Discussion:
'syslogd -u' and pidfile creation
Add Reply
Jan Schaumann
2024-11-08 15:29:04 UTC
Reply
Permalink
Hello,

20 years ago, I filed bin/27309. In short, if you use
'syslogd -u user', then syslogd can't create a pidfile
because that is done post-setuid.

My suggested fix (diff attached) is to create the
pidfile and chown it before changing UIDs. The
subsequent pidfile(3) call will happily take over the
existing file.

One thing to note is that upon termination, the
pidfile will remain (albeit truncated), because the
unprivileged user does not have write permissions on
/var/run. This shouldn't be a problem: upon start,
pidfile(3) does the right thing in the presence of an
empty existing file.

Does that seem reasonable?

-Jan
Mouse
2024-11-08 17:02:38 UTC
Reply
Permalink
[I]f you use 'syslogd -u user', then syslogd can't create a pidfile
because that is done post-setuid.
What is the intended use case for -u? Or, to put it another way, why
is this something that needs fixing? My own reaction is that if you're
using -u, it's not appropriate to write the usual system-wide PID file
in its usual place, which makes this a feature rather than a bug. So
there obviously is something different between what I've got in mind
and what you do.

/~\ The ASCII Mouse
\ / Ribbon Campaign
X Against HTML ***@rodents-montreal.org
/ \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
Robert Elz
2024-11-08 19:00:54 UTC
Reply
Permalink
Date: Fri, 8 Nov 2024 12:02:38 -0500 (EST)
From: Mouse <***@Rodents-Montreal.ORG>
Message-ID: <***@Stone.Rodents-Montreal.ORG>

| What is the intended use case for -u?

My guess would be so that the syslogd process isn't running as root,
and so can do less harm if some bug is uncovered in the processing
messages it receives from a remote host (or even the current one).

| My own reaction is that if you're using -u, it's not appropriate to
| write the usual system-wide PID file in its usual place,

But it also would not be appropriate to open the sockets (binding to
the ports) or the output log files in its usual place either - so if
you imagine that -u is so some user can have a private syslogd running
for their own messages, I don't believe that is its intent.

As for:

***@netmeister.org said:
| Does that seem reasonable?

The patch looks OK to me, but wrt:


***@netmeister.org said:
| One thing to note is that upon termination, the pidfile will remain
| (albeit truncated), because the unprivileged user does not have write
| permissions on /var/run.

I agree this is mostly harmless (though annoying) - but leads me to
ponder whether or not we should have a directory permission setting
which would allow anyone to remove their own files from a directory,
but not create any (assuming they don't also have write permission,
which has to be the case or they can remove any files, unless
one of the setuid bits is set, like in /tmp).

Even though it is not at all meaningful in any naming sense, perhaps
we could reuse the sticky bit on directories (which was once used for
what is now the setuid bit) to allow for this operation, precisely for
directories like this, where a priv'd process creates a file (or files)
in some directory, chowns them to some user, then runs as that user until
exit. There's no policy reason to retain the files - the priv'd process
could just fork() and have its parent wait on the child, and then delete
everything that needs deleting, so a mechanism already exists - but is
fairly heavyweight for such a simple requirement.

An alternative might be to add extra meaning to the setuid/gid bits
which currently are useful only if the relevant write permission bit
is available, and in that case are restrictive rather than permissive,
so that if write perm for the user isn't available, they'd mean that
unlinking a suitably owned file would still be possible when write
permission otherwise forbids it (adding permissions in that case).
I think I'd prefer to use the t (sticky) bit, as that overloading of
meanings for the user & group setuid bits might be rather confusing.

And (just to reply in advance, just in case) to the "shouldn't this
be an extended attribute type thing?" question - yes, it probably should,
but so should all permissions. But EAs only work on filesystes formatted
to permit them (none of mine do, for example) which makes that a far less
attractive solution to be something which ought to be able to work anywhere.

So, any general opinions on this, were it to get implemented ?

kre


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
Robert Elz
2024-11-08 22:02:32 UTC
Reply
Permalink
Date: Sat, 09 Nov 2024 02:00:54 +0700
From: Robert Elz <***@munnari.OZ.AU>
Message-ID: <***@jacaranda.noi.kre.to>


| Even though it is not at all meaningful in any naming sense, perhaps
| we could reuse the sticky bit on directories (which was once used for
| what is now the setuid bit)

Edgar Fu� pointed out that I got this all backwards, and the available
(upper 3) mode bits for dir permissions all wrong. I really should
stop relying upon my pathetic emulation of a memory...

But that's kind of beside the point, there is certainly at least one of
those 3 bits which is used for nothing currently, which could serve this
purpose.

The bigger question is whether the basic function is worth having, rather
than which bit should be used to enable it.

kre


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
Jan Schaumann
2024-11-08 19:05:38 UTC
Reply
Permalink
Post by Mouse
[I]f you use 'syslogd -u user', then syslogd can't create a pidfile
because that is done post-setuid.
What is the intended use case for -u?
To run syslogd as an unprivileged user rather than as
root. It starts up as root to open the log sockets,
then changes euid to the target user.

With this option, right now syslogd starts up, changes
euid, daemonizes and then silently fails to create the
pidfile. This means that then "/etc/rc.d/syslogd
stop" will be unable to kill syslogd, and
"/etc/rc.d/syslogd restart" will start a second
instance.

-Jan

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
Jan Schaumann
2024-11-08 22:17:13 UTC
Reply
Permalink
Post by Robert Elz
I agree this is mostly harmless (though annoying) - but leads me to
ponder whether or not we should have a directory permission setting
which would allow anyone to remove their own files from a directory,
but not create any (assuming they don't also have write permission,
which has to be the case or they can remove any files, unless
one of the setuid bits is set, like in /tmp).
I'm not sure that's a frequent enough use case to
warrant inventing a new permissions bit for.

Introducing this would also add a certain amount of
complexity and opportunity for user error, so I'd
probably wait until a more tangible need arises.

-Jan

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
Loading...