Re: Making a dynamically-linked root

From: Matthew Dillon (dillon_at_apollo.backplane.com)
Date: 06/07/03

  • Next message: Doug Barton: "Re: Way forward with BIND 8"
    Date: Fri, 6 Jun 2003 16:44:56 -0700 (PDT)
    To: Robert Watson <rwatson@freebsd.org>
    
    

        It would be fairly easy to create a unix-domain or localhost socketed
        port service and messaging primitives to access just about any
        configuration data that you would typically store in a file. Initially
        such a service would simply access the appropriate file and relay the
        information to the client but ultimately it could incorporate more
        sophisticated features on its backend without any modifications having
        to be done on the client side or to the client protocol. Something like
        this:

        * client connects to sevice

        * client sends message with creds (SCM_CREDS) containing request. The
        message would include a serial id to allow the client side to
        multi-thread or stream requests, configuration file id or path name,
        command, and data.

        * client gets reply (and optionally caches result, default to off).
        (done)

        Frontend primitives could be as simple as 'get record N', and
        'lookup record with key', plus a timeout/failure and possibly
        a failsafe feature. The entire implementation in libc would be very
        small and record data would always be returned in text form (key/data)
        for maximum portability.

        Backend sophisitication could include loadable modules to integrate
        remote services for particular configuration file classes, like NIS,
        multiple resolver sources, logging/auditing, security restrictions,
        different backend storage mechanisms such as databases, backend forking
        and/or multi-threading to handle parallel blockable requests (e.g. DNS
        lookups), automatic DBM management (no need to run pwd_mkdb and friends),
        security partitioning (fork/jail) to prevent bugs from corrupting other
        users using the service, and so forth.

        It would be nice to be able to get rid of the necessity of running all
        the *_mkdb commands and to remove PAM, locale, and the resolver from
        client binaries, and to have a mechanism that anyone can write a simple
        DLL to support their own special circumstances.

                                            -Matt
                                            Matthew Dillon
                                            <dillon@backplane.com>

    :I think that would be quite neat; as discussed, irs from the BIND
    :distribution does the DNS elements of this, although not in our current
    :framework. An idea I've also been interested in looking at, now that we
    :have NSS to indirect many of the database operations, is how easy it would
    :be to indirect new configuration data through NSS. For example, although
    :we can share account information via directory services such as NIS, LDAP,
    :etc, we cannot currently share login.conf user class data. Some other
    :configuration files might also lend themselves quite well to this sort of
    :configuration -- perhaps even files such as inetd.conf, ftpusers,
    :login.access, opiekies, etc.
    :
    :One of the important goals of elements like NSS is to improve our ability
    :to centrally manage many FreeBSD systems in a scalable manner; another is
    :the ability to support more reliable and more easily managed backends,
    :such as configuration databases originating in local SQL, etc.
    :Experimenting with ways to take this a few steps further might be quite
    :interesting, and could have some nice payoffs.
    :
    :Robert N M Watson FreeBSD Core Team, TrustedBSD Projects
    :robert@fledge.watson.org Network Associates Laboratories
    _______________________________________________
    freebsd-arch@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-arch
    To unsubscribe, send any mail to "freebsd-arch-unsubscribe@freebsd.org"


  • Next message: Doug Barton: "Re: Way forward with BIND 8"

    Relevant Pages

    • Re: ATI or Nvidia?
      ... I don't like too much having these proprietary drivers "tainting" my ... Usage: aticonfig... ... Parses an existing X-Server configuration file and modifies it to operate ...
      (comp.os.linux.hardware)
    • Re: Configuration data for a Windows Service
      ... The service will definitely use a configuration file for at least some of ... the pluggable objects itself is still on the table. ... If my hosting application was a standard Windows Forms ...
      (microsoft.public.dotnet.framework)
    • Re: Class Library Configuration Files
      ... If you create an EXE in .NET that is run as a windows service, ... create a config file where you place all of your configuration settings. ... where your configuration file is going to be. ... The real executable is the one on the client machine (or, more likely, Web ...
      (microsoft.public.dotnet.languages.csharp)
    • Re: How do I give ASP.NET process network credentials?
      ... An error occurred during the processing of a configuration file ... required privilege is not held by the client. ... Error from the operating system 'A required privilege is ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: [RFC] libcg: design and plans
      ... In general - cgroup is a very flexible subsystem that can be used in a wide variety of ways and modes and trying to create a universal simple API would more likely result in something hard to manage and work with. ... We have been working on a library for control groups which would provide ... Provide persistent configuration across reboots ... Similarly a configuration file will be ...
      (Linux-Kernel)