization of "the inetd protocol" to allow for more than one
socket to be passed simultaneously, and leave stdout/stderr available
for logging/warnings from the daemon). Any inetd could gain support
for systemd-compatible socket-activation, in principle.
The reference implementation of socket activation in libsystemd-daemon
is #ifdef'd out when not on Linux, but it's hardly rocket science:
$LISTEN_PID is the decimal process ID for which the sockets are intended
(so that its child processes will ignore $LISTEN_FDS even if it's not
removed from the environment), $LISTEN_FDS is a decimal integer, and fds
3 up to 3+$LISTEN_FDS-1 are the sockets to listen on.
Regards,
S
Reply to: