LWN: Comments on "Review: The Linux Programming Interface"

Review: The Linux Programming Interface

spitzak — Fri, 28 Jan 2011 21:32:43 +0000

> And, at least all the device special files are confined to "/dev" (in practice), rather than scattered wherever (usually in "/tmp") like most filesystem Unix domain sockets...

I think this is your only legitimate complaint. Why not make a fix so the "abstract name space" is mounted under a permanent name. Then everything is in a predictable place in the filesystem, and you have all the HUGE advantages that they are in the same namespace you can search with existing tools.

/proc is full of files that used to be "namespaces" (actaully various kernel calls and tools that peeked into kernel memory maps). I think it is pretty obvious that /proc is VASTLY superior to the old api, in that it is discoverable and many more tools are written to use it.

Review: The Linux Programming Interface

renox — Thu, 27 Jan 2011 14:14:35 +0000

> that if it were holding a TCP port# instead? Do you complain that you can't "rm" listening TCP ports, too?

I had this need in one of our application, to workaround an issue I had to use a small tool which can 'force close' a 'listening TCP ports', having the possibility to 'rm' listening TCP ports would have been much more easy.

Review: The Linux Programming Interface

paulj — Tue, 25 Jan 2011 09:47:59 +0000

Solaris 10 does. I doubt it's changed, but havn't checked recent versions of OpenSolaris.

Review: The Linux Programming Interface

RobSeace — Fri, 21 Jan 2011 15:39:50 +0000

> examples of the things you want to do include

No, I want to do none of those things... Maybe they are things YOU and others want to do... But, personally, I have no need for any of them, and they mostly seem like stretches and grasping at straws to justify them existing in a place they certainly don't belong (the filesystem)...

And, your example of a buggy app and/or kernel is just crazy... You want to be able to kluge around a serious app/kernel bug by stealing its socket out from under it, and replacing it via another running copy? How about just fixing the bug! What if it were holding a TCP port# instead? Do you complain that you can't "rm" listening TCP ports, too?

> If you're unhappy because a system leaves files around in /tmp that aren't used anymore

That's part of why I dislike them... They're scattered around wherever, often somewhere under "/tmp" (which is a really poor place for something designed to be a shared identifier for communication between multiple apps)... But, mostly I dislike them because THEY ARE NOT FILES! Just having them exist as a directory entry in the filesystem does not fulfill some Unix utopia idea of "everything is a file"... In order for that to be fulfilled, the things must actually be usable AS FILES... If they were designed such that you could pass one to an otherwise unsuspecting app, which just open()'d it normally, and that magically let that app talk to whoever is listening on the other end of the socket (a la a named pipe), then I'd be all in favor of them... That would be brilliant... But, no, you can't do that... All you can do with a Unix domain socket "file" is to bind() to it or connect() to it... They're not files; they're filesystem representations of unique socket addresses, and that's all... As such, there's no need for them to live in the filesystem at all... (Unless you have special rare needs like those previously mentioned which can only be solved by them having a pathname in the filesystem...)

Review: The Linux Programming Interface

cras — Fri, 21 Jan 2011 15:05:50 +0000

Looking at http://www.cvedetails.com/cve/CVE-1999-1402/ I think this got fixed about 10 years ago everywhere. And since there aren't any other portable solutions for this either, I think it's safe enough nowadays to trust the filesystem permissions.

Review: The Linux Programming Interface

price — Fri, 21 Jan 2011 15:00:36 +0000

The reason abstract-namespace sockets are evil is that everything you end up wanting to do to them has to be reinvented, or else you live without. If on the other hand you use a common abstraction, namely the filesystem, then you get the benefit of all the common tools.

Cyberax's examples of the things you want to do include
* protect with AppArmor
* hide in a namespace away from some processes (like with chroot)
* see when they were created (presumably for debugging)

Here's my example:
* move them out of the way.
You think you wouldn't want that for a socket? Think again. I once had to deal with a buggy server process (clvmd) that would occasionally hang unkillably (due to a kernel bug), while holding an abstract-namespace socket. This means that when I tried to restart it, the new process would immediately fail because the socket was already bound.

If the clvmd authors had used filesystem sockets like good Unix-respecting developers, I could have simply mv'd or even rm'd the old socket, and the new process would have been free to bind to its socket at the usual name. Instead, I had to restart the box. This was a VM server -- dozens of people's VMs were affected by each restart. The bug recurred a couple of times a day. I *really* wished the program had used sockets in the filesystem, or that somebody had implemented rename() or unlink() for abstract-namespace sockets -- but who would do that? The program should have used sockets in the filesystem.

If you're unhappy because a system leaves files around in /tmp that aren't used anymore, you're really focusing on the wrong things.

Review: The Linux Programming Interface

RobSeace — Fri, 21 Jan 2011 14:54:00 +0000

As far as I know, most BSD derived ones do... Maybe the modern BSDs have added support for Unix domain file permissions, but it certainly wasn't historically true... I know I've heard of Solaris/SunOS ignoring Unix domain file perms before, as well... From "man 7 unix" on a Linux box:

In the Linux implementation, sockets which are visible in the filesys-
tem honour the permissions of the directory they are in. Their owner,
group and their permissions can be changed. Creation of a new socket
will fail if the process does not have write and search (execute) per-
mission on the directory the socket is created in. Connecting to the
socket object requires read/write permission. This behavior differs
from many BSD-derived systems which ignore permissions for Unix sock-
ets. Portable programs should not rely on this feature for security.

Review: The Linux Programming Interface

cras — Fri, 21 Jan 2011 14:13:40 +0000

What systems ignore filesystem permissions on UNIX sockets? I doubt any that still matter (Linux, OSX, BSDs, Solaris).

Review: The Linux Programming Interface

RobSeace — Thu, 20 Jan 2011 21:08:53 +0000

> Which is a shortcoming of Unix design

Perhaps, but given that you need to use completely different syscalls to work with sockets, and can't really just use regular file syscalls on them (well, for the most part; of course you can use read()/write() on them), I'm not sure I agree... How does Plan9 deal with this? Can you just open() up a TCP socket, and somehow specify a host and port to connect to, or one to listen on? (A la bash's "/dev/tcp"...) Once you do, does this process-specific socket exist as a separate file for others to see (and interact with)? I'm not sure I see how it makes much sense, in general...

> How about security with AppArmor?

Maybe, I know nothing about AppArmor... My distro (RHEL/CentOS) doesn't use it, favoring SELinux instead... (And, there's probably SOME method of making SELinux work with abstract Unix domain sockets, but goodness knows if anyone could ever figure out HOW!)

> Does your namespace work with chroot?

My namespace? Thanks for the credit, but I didn't invent it; I'm just a very big fan of it who regularly uses it... ;-)

But, sure, I guess that's a possible valid use... I'm not sure I can really conceive of a real-world use for such a thing, however... Maybe sandboxing something with its own private "/dev/log" that goes somewhere other than the real syslogd? *shrug*

> Also, unix sockets have a creation time (which helped me once).

Well, not really; like any other file, they've got modify and change times... But, yeah, both will generally reflect creation time... I'm not really sure how that'd be of much help in general, though?

> I can't open a lot of files in /proc for writing or reading.

Like which? For reasons other than permissions? Not talking about directories (or symlinks to them), I assume? Do you mean the non-file FD symlinks under "/proc/#/fd/"? Those you can at least readlink() like a real symlink...

> Quite a lot of devices in /dev are IOCTL-only and can't perform any read/write operation and so on.

Is it really a lot? Even if so, at least you can open() them... And, at least all the device special files are confined to "/dev" (in practice), rather than scattered wherever (usually in "/tmp") like most filesystem Unix domain sockets... If they had their own directory to live in which everyone used by convention, I wouldn't mind them nearly as much... I don't mind "/dev/log", since it's stuck in "/dev/" with the other special files...

One huge benefit of abstract Unix domain sockets is no need to worry about unlink()'ing them when you're done, and dealing with the race conditions inherent in that... They just go away when you exit or close() the listening socket... With filesystem sockets, a server needs to see if the socket already exists in the filesystem; if so, maybe that means another copy of itself (or some other app) is using that socket; or, maybe it means it previously crashed before being able to remove that socket... Should it unlink() it and try to bind() it itself? Only way to know is try to connect() to it, and see if someone is really listening on it (or look for it in "/proc/net/unix")... None of this is needed with abstract Unix domain sockets...

Review: The Linux Programming Interface

Cyberax — Thu, 20 Jan 2011 20:21:10 +0000

>Not when it comes to sockets, it doesn't... Do your TCP and UDP sockets exist in the filesystem, as well? How do you think lsof deals with those?

Which is a shortcoming of Unix design (which was fixed in 9p, btw).

>What, aside from lsof, actually needs to ever reference a Unix domain socket by pathname as if it were a file, anyway? It's not like you can just pass one to an arbitrary app which is expecting a file, and expect it to do anything sensible...

How about security with AppArmor? Does your namespace work with chroot? Also, unix sockets have a creation time (which helped me once).

>And, your strawman about getting rid of "/dev", "/sys", "/proc", etc. is missing the point entirely... The things under those dirs are perfectly usable AS FILES!

Not really. I can't open a lot of files in /proc for writing or reading. Quite a lot of devices in /dev are IOCTL-only and can't perform any read/write operation and so on.

Review: The Linux Programming Interface

RobSeace — Thu, 20 Jan 2011 20:10:54 +0000

> That's not a shortcoming of lsof, but a shortcoming of having a separate
> namespace. It goes against all the Unix traditions.

Not when it comes to sockets, it doesn't... Do your TCP and UDP sockets exist in the filesystem, as well? How do you think lsof deals with those? Right, it has to deal with a separate namespace... Just like it should be taught how to do with Linux's abstract Unix domain namespace... It's not like it's hard: they're right there in "/proc/net/unix", which it already reads anyway...

What, aside from lsof, actually needs to ever reference a Unix domain socket by pathname as if it were a file, anyway? It's not like you can just pass one to an arbitrary app which is expecting a file, and expect it to do anything sensible... Like, for instance, you can do with a named pipe... That's a case where existing in the filesystem is actually useful... There's absolutely no use to socket files; they're not "files" in any meaningful sense, because you can't do file I/O on them... They're just special creatures that happen to be identified via a pathname...

And, your strawman about getting rid of "/dev", "/sys", "/proc", etc. is missing the point entirely... The things under those dirs are perfectly usable AS FILES! They may be special creatures of their own, but plain old file I/O works on them; you can open() them, read() from them, write() to them... You can't do that on a socket "file"... I'm all in favor of "everything as a file", having used Unix-like systems for well over 20 years now... But, I'm not in favor of leaving tons of file-like tokens scattered all over the filesystem, which can't actually be used like files for anything, and which only exist there for the sole purpose of having a unique name to identify them by...

Review: The Linux Programming Interface

Cyberax — Thu, 20 Jan 2011 19:20:32 +0000

>But, that's more a shortcoming of lsof than of abstract Unix domain sockets...

That's not a shortcoming of lsof, but a shortcoming of having a separate namespace. It goes against all the Unix traditions.

While we're at it, why not move /dev into a separate namespace (like Windows does, BTW)? And then /sys and /proc.

Well, personally I don't care about other Unixes. However, ability to use AppArmor to restrict access to sockets somehow makes me feel more secure.

Review: The Linux Programming Interface

RobSeace — Thu, 20 Jan 2011 19:15:07 +0000

"lsof -U" will list all Unix domain sockets, including those in the abstract namespace... It would be nice if it displayed the actual abstract name in a format similar to "/proc/net/unix", and allowed searching for them by that name as well, I agree... But, that's more a shortcoming of lsof than of abstract Unix domain sockets...

And, using filesystem permissions to control access of Unix domain sockets is highly unportable... Many systems totally ignore perms on Unix domain sockets, making them effectively always 0777, like symlinks... (Yes, of course, the abstract namespace is also unportable, so relying on one Linux quirk is as good/bad as relying on another, I suppose...) But, any sane app that needs to restrict who talks to it over a Unix domain socket will use a much better app-level restriction of some kind, probably using SO_PEERCRED or SCM_CREDENTIALS/SO_PASSCRED or something of the sort, if not a full-blown login/authentication mechinism...

Review: The Linux Programming Interface

Cyberax — Thu, 20 Jan 2011 18:49:22 +0000

And I happen to have quite the opposite opinion. For example, real filesystems allow me to use "lsof" to check the list of socket's clients. Or to use common Unix permissions to control access.

Review: The Linux Programming Interface

mkerrisk — Thu, 20 Jan 2011 18:46:23 +0000

Quoting a just-posted blog entry:

Some days ago, No Starch Press started selling an ebook version of TLPI. The ebook is also provided for free when you buy a paper copy of TLPI from No Starch (look here for coupon—valid until end of February—that provides a publisher discount for the book+ebook package).

Currently, the ebook is available only in PDF form and only from No Starch. However, a full range of other ebook formats is currently in production, and when those formats are available they will be sold through the usual retail channels (and made available to No Starch customers who already have the ebook). I expect those other formats to be available around mid-February.

Review: The Linux Programming Interface

RobSeace — Thu, 20 Jan 2011 17:39:42 +0000

> 57.6 The Linux Abstract Socket Namespace

I'm delighted to see this listed in the table of contents... This is a criminally underdocumented and seemingly little known feature... I really wish all apps that use a Unix domain socket would use an abstract name instead of a real filesystem name, requiring yet another stupid "/tmp" directory be created to hold it, or whatever... Unix domain sockets within the filesystem are just ugly clutter, and serve no useful purpose... The abstract namespace is a brilliant concept, which I wish all other Unices would steal...

"Buy now"

jake — Thu, 20 Jan 2011 16:48:53 +0000

> Why not ThinkGeek LWN t-shirts to support the site too?

these we have (though not from ThinkGeek): http://www.cafepress.com/lwn_net

jake

"Buy now"

alison — Thu, 20 Jan 2011 16:32:10 +0000

"Buy now" from No Starch or O'Reilly or other FLOSS-friendly presses certainly seems safer. Why not ThinkGeek LWN t-shirts to support the site too? Or Flattr buttons, maybe? Easy for me to propose a whole list of improvements for other to implement, as always! I bought the Kerrisk book last night (and another at the same time) and am sorry LWN doesn't get a cent.

"Buy now"

rriggs — Thu, 20 Jan 2011 15:14:15 +0000

Amazon ain't the only game in town...

"Buy now"

corbet — Thu, 20 Jan 2011 14:00:16 +0000

Almost exactly a year ago we were dipping our toes back into the affiliate scene so we could provide just such a button. Then this happened. I can only say that we were quite glad not to be dependent on that revenue stream...

Review: The Linux Programming Interface

Cyberax — Thu, 20 Jan 2011 14:00:05 +0000

I'm in Ukraine and shipping options are limited and costly. Also, I don't like physical books because I move quite frequently.

Review: The Linux Programming Interface

jku — Thu, 20 Jan 2011 12:55:25 +0000

Disappointing if the hard copies bought from other sellers don't include that...

Anyway, there's a coupon code on http://man7.org/tlpi/ that gives 30% off -- that makes the publisher price at least somewhat competitive with other shops.

Review: The Linux Programming Interface

mkerrisk — Thu, 20 Jan 2011 08:09:20 +0000

The links for the source code tarballs have now been corrected on man7.org.

Review: The Linux Programming Interface

alison — Thu, 20 Jan 2011 07:16:08 +0000

LWN needs a "buy now" button so that we can help support the site with book purchases.

It's worth mentioning Matthew and Stones' _Beginning Linux Programming_ while on this topic. That book is a few years older and obviously less encyclopedic but nonetheless a wonderful and more portable reference. I particularly love that M&S include examples of bad code and bad practices in using the C API. I have learned the answers to several long-time puzzlements by typing in their examples and picking them apart. While I read the M&S book in order of my curiosity, I'm pretty sure I have now covered pretty much the whole multi-hundred page volume. As with any good bible, those so inclined can always while away 5 minutes by opening M&S to a random page.

Unfortunately it sounds like I need the Kerrisk book too: sigh.

Review: The Linux Programming Interface

dlang — Thu, 20 Jan 2011 01:00:36 +0000

if you buy the book from the publisher, you will get the e-book version as well.

Review: The Linux Programming Interface

Nick — Thu, 20 Jan 2011 00:26:53 +0000

I have a copy of this, and I would recommend it for userspace programmers using the Linux kernel API and also kernel programmers implementing it.

It's huge, but each particular section is well split up, so they are digestible chunks. Those parts I have read so far are interesting and informative.

Review: The Linux Programming Interface

dougg — Wed, 19 Jan 2011 21:47:58 +0000

As pointed out in the preface of the book, its format is homage to the late Richard Stevens who wrote a great series of books on Unix and TCP/IP programming in the 1990s. After carrying around TLPI for several weeks I am beginning to think that dividing TLPI into several volumes (like Richard Stevens did) would be a good idea.
Having fought with System V IPC I think that I'll skim the IPC sections. Besides I use inotify, flock and tmpfs to cover my current IPC needs. And TLPI is the first book that I have seen to cover those three subjects.

Review: The Linux Programming Interface

andikleen2 — Wed, 19 Jan 2011 21:35:27 +0000

Yes it's a very nice book. I expect it to become the "Stevens" of Linux low level programming.

-Andi

Review: The Linux Programming Interface

Cyberax — Wed, 19 Jan 2011 21:01:58 +0000

Wow! Thanks!

I sooooo needed a book like this that I even contemplated writing it myself.

/me waits for ebook.

Review: The Linux Programming Interface

mkerrisk — Wed, 19 Jan 2011 20:49:37 +0000

Note to readers of this review: there is a temporary glitch in the man7.org web page that points to the source code tarballs for TLPI. This should be fixed in about 24 hours, but in the meantime the correct location for the code can be found here.

Review: The Linux Programming Interface

b7j0c — Wed, 19 Jan 2011 20:04:00 +0000

i've been reading this and its an impressive work. i can only imagine the amount of effort that went into writing this...