PrivSep and portability

[Kevin Steves]

On Tue, 2 Apr 2002, Gert Doering wrote:
:I've seen a few patches related to the PrivSep works.  As far as I can
:see, it seems to work by using a shared memory segment to communicate.
:
:I just want to point out that there are some unix systems that do not
:have mmap() (SCO, older SVR3 systems) or that might have problems with
:anonymous shared mmap() (don't have an examples, but e.g. the INN docs
:are full of warnings concerning mmap()).
:
:So I want to ask you to make the PrivSep stuff compile-time configurable,
:to enable building on "legacy" platforms.

yes, what we want in the end is that ./configure;make will compile on the
current platforms and work as it does today.  privsep is by default off.

the strategy i've taken is to get it working on portable platforms that
i'm using (currently solaris 8 and hp-ux 11).  now i'm thinking about how
to support PAM.

we currently support access rights and ancillary data fd passing.  we
should probably add I_SEND/RECVFD support, but i haven't seen anyone ask
yet.  same for shm support vs. mmap().

for platforms that cannot be supported, i think we will just fatal() on a
required non-supported function if someone enables privsep.  i think we
should still handle preauth separation without fd passing support, but i
haven't tested that.