On Wed, 2013-04-03 at 10:36 -0400, Abhishek Koneru wrote:
Hi Ade,
Please share your views on this. It is regarding a ticket to prevent a concurrent execution of pkispawn/pkidestroy.
On Tue, 2013-04-02 at 15:52 -0500, Endi Sukma Dewata wrote: On 4/2/2013 11:54 AM, Abhishek Koneru wrote:
Please review the patch which adds a locking mechanism to prevent pkispawn and pkidestroy to execute concurrently.
Some comments:
1. This mechanism locks the entire system, so only one pkispawn/pkidestroy can run at any time. Is this the intended behavior? Or should we lock a particular instance only?
I think it was decided to allow only one pkispawn/pkidestroy for an entire system.
pkispawn and pkidestroy do selinux operations. Only one set of selinux operations should be done at a time. Not doing this could cause an operation to fail or worse. If you like, you could try to lock this section only, but then you still need to ensure that concurrent oerations do not affect the same data -- for instance, are they touching the same ports? The simplest and easiest solution will be to lock to having one operation per system at a time.
2. If another script is already running, the current script will block until the other script is done. Is this the intended behavior? Or should it fail immediately? Or should it wait but show a message saying another script is running?
Since only the section of code which does spawn()/destroy() are under lock, all the user details are taken by that time. But the blocked script will be waiting for some-time. I think showing a message would be nice as Endi reviewed.
My first thought was that it should fail immediately. But I could see having it wait with the relevant message. The user can then choose to control-C if they want.
3. Right now the lock file is called /tmp/pkioperationlock.lck. It might be better to move it into /var/run/pki/pki-deployment.lock or something like that.
Will be changed.
PFA the patch for you convenience.
--Abhishek