gssproxy

#123 [RFE] fork separate processes for each socket
Closed: Deferred by simo. Opened by simo.

Closed: Deferred
Reopen Issue

We have the ability to definie different sockets per service.
When a completely different socket is defined we may want to fork a compltely separate process to mage it to minimize the effect of crash bugs and security bugs by constraining them to the specific service.

We could for in all cases and then use socket passing, but I wouldn't do that yet.

Can you give a bit more context and use case of when it makes sense to define different sockets?
When is it useful to create different processes for different sockets?

You use different sockets when you have no other way to differentiate between clients, yet you need to because you need to apply different configurations.

For example when you have 2 root processes and no selinux (or they use the same label) availble and yet you need them to have different service definitions.

The reson to fork is just more reliability and defence in depth. If one client causes crashes another client will not be affected.

I am also thinking of adding socket activation, which would naturally cause separate processes to be started directly by the init system, so being able to internally handle multiple processes from this point of view would make that goal more easily achievable.

Metadata Update from @simo:
- Issue assigned to simo
- Issue set to the milestone: X - DEFERRED

Project has moved please reopen here if still an issue:
https://github.com/gssapi/gssproxy/issues

Metadata Update from @simo:
- Issue close_status updated to: Deferred
- Issue priority set to: None (was: 5)
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
enhancement
gssproxy daemon
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.