How do you allow Unix based ONC RPC within the security constraints of SGD

Question

On our new boxes running SGD 4.2.91and up we notice that our applications that uses rpc to communicate no longer work. One of the programs, the arbitrator, (i.e. runs in its on process space, not a linked in library). Therefore, two user will share the same arbitrator (or conversely, only one arbitrator runs per machine). The arbitrator runs without a display (i.e. has no stdout, etc, similar to a daemon). The arbitration process also uses the UNIX kernel resource of shared memory. Here is what I have observed with my testing. The arbitrator routine is successfully registered in the port map ( svc_register). This means it does run. But later when svc_run is called, the process is not found ( actually the select fails), and ps �ef | grep arbitrator indicates that the arbitrator is not running

Answer 1

Does SGD put any restrictions/constraints on ONC RPC, ie does it attempt to block or authenicate?
What object list_attributes does the application that luanches arbitrator need?
Does abribrator need to be in the list of allow applications for the current user? Can it be put in this list and not have an icon on the desktop ( since the user does not manually launch it, and usually is not even aware of it)?
Or, more generally, how does the enumerated allowed list of executables handle a process that exec/forks a new process? ie does SGD have to know the forked process name, etc?