Attachment 104887 Details for Bug 25481 – Bug 25481: Pass --user to start-stop-daemon when a pidfile is used

[patch] Bug 25481: Pass --user to start-stop-daemon when a pidfile is used

Bug-25481-Pass---user-to-start-stop-daemon-when-a-.patch (text/plain), 1.85 KB, created by Jonathan Druart on 2020-05-14 14:09:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2020-05-14 14:09:13 UTC

Size: 1.85 KB

patch

obsolete

>From a57223ec371d625c28d3260cb13bad46a267bfee Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Thu, 14 May 2020 16:06:06 +0200
>Subject: [PATCH] Bug 25481: Pass --user to start-stop-daemon when a pidfile is
> used
>
>Since D10, the behaviour of start-stop-daemon changed, see from its
>manual:
>"""
>Warning:  using this match option with a world-writable pidfile or using it alone with a daemon that writes the pidfile as an unprivileged (non-root) user will be refused with an error (since
>version 1.19.3) as this is a security risk, because either any user can write to it, or if the daemon gets compromised, the contents of the pidfile cannot be trusted, and  then  a  privileged
>runner (such as an init script executed as root) would end up acting on any system process.  Using /dev/null is exempt from these checks.
>"""
>
>Test plan:
>koha-plack --restart kohadev
>should success with this patch.
>Without this patch you get:
>start-stop-daemon: matching only on non-root pidfile /var/run/koha/kohadev/plack.pid is insecure
>---
> debian/scripts/koha-functions.sh | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/debian/scripts/koha-functions.sh b/debian/scripts/koha-functions.sh
>index 8687845aa5..6b961434c1 100755
>--- a/debian/scripts/koha-functions.sh
>+++ b/debian/scripts/koha-functions.sh
>@@ -269,6 +269,7 @@ is_plack_running()
>     local instancename=$1
> 
>     if start-stop-daemon --pidfile "/var/run/koha/${instancename}/plack.pid" \
>+            --user="$instancename-koha.$instancename-koha" \
>             --status ; then
>         return 0
>     else
>@@ -292,6 +293,7 @@ is_z3950_running()
>     local instancename=$1
> 
>     if start-stop-daemon --pidfile "/var/run/koha/${instancename}/z3950-responder.pid" \
>+            --user="$instancename-koha.$instancename-koha" \
>             --status ; then
>         return 0
>     else
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 25481: 104887 | 104922 | 104941 | 104977 | 105088