Solaris 9 setproject(3PROJECT) Problem

Tom · *nix forums beginner Joined: 10 Mar 2005 Posts: 14

I am trying to learn and understand the programming interface for
placing a process into a desired project. The man page for
setproject(3PROJECT) says if the user is a member of that project then
super-user privleges are not required. I added my user into a project.
However, whereas via the command line 'newtask' a new process can be
added, the same attempt via the API 'setproject' fails.

Why does my program fail but the command line mechanism work?

% id
uid=9999(santera) gid=14(sysadmin)
% grep santera /etc/project
t8000-lr:110:Platform
LR:santera::project.cpu-shares=(privileged,1,deny)
% newtask -p t8000-lr ls
Makefile SetProject.C SetProject

% cat SetProject.C
// SetProject.C
#include <unistd.h>
#include <iostream>
#include <sched.h> // scheduler
#include <cerrno>
#include <project.h>
#include <sys/types.h>
#include <sys/task.h>

using namespace std;

int main (int /* pArgc, char** /* pArgv */)
{
cout << "PID=" << ::getpid ()
<< "; UID=" << ::getuid ()
<< "; EUID=" << ::geteuid ()
<< "; GID=" << ::getgid ()
<< "; EGID=" << ::getegid ()
<< endl;

int retVal = ::setproject ("t8000-lr",
"santera",
TASK_NORMAL);
if (retVal != 0)
{
cout << "error: setproject(): retVal=" << retVal
<< "; " << errno << " (" << strerror(errno) << ")"
<< endl;
}
}

% SetProject
PID=21193; UID=9999; EUID=9999; GID=14; EGID=14
error: setproject(): retVal=-1; 1 (Not owner)

Casper H.S. Dik · *nix forums Guru Joined: 20 Feb 2005 Posts: 1634

"Tom" <cube_384@yahoo.com> writes:

Tom · *nix forums beginner Joined: 10 Mar 2005 Posts: 14

Casper, the Solaris 9 man page seems to imply that if user is a member
of the project, it can create a task in that project. Allow me to
quote:

If user_name is a valid member of the project specified by
project_name, as determined by inproj(3PROJECT), setpro-
ject() will create a new task with settaskid(2) using task
flags specified by flags, use setrctl(2) to associate vari-
ous resource controls with the process, task, and project,
and bind the calling process to the appropriate resource
pool with pool_set_binding(3POOL). Resource controls not
explicity specified in the project entry will be preserved.
If user_name is a name of the superuser (user with UID equal
to 0), the setproject() function skips the inproj(3PROJECT)
check described above and allows the superuser to join any
project.

If this is not true, I do not understand how application processes can
manage which projects to join; they'd all have to have super-user priv.

Tom

Casper H.S. Dik · *nix forums Guru Joined: 20 Feb 2005 Posts: 1634

"Tom" <cube_384@yahoo.com> writes:

Tom · *nix forums beginner Joined: 10 Mar 2005 Posts: 14

Thanks for the explanation. I'm sure Solaris 9 works just as you state,
but I'm not so sure that is the way it ought to work. I'll tell you,
the man page is VERY mis-leading.

Why should I bother to specify user_name as a valid member of the
project if only super-user can be used to successfully do anything with
this function? There isn't any way to specify another process id via
setproject's API, so it's dealing with the process making the call.
This just does not make sense to me.

newtask(1) will not allow user to join a project unless user is
specified in /etc/project, but once specified it works. It seems to me
setproject should do the same thing; otherwise I have no programming
API equivalent. I'm forced to have a SUID program do fork/exec, then
the new child process does the setproject while still having super-user
priv to make this work. Please correct me if I'm missing something.

My goal is to have various processes, all of the same user, end up in
different projects. I need to do this from a program not some
command-line mechanism.

Tom

Casper H.S. Dik · *nix forums Guru Joined: 20 Feb 2005 Posts: 1634

"Tom" <cube_384@yahoo.com> writes:

Tom · *nix forums beginner Joined: 10 Mar 2005 Posts: 14

Casper H.S. Dik wrote:

Casper H.S. Dik · *nix forums Guru Joined: 20 Feb 2005 Posts: 1634

"Tom" <cube_384@yahoo.com> writes:

Google