OSProcessBuilder - Quickstart for Developers

This document serves as a crash-course on the basics of the process builder. For further information please refer to:

1. Building

To build the OSProcessBuilder, you can use the build mechanism of ProActvie, as it is fully compilant with it (extension targets). The main side-effect of building is that the script files will be copied into the proactive.home/dist/scripts/processbuilder/ folder. However, not all files which can be seen in the scripts folder among the sources will be copied (please refer to scripts/[os_name]/CONTENTS.txt for more information).

Windows particularities

Linux particularities
The executable suer32, respectively suer64 are obtained from suer.c. The compilation is done inside the build scripts with gcc. However, if you plan to export a PA distribution, make sure you have both 32 and 64 bit version of the gcc libraries on your machine, as it will try to compile in both modes.

2. Testing

The test files for the OSProcessBuilder can be found in the proactive/src/Tests/functionalTests/processbuilder folder. To run them you will most probably have to set three environment variables:

3. Setting up machines to be used with the lib

All OSes
Make sure that the proactive.home/dist/scripts/processbuilder folder is readable (and contents are executable) by all users that can be used as targets for launching.

Windows

Linux

4. Security Threats and Other Issues

The user of the forking process must have SE_INCREASE_QUOTA_NAME and SE_ASSIGNPRIMARYTOKEN_NAME privileges.

Linux (general)
Since we use scripts to start the executable in case there is a target user, be aware that all paramters are visible to all users! Do not leave sensitive information in the arguments for the command. Use the environment instead - also, read below.

Linux (the SSH option)
The main security issue is that since ssh will not propagate the environent at all, we use the same hack as in windows. We write the contents of the environment to the temp folder (this is done in the scripts, and we create this file with mktemp). Do not put sensitive information into the environment as it may be read by anyone.