summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--examples/monkeysphere-monitor-keys30
1 files changed, 27 insertions, 3 deletions
diff --git a/examples/monkeysphere-monitor-keys b/examples/monkeysphere-monitor-keys
index 4d89cd5..f6328df 100644
--- a/examples/monkeysphere-monitor-keys
+++ b/examples/monkeysphere-monitor-keys
@@ -29,6 +29,11 @@
# monitoring file system changes appropriate to your operating system (if you
# are running Linux, liblinux-inotify2-perl is recommended).
+# FIXME: does this handle revocations and re-keying? if a sysadmin
+# switches over to this arrangement, how will the system check for
+# revocations? Scheduling a simple gpg --refresh should handle
+# revocations. I'm not sure how to best handle re-keyings.
+
use strict;
use warnings;
use File::ChangeNotify;
@@ -50,7 +55,7 @@ sub debug {
sub get_watch_files() {
my @watch_files;
- my %key_file_locations = get_key_file_locations();
+ my %key_file_locations = get_key_file_locations();
# get list of users on the system
while(my ($name, $passwd, $uid, $gid, $gcos, $dir, $shell, $home) = getpwent()) {
while (my ($key, $file) = each (%key_file_locations)) {
@@ -104,7 +109,12 @@ sub get_watcher {
}
}
}
+
# create combined file filters to limit our monitor
+
+ # FIXME: what if the elements of @filters have some regex characters
+ # in them? this seems like it could match all kinds of crazy stuff
+
my $filter = '^(' . join("|",@filters) . ')$';
# return a watcher object
@@ -126,8 +136,19 @@ sub watch {
} else {
# if user deleted, file might not exist
if( -f $event->path) {
+ # FIXME: how is this choosing a username? What if the
+ # sysadmin controls these files instead of the user?
+ # (e.g. /etc/monkeysphere/authorized_user_ids/%u) then won't
+ # the owner be the superuser each time?
+
+ # Is there some more clever way that we can get back to the
+ # user from the path itself? maybe we store a lookup table
+ # when we're generating the path list and refer back to it?
my $username = getpwuid((stat($event->path))[4]);
+ # FIXME: this seems like it is trying to treat an array as a
+ # set. Maybe it'd be better to use the keys of a hash (or
+ # hashref) instead?
if ( !grep $_ eq $username, @users ) {
push(@users,$username);
}
@@ -135,9 +156,12 @@ sub watch {
}
}
for my $user (@users) {
- my @args = ('u',$user);
debug("Updating user: %s\n", $user);
- system 'monkeysphere-authentication', @args;
+ # FIXME: this call blocks until m-a u finishes running, i think.
+ # what happens if other changes occur in the meantime? Can we
+ # rate-limit this? Could we instead spawn child processes that
+ # run this command directly?
+ system('monkeysphere-authentication', 'update-users', $user);
}
}
}