s6-sudoc.html (3517B)
1 <html> 2 <head> 3 <meta name="viewport" content="width=device-width, initial-scale=1.0" /> 4 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> 5 <meta http-equiv="Content-Language" content="en" /> 6 <title>s6: the s6-sudoc program</title> 7 <meta name="Description" content="s6: the s6-sudoc program" /> 8 <meta name="Keywords" content="s6 s6-sudoc sudo setuid suid unix privilege gain getpeereid client" /> 9 <!-- <link rel="stylesheet" type="text/css" href="//skarnet.org/default.css" /> --> 10 </head> 11 <body> 12 13 <p> 14 <a href="index.html">s6</a><br /> 15 <a href="//skarnet.org/software/">Software</a><br /> 16 <a href="//skarnet.org/">skarnet.org</a> 17 </p> 18 19 <h1> The <tt>s6-sudoc</tt> program </h1> 20 21 <p> 22 <tt>s6-sudoc</tt> talks to a peer <a href="s6-sudod.html">s6-sudod</a> 23 program over a Unix socket, passing it command-line arguments, environment 24 variables and standard descriptors. 25 </p> 26 27 <h2> Interface </h2> 28 29 <pre> 30 s6-sudoc [ -e ] [ -t <em>timeoutconn</em> ] [ -T <em>timeoutrun</em> ] [ <em>args...</em> ] 31 </pre> 32 33 <ul> 34 <li> s6-sudoc transmits its standard input, standard output and standard error 35 via fd-passing over a Unix socket that must be open on its descriptors 6 and 7. 36 It expects an <a href="s6-sudod.html">s6-sudod</a> process to be receiving them 37 on the other side. </li> 38 <li> It also transmits its command-line arguments <em>args</em>, and also its 39 environment by default. Note that s6-sudod will not necessarily accept all the 40 environment variables that s6-sudoc tries to transmit. </li> 41 <li> s6-sudoc waits for the server program run by s6-sudod to finish. It exits 42 the same exit code as the server program. If the server program is killed by a 43 signal, s6-sudoc kills itself with the same signal. </li> 44 </ul> 45 46 <h2> Options </h2> 47 48 <ul> 49 <li> <tt>-e</tt> : do not attempt to transmit any environment variables 50 to <a href="s6-sudod.html">s6-sudod</a>. </li> 51 <li> <tt>-t <em>timeoutconn</em></tt> : if s6-sudod has not 52 managed to process the given information and start the server program after 53 <em>timeoutconn</em> milliseconds, give up. By default, <em>timeoutconn</em> 54 is 0, meaning infinite. Note that there is no reason to set up a nonzero 55 <em>timeoutconn</em> with a large value: s6-sudod is not supposed to block. 56 The option is only there to protect against ill-written services. </li> 57 <li> <tt>-T <em>timeoutrun</em></tt> : if the server program 58 has not exited after <em>timeoutrun</em> milliseconds, give up. By 59 default, <em>timeoutrun</em> is 0, meaning infinite. </li> 60 </ul> 61 62 <h2> Notes </h2> 63 64 <ul> 65 <li> If s6-sudoc is killed, or exits after <em>timeoutrun</em> milliseconds, 66 while the server program is still running, s6-sudod will send a SIGTERM and a 67 SIGCONT to the server program - but this does not guarantee that it will die. 68 If the server program keeps running, it might still read from the file that 69 was s6-sudoc's stdin, or write to the files that were s6-sudoc's stdout or 70 stderr. <strong>This is a potential security risk</strong>. 71 Administrators should audit their server programs to make sure this does not 72 happen. </li> 73 <li> More generally, anything using signals or terminals will not be 74 handled transparently by the s6-sudoc + s6-sudod mechanism. The mechanism 75 was designed to allow programs to gain privileges in specific situations: 76 short-lived, simple, noninteractive processes. It was not designed to emulate 77 the full suid functionality and will not go out of its way to do so. </li> 78 </ul> 79 80 </body> 81 </html>