Subject: Re: [vserver] OCS and VServer
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 14 Jan 2009 07:25:55 +0100

On Tue, Jan 13, 2009 at 06:16:54PM -0500, John A. Sullivan III wrote:
> I was reading an old post
> (http://www.mail-archive.com/vserver@list.linux-vserver.org/msg10430.h
> tml) on using OCS inventory on a VServer guest and I was somewhat
> suspicious of the advice. Perhaps there is a better way and so I've
> posted for archival purposes.

> The problem is the inventory routine checks for read access to /dev/mem
> and, if it cannot read /dev/mem, it fails.  

> The final gist of the thread was the check is simply to ensure the
> user has root privileges and the solution was to comment out the
> check. 

well, the 'programmers' should better get
_some_ idea about unix and lateron posix
capabilities and their purpose ...

next time, program XY tries to write to
/etc/passwd, just to verify that it is
running as root ...

> Perhaps I am ignorant but I think I would rather still check for
> proper privileges rather than have the routine inexplicably fail.

> What I did instead was to edit ocsinventory-client.pl by changing
> unless(-r "/dev/mem"){
>        die localtime()." => You don't have enough rights to
> run this program\n";
> }
> to
> unless(-w "/root"){
>        die localtime()." => You don't have enough rights to
> run this program\n";
> }
> 

seriously, first, the developers (of OCS)
should figure what they actually want to
test for, and only do such a test if they
actually need read access to /dev/mem

secondly, once it is clear that they need
more than the priviledges available to a
mere user, they should better test for exactly
thos epriviledges, than doing voodoo tests
which will fail in many situations ...

> I know very little about VServer, OCS, or perl but it works for me. 
> Any corrections are most welcomed.

if the developers can not tell what they
actually need, the best approach is to simply
comment that check out and let the person
installing the software, which probably has
better understanding of those requirements
than the authors, make the decisions

> By the way, we want to run OCS on a guest rather than simply the host
> because we are using it as part of OSSIM and would like the software
> inventory to correlate against vulnerability and attacks to properly
> assess risk level.  We realize we are recording the same hardware
> several times.  Thanks - John

sidenote: somehow those checks and the whole
OCS feature set doesn't sound very useful to
me, especially as this information is already
available via various tools, which do not
require access to /dev/mem :)

but as usual, YMMV
best,
Herbert

> -- 
> John A. Sullivan III
> Open Source Development Corporation
> +1 207-985-7880
> jsullivan@opensourcedevel.com
> 
> http://www.spiritualoutreach.com
> Making Christianity intelligible to secular society