Bug 25481 - koha-plack not working under D10
Summary: koha-plack not working under D10
Status: Pushed to stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: master
Hardware: All All
: P5 - low blocker (vote)
Assignee: Jonathan Druart
QA Contact: Tomás Cohen Arazi
URL:
Keywords:
Depends on:
Blocks: 24167
  Show dependency treegraph
 
Reported: 2020-05-13 11:19 UTC by Jonathan Druart
Modified: 2020-05-21 20:54 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:
20.05.00, 19.11.06


Attachments
Bug 25481: Pass --user to start-stop-daemon when a pidfile is used (1.85 KB, patch)
2020-05-14 14:09 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 25481: Pass --user to start-stop-daemon when a pidfile is used (2.40 KB, patch)
2020-05-15 08:44 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 25481: Pass --user to start-stop-daemon when a pidfile is used (2.45 KB, patch)
2020-05-15 12:38 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 25481: Pass --user to start-stop-daemon when a pidfile is used (2.51 KB, patch)
2020-05-15 23:03 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 25481: Pass --user to start-stop-daemon when a pidfile is used (2.57 KB, patch)
2020-05-19 12:36 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2020-05-13 11:19:01 UTC Comment hidden (obsolete)
Comment 1 Jonathan Druart 2020-05-14 12:23:38 UTC
root@9ff4dd74490d:~$ koha-plack --stop kohadev
start-stop-daemon: matching only on non-root pidfile /var/run/koha/kohadev/plack.pid is insecure
[FAIL] Error: Plack not running for kohadev: failed!


root@9ff4dd74490d:~$ ls -l /var/run/koha/kohadev/
total 20
drwxr-xr-x 2 kohadev-koha kohadev-koha 4096 May 13 11:14 authorities
srw-rw-rw- 1 kohadev-koha kohadev-koha    0 May 13 11:15 authoritysocket
drwxr-xr-x 2 kohadev-koha kohadev-koha 4096 May 13 11:14 biblios
srw-rw-rw- 1 kohadev-koha kohadev-koha    0 May 13 11:15 bibliosocket
-rw-r--r-- 1 kohadev-koha kohadev-koha    5 May 13 11:19 kohadev-koha-sip.pid
-rw-r--r-- 1 kohadev-koha kohadev-koha    4 May 13 11:15 kohadev-koha-zebra.pid
-rw-r--r-- 1 kohadev-koha kohadev-koha    5 May 13 11:20 plack.pid
srwxr-xr-x 1 kohadev-koha kohadev-koha    0 May 13 11:20 plack.sock


Also note that the error message is wrong, plack is running but says it's not.
Comment 2 Jonathan Druart 2020-05-14 14:09:13 UTC
Created attachment 104887 [details] [review]
Bug 25481: Pass --user to start-stop-daemon when a pidfile is used

Since D10, the behaviour of start-stop-daemon changed, see from its
manual:
"""
Warning:  using this match option with a world-writable pidfile or using it alone with a daemon that writes the pidfile as an unprivileged (non-root) user will be refused with an error (since
version 1.19.3) as this is a security risk, because either any user can write to it, or if the daemon gets compromised, the contents of the pidfile cannot be trusted, and  then  a  privileged
runner (such as an init script executed as root) would end up acting on any system process.  Using /dev/null is exempt from these checks.
"""

Test plan:
koha-plack --restart kohadev
should success with this patch.
Without this patch you get:
start-stop-daemon: matching only on non-root pidfile /var/run/koha/kohadev/plack.pid is insecure
Comment 3 Jonathan Druart 2020-05-14 14:09:30 UTC
This is blocker for 20.05
Comment 4 David Cook 2020-05-15 00:24:59 UTC
Haven't looked into this in Koha but just a bit of Googled info on start-stop-daemon:

Jessie: 1.17.27
https://manpages.debian.org/jessie/dpkg/start-stop-daemon.8.en.html

Stretch: 1.18.25
https://manpages.debian.org/stretch/dpkg/start-stop-daemon.8.en.html

Buster: 1.19.7
https://manpages.debian.org/buster/dpkg/start-stop-daemon.8.en.html

Ubuntu 18.04 (based off buster/sid): 1.19.05
http://manpages.ubuntu.com/manpages/bionic/man8/start-stop-daemon.8.html

Issue introduced in 1.19.3?
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=921557

Claimed to be fixed in 1.19.5 in February though...

Jonathan, could you report on what version of dpkg is installed in your test environment? Might be that the update hasn't flowed to the Docker images you're using.
Comment 5 David Cook 2020-05-15 00:26:24 UTC
(In reply to Jonathan Druart from comment #2)
> Since D10, the behaviour of start-stop-daemon changed, see from its
> manual:
> """
> Warning:  using this match option with a world-writable pidfile or using it
> alone with a daemon that writes the pidfile as an unprivileged (non-root)
> user will be refused with an error (since
> version 1.19.3) as this is a security risk, because either any user can
> write to it, or if the daemon gets compromised, the contents of the pidfile
> cannot be trusted, and  then  a  privileged
> runner (such as an init script executed as root) would end up acting on any
> system process.  Using /dev/null is exempt from these checks.
> """

Oh right... that makes sense. Nevermind me... 😓
Comment 6 David Cook 2020-05-15 00:26:29 UTC
(In reply to Jonathan Druart from comment #2)
> Since D10, the behaviour of start-stop-daemon changed, see from its
> manual:
> """
> Warning:  using this match option with a world-writable pidfile or using it
> alone with a daemon that writes the pidfile as an unprivileged (non-root)
> user will be refused with an error (since
> version 1.19.3) as this is a security risk, because either any user can
> write to it, or if the daemon gets compromised, the contents of the pidfile
> cannot be trusted, and  then  a  privileged
> runner (such as an init script executed as root) would end up acting on any
> system process.  Using /dev/null is exempt from these checks.
> """

Oh right... that makes sense. Nevermind me... 😓
Comment 7 Victor Grousset/tuxayo 2020-05-15 02:05:56 UTC
I'm getting this error.

> root@32f1d65b48bc:kohadevbox$ koha-plack --restart kohadev
> start-stop-daemon: user 'kohadev-koha.kohadev-koha' not found
> [FAIL] Error: Plack not running for kohadev: failed!

Extract of my /etc/passwd file
kohadev-koha:x:1000:1000:Koha instance kohadev-koha,,,:/var/lib/koha/kohadev:/bin/bash

My dev env is
export KOHA_IMAGE=master-buster ; ku
Comment 8 Jonathan Druart 2020-05-15 08:44:04 UTC
Created attachment 104922 [details] [review]
Bug 25481: Pass --user to start-stop-daemon when a pidfile is used

Since D10, the behaviour of start-stop-daemon changed, see from its
manual:
"""
Warning:  using this match option with a world-writable pidfile or using it alone with a daemon that writes the pidfile as an unprivileged (non-root) user will be refused with an error (since
version 1.19.3) as this is a security risk, because either any user can write to it, or if the daemon gets compromised, the contents of the pidfile cannot be trusted, and  then  a  privileged
runner (such as an init script executed as root) would end up acting on any system process.  Using /dev/null is exempt from these checks.
"""

Test plan:
koha-plack --restart kohadev
should success with this patch.
Without this patch you get:
start-stop-daemon: matching only on non-root pidfile /var/run/koha/kohadev/plack.pid is insecure
Comment 9 Jonathan Druart 2020-05-15 08:44:26 UTC
Erk, I attached the wrong patch!
Comment 10 Nick Clemens 2020-05-15 12:38:43 UTC
Created attachment 104941 [details] [review]
Bug 25481: Pass --user to start-stop-daemon when a pidfile is used

Since D10, the behaviour of start-stop-daemon changed, see from its
manual:
"""
Warning:  using this match option with a world-writable pidfile or using it alone with a daemon that writes the pidfile as an unprivileged (non-root) user will be refused with an error (since
version 1.19.3) as this is a security risk, because either any user can write to it, or if the daemon gets compromised, the contents of the pidfile cannot be trusted, and  then  a  privileged
runner (such as an init script executed as root) would end up acting on any system process.  Using /dev/null is exempt from these checks.
"""

Test plan:
koha-plack --restart kohadev
should success with this patch.
Without this patch you get:
start-stop-daemon: matching only on non-root pidfile /var/run/koha/kohadev/plack.pid is insecure

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 11 Victor Grousset/tuxayo 2020-05-15 23:03:15 UTC
Created attachment 104977 [details] [review]
Bug 25481: Pass --user to start-stop-daemon when a pidfile is used

Since D10, the behaviour of start-stop-daemon changed, see from its
manual:
"""
Warning:  using this match option with a world-writable pidfile or using it alone with a daemon that writes the pidfile as an unprivileged (non-root) user will be refused with an error (since
version 1.19.3) as this is a security risk, because either any user can write to it, or if the daemon gets compromised, the contents of the pidfile cannot be trusted, and  then  a  privileged
runner (such as an init script executed as root) would end up acting on any system process.  Using /dev/null is exempt from these checks.
"""

Test plan:
koha-plack --restart kohadev
should success with this patch.
Without this patch you get:
start-stop-daemon: matching only on non-root pidfile /var/run/koha/kohadev/plack.pid is insecure

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 12 Victor Grousset/tuxayo 2020-05-15 23:04:12 UTC
Thanks Jonathan, it works :) (tested with restart_all)
It comes at a handy moment when I need to use Debian 10 to test another bug.
And also to use Debian 10 by default.
Comment 13 Tomás Cohen Arazi 2020-05-19 12:36:14 UTC
Created attachment 105088 [details] [review]
Bug 25481: Pass --user to start-stop-daemon when a pidfile is used

Since D10, the behaviour of start-stop-daemon changed, see from its
manual:
"""
Warning:  using this match option with a world-writable pidfile or using it alone with a daemon that writes the pidfile as an unprivileged (non-root) user will be refused with an error (since
version 1.19.3) as this is a security risk, because either any user can write to it, or if the daemon gets compromised, the contents of the pidfile cannot be trusted, and  then  a  privileged
runner (such as an init script executed as root) would end up acting on any system process.  Using /dev/null is exempt from these checks.
"""

Test plan:
koha-plack --restart kohadev
should success with this patch.
Without this patch you get:
start-stop-daemon: matching only on non-root pidfile /var/run/koha/kohadev/plack.pid is insecure

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 14 Martin Renvoize 2020-05-19 14:04:59 UTC
Nice work everyone!

Pushed to master for 20.05
Comment 15 Joy Nelson 2020-05-21 20:54:05 UTC
pushed to 19.11.x for 19.11.06