usermode

#2 Add support for optional include files in shvar
Opened by andriyptrv. Modified

Open
Close Issue

We have a legacy application that consists of a daemon and a privileged "query"
program. Recently we have started using usermode console.apps to deal with
the authentication for the privileged program. The config file looks like this:
PROGRAM=/usr/sbin/bmapd-query
USER=root
. /var/run/bmapd/auth.ini

The auth.ini is dynamically created by the daemon depending on the certain setup
parameters. Sometimes the file may not exist, and then userhelper -w
completely disregards the config and immediately exits.

As a workaround we modified usermode to stop processing config files when a
missing include is encountered, but still keep going with the parts it already
read. We would be happy if you apply this patch for the functionality into
usermode.
Andriy

Patched file
shvarfix.patch

Thanks for the patch. I'm afraid it's not acceptable in the current form: a missing include file usually indicates a misconfiguration and userhelper needs to "fail closed". For example, if there is a typo in the path, userhelper could authenticate an user with a configuration that was not intended by the system administrator.

Without knowing any details, it seems to me that it should be possible to modify your application or application installation process to ensure bmapd/auth.ini always exists. If that is not an option for some reason, I'd probably accept a patch that adds a separate "include if exists" directive. The directive would ignore files that do not exist, but still fail if the file exists but can't be read for any other reason.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.