How can one send a file descriptor thru a pipe?


(For example, in the case of a server that forks worker children and
then listen for incoming connections, it'll have to forward the open
socket to a free worker child. How can it do it?)

--
__Pascal Bourguignon__                     http://www.informatimago.com/
The world will now reboot; don't bother saving your artefacts.

[ Post a follow-up to this message ]

Pascal Bourguignon wrote :

> How can one send a file descriptor thru a pipe?
>
> (For example, in the case of a server that forks worker children and
> then listen for incoming connections, it'll have to forward the open
> socket to a free worker child. How can it do it?)

for this kind of things, you can use threads instead of processes.
That will allow you such things.

But you can have a look at what apache is doing.
I guess apache forks once the socket is binded so that there are
several processes that can accept incoming connections.
(maybe it is not possible to do that  )

--
DINH V. Hoa,

"Ma tuxitude me beastifie" -- sunZ

[ Post a follow-up to this message ]

"Pascal Bourguignon" <spam@mouse-potato.com> wrote in message
news:87llcpi0dw.fsf@thalassa.informatimago.com...
> How can one send a file descriptor thru a pipe?

You can't.

> (For example, in the case of a server that forks worker children and
> then listen for incoming connections, it'll have to forward the open
> socket to a free worker child. How can it do it?)

In the simplest case: create the listening socket, then fork() the workers,
then have each worker call accept(). You don't need to "forward" the
accepted connections.

Alex

[ Post a follow-up to this message ]

On 26 Nov 2004 07:34:51 +0100,
Pascal Bourguignon <spam@mouse-potato.com> wrote:


>
> How can one send a file descriptor thru a pipe?
>
>
> (For example, in the case of a server that forks worker children and
> then listen for incoming connections, it'll have to forward the open
> socket to a free worker child. How can it do it?)
>

openssh is doing exacly that in their privilege separation solution.
When the unprivileged server needs a pty pair it sends a request to
a privileged process and this process will then send back the opened
fd to the pty pair.  It is using a socketpair for this and not a pipe,
though.  Look at the monitor_fdpass for how this can be done.

The orginal SystemV rel4 have similar capability but implemented
with STREAMS pipe, which isn't the same thing as a normal pipe.

This mechanism is documented in one of the books by R.W.Stewens; the APUE
book, if I'm not mistaken.  There isn't much documentation elsewhere.

Villy

[ Post a follow-up to this message ]

Villy Kruse <vek@station02.ohout.pharmapartners.nl> writes:

> On 26 Nov 2004 07:34:51 +0100,
>     Pascal Bourguignon <spam@mouse-potato.com> wrote: 
>
> openssh is doing exacly that in their privilege separation solution.
> When the unprivileged server needs a pty pair it sends a request to
> a privileged process and this process will then send back the opened
> fd to the pty pair.  It is using a socketpair for this and not a pipe,
> though.  Look at the monitor_fdpass for how this can be done.

What's needed is a Unix domain socket. socketpair is implemented as
Unix domain sockets. The Apache approach is probably easier to do
though.

> The orginal SystemV rel4 have similar capability but implemented
> with STREAMS pipe, which isn't the same thing as a normal pipe.
>
> This mechanism is documented in one of the books by R.W.Stewens; the
> APUE book, if I'm not mistaken.  There isn't much documentation
> elsewhere.

It's in "Unix Network Programming" Vol 1. (chapter 14).

Joe
--
To the optimist, the glass is half full. To the pessimist, the glass
is half empty. To the engineer, the glass is twice as big as it needs
to be.
- anon

[ Post a follow-up to this message ]

On Thu, 26 Nov 2004, Pascal Bourguignon wrote:

> How can one send a file descriptor thru a pipe?

I describe how to do this in Chapter 21 of my book, Solaris
Systems Programming.  I should also point out that only STREAMS
pipes can pass file descriptors.

HTH,

--
Rich Teer, SCNA, SCSA, author of "Solaris Systems Programming"

President,
Rite Online Inc.

Voice: +1 (250) 979-1638
URL: http://www.rite-group.com/rich

[ Post a follow-up to this message ]

On Fri, 26 Nov 2004, Villy Kruse wrote:

> book, if I'm not mistaken.  There isn't much documentation elsewhere.

I describe how to pass descriptors in my book, Solaris Systems
Programming.

--
Rich Teer, SCNA, SCSA, author of "Solaris Systems Programming"

President,
Rite Online Inc.

Voice: +1 (250) 979-1638
URL: http://www.rite-group.com/rich

[ Post a follow-up to this message ]

Rich Teer <rich.teer@rite-group.com> writes:

> On Thu, 26 Nov 2004, Pascal Bourguignon wrote:
> 
>
> I describe how to do this in Chapter 21 of my book, Solaris
> Systems Programming.  I should also point out that only STREAMS
> pipes can pass file descriptors.

Unix domain sockets can do it as well, and they have the advantage of
being portable.

--
Måns Rullgård
mru@inprovide.com

[ Post a follow-up to this message ]

On Fri, 26 Nov 2004, Måns Rullgård wrote:

> Unix domain sockets can do it as well, and they have the advantage of
> being portable.

True, although I'd argure that STREAMS is portable (any SVR4-based UNIX
should have them), although admittedly they aren't specified by POSIX.

--
Rich Teer, SCNA, SCSA, author of "Solaris Systems Programming"

President,
Rite Online Inc.

Voice: +1 (250) 979-1638
URL: http://www.rite-group.com/rich

[ Post a follow-up to this message ]

Villy Kruse <vek@station02.ohout.pharmapartners.nl> writes:

> On 26 Nov 2004 07:34:51 +0100,
>     Pascal Bourguignon <spam@mouse-potato.com> wrote:
>
> 
>
> openssh is doing exacly that in their privilege separation solution.
> When the unprivileged server needs a pty pair it sends a request to
> a privileged process and this process will then send back the opened
> fd to the pty pair.  It is using a socketpair for this and not a pipe,
> though.  Look at the monitor_fdpass for how this can be done.
>
> The orginal SystemV rel4 have similar capability but implemented
> with STREAMS pipe, which isn't the same thing as a normal pipe.
>
> This mechanism is documented in one of the books by R.W.Stewens; the APUE
> book, if I'm not mistaken.  There isn't much documentation elsewhere.

Thank you. Indeed, it works sending sendmsg(2) a 1-(dummy)-byte
message with the file descriptor in the message header (either
msg_accrights or msg_control).  I should have searched
/usr/include/linux/socket.h instead of ioctl.h...

--
__Pascal Bourguignon__                     http://www.informatimago.com/
The world will now reboot; don't bother saving your artefacts.

[ Post a follow-up to this message ]