haskell / haskell/process

Reconsider #44 (change user and group)

Open
#230 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Haskell
Stars
91
Forks
91
PR merge metrics
No merged PRs in 30d

Description

The capability to change user and group was added 6 years ago in #45. There a few reasons why I believe this feature may not be pulling its weight:

* doing setuid dance *correctly* in a cross-platform way is hard (consider how [much effort openssh-portable goes through](https://github.com/openssh/openssh-portable/blob/master/openbsd-compat/bsd-setres_id.c))
* there's a TODO acknowledging the questionable [correctness of the implementation](https://github.com/haskell/process/blob/master/cbits/posix/fork_exec.c#L175-L176)
* posix_spawn API doesn't support this capability so this feature requires keeping both code paths and runtime fall-back which is unlikely to be a well-tested scenario.
* no tests cover this functionality (because it is really inconvenient to test)

@jprider63 do you still use this feature that you added? Can somebody think of a way to survey the ecosystem to figure out how much usage the feature received?

In summary, I believe the feature is likely not secure, contains race conditions, complicates the codebase, and has no tests. This seems like a good candidate for removal.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.