238351 2008-09-22 03:10 0000 dev-util/git-1.5.6.4 git-daemon init script doesn't function correctly 2009-04-16 10:26:34 0000 1 1 1 Unclassified Gentoo Linux Ebuilds unspecified All Linux RESOLVED TEST-REQUEST P2 normal --- 1 dev@snitselaar.org ferdy@gentoo.org flameeyes@gentoo.org plaes@plaes.org rbu@gentoo.org robbat2@gentoo.org roy@marples.name yrusinov@gmail.com dev@snitselaar.org 2008-09-22 03:10:48 0000 The daemon gets started, but the init script reports it as failing to start Reproducible: Always Steps to Reproduce: 1. sudo /etc/init.d/git-daemon start 2. sudo /etc/init.d/git-daemon status 3. ps -ef | grep git-daemon 4. sudo /etc/init.d/git-daemon stop Actual Results: snits@tesla /etc/init.d $ sudo /etc/init.d/git-daemon start * Caching service dependencies ... [ ok ] * Starting git-daemon ... [ !! ] snits@tesla /etc/init.d $ sudo /etc/init.d/git-daemon status * status: stopped snits@tesla /etc/init.d $ ps -ef | grep git-daemon root 29256 1 0 20:02 ? 00:00:00 git-daemon --syslog --export-all --verbose --base-path=/pub/scm snits 29321 22931 0 20:03 pts/3 00:00:00 grep --colour=auto git-daemon snits@tesla /etc/init.d $ sudo /etc/init.d/git-daemon stop * WARNING: git-daemon has not yet been started. Expected Results: snits@tesla /etc/init.d $ sudo /etc/init.d/git-daemon start * Caching service dependencies ... [ ok ] * Starting git-daemon ... [ ok ] snits@tesla /etc/init.d $ sudo /etc/init.d/git-daemon status * status: started snits@tesla /etc/init.d $ ps -ef | grep git-daemon root 29474 1 0 20:05 ? 00:00:00 /usr/bin/git-daemon --syslog --export-all --verbose --base-path=/pub/scm snits 29509 22931 0 20:05 pts/3 00:00:00 grep --colour=auto git-daemon snits@tesla /etc/init.d $ sudo /etc/init.d/git-daemon stop * Stopping git-daemon ... [ ok ] In Bug 236685 for git-1.6.0 there is a patch for a different fix that shows the correct code for the start-stop-daemon invocation, but I can't find in the Changelog in /usr/portage/git at what point this was fixed. The exit status for git -- daemon must be different than the status for git-daemon. The patch below solves the problem: --- git-daemon.orig 2008-09-20 00:26:35.000000000 -0700 +++ git-daemon 2008-09-20 00:31:07.000000000 -0700 @@ -9,11 +9,11 @@ } start() { ebegin "Starting git-daemon" start-stop-daemon --start --background \ - --exec /usr/bin/git -- daemon ${GITDAEMON_OPTS} + --exec /usr/bin/git-daemon -- ${GITDAEMON_OPTS} eend $? } stop() { ebegin "Stopping git-daemon" dev@snitselaar.org 2008-09-22 03:12:02 0000 Created an attachment (id=166056) patch to exec git-daemon instead of git -- daemon robbat2@gentoo.org 2008-09-22 04:59:43 0000 It works here with 1.5.4.5 which is older than your 1.5.6.4: # grep bin/git.*daemon /etc/init.d/git-daemon --exec /usr/bin/git -- daemon ${GITDAEMON_OPTS} # /etc/init.d/git-daemon start ; ps -ef |grep git * Starting git-daemon ... [ ok ] root 4198 1 0 04:59 ? 00:00:00 git-daemon --syslog root 4206 20336 0 04:59 pts/3 00:00:00 grep --colour=auto git roy@marples.name 2008-09-22 19:07:07 0000 This is with git-1.6.0.2 uberserver init.d # ps ax | grep git 5407 ? Ss 0:00 /usr/libexec/git-core/git-daemon --base-path=/var/git --export-all --syslog So either use s-s-d witht the right path, or use git daemon without s-s-d. robbat2@gentoo.org 2008-09-22 20:04:30 0000 uberlord: the reporter was seeing it fail to even start. Whereas it does start correctly on my machines, regardless of git and baselayout/openrc version. roy@marples.name 2008-09-22 20:14:28 0000 Created an attachment (id=166132) Launch git daemon with --pid-file Or use pidfiles :) NOTE: OpenRC-0.2.5 will incorrectly report git-daemon as crashed, this is fixed with OpenRC-git roy@marples.name 2008-09-22 20:16:08 0000 (In reply to comment #4) > uberlord: the reporter was seeing it fail to even start. Whereas it does start > correctly on my machines, regardless of git and baselayout/openrc version. I was seeing the same issue as the reporter on my hardened amd64 server, running mostly stable. roy@marples.name 2008-09-22 20:59:42 0000 May have to add --name git-daemon for baselayout-1 flameeyes@gentoo.org 2008-09-30 12:42:47 0000 May I add that it would be nice if git-daemon was running under its own user rather than with _root_? (For that to happen, beside creating the user, it needs a /var/run/git-daemon directory where the user can write to, rather than using /var/run directly). rbu@gentoo.org 2008-10-10 14:38:04 0000 I can reproduce this error on my baselayout-1 stable server with git 1.5.6.4. (In reply to comment #7) > May have to add --name git-daemon for baselayout-1 That fixed the problem, yes. rbu@gentoo.org 2008-10-10 14:42:17 0000 (In reply to comment #8) > May I add that it would be nice if git-daemon was running under its own user > rather than with _root_? (For that to happen, beside creating the user, it > needs a /var/run/git-daemon directory where the user can write to, rather than > using /var/run directly). Is git-daemon doing anything in that directory? I would suggest adding "--user git" as a parameter should be sufficient? plaes@plaes.org 2008-11-21 17:50:16 0000 Same troubles seem to exist with dev-util/git-1.6.0.4 Also.. why not use /usr/libexec/git-core/git-daemon directly? plaes@plaes.org 2008-11-21 18:04:33 0000 My views on git stuff on Gentoo: dev-util/git: * add git user and group * use /var/spool/git as home directory * add following default options to git-daemon ebuild: * user and group set to git * base-path set to /var/spool/git/repositories ? (or just /var/spool/git) dev-util/gitosis-gentoo (and/or dev-util/gitosis) * drop git user creation (depends on git anyway) plaes@plaes.org 2008-11-23 11:42:27 0000 Created an attachment (id=172921) add-git-user-group.patch Add git user and group creation to git ebuild. plaes@plaes.org 2008-11-23 11:44:15 0000 Created an attachment (id=172922) fix-git-daemon-initscript.patch Fixes to git-daemon initscript to properly start/stop it and use git user/group. robbat2@gentoo.org 2008-11-23 12:36:24 0000 Why do you think that git-daemon should run as a privileged user vs. the nobody user (see the xinetd variant). plaes@plaes.org 2008-11-23 13:36:20 0000 (In reply to comment #15) > Why do you think that git-daemon should run as a privileged user vs. the nobody > user (see the xinetd variant). > Oh, I didn't actually think about the xinetd stuff. Shouldn't the xinetd be configured/started using /etc/init.d/xinetd with appropriate conf under /etc/xinetd.d/ directory? robbat2@gentoo.org 2008-11-23 22:25:47 0000 It is started with xinetd, and I think it's how the majority of git-daemon users actually use it, so that they don't need it running 24/7, and can also impose service limits etc. I say we just change the init.d/git-daemon to use the nobody user as well, and end it at that. Having it run as the git user would be very bad in the case of an exploit with your /var/spool/git owned by the user as well. The attacker has valid filesystem perms to eat your repos, which would suck. rbu@gentoo.org 2008-11-24 00:13:48 0000 (In reply to comment #17) > It is started with xinetd, and I think it's how the majority of git-daemon > users actually use it, so that they don't need it running 24/7, and can also > impose service limits etc. It still is a use-flag and you can install it without pulling in xinetd (never liked that myself). > I say we just change the init.d/git-daemon to use > the nobody user as well, and end it at that. Right now the non-xinetd init script will run it as root, so any non-root user is better than root. By your argument, if the nobody user suffices, then git-daemon should be run as that. robbat2@gentoo.org 2008-11-24 01:09:45 0000 Fixed in git-1.6.0.4-r1. 1. The user/group are configurable via the conf.d. 2. "/usr/bin/git daemon" is the upstream-preferred way of running it, so that the actual binary can move safely in future, or be merged into a single multicall binary. plaes@plaes.org 2008-11-24 07:28:44 0000 Please fix typo in /etc/init.d/git-daemon: /usr/bin/git/git leio@gentoo.org 2008-11-24 07:51:56 0000 Reopening on Priit's request robbat2@gentoo.org 2008-11-24 09:27:51 0000 Fixed agian, sorry. haubi@gentoo.org 2008-11-26 15:07:35 0000 (In reply to comment #19) > Fixed in git-1.6.0.4-r1. Please keep a separate copy of git-daemon.initd for git-1.5*, which keeps using '/usr/bin/git-daemon' (didn't have luck with --name=git-daemon, how should that work?). Because I still have the original failure (comment#0) with git-1.5.6.4 on both stable and hardened profiles. robbat2@gentoo.org 2008-11-27 10:57:16 0000 haubi: the new init.d works 100% perfectly here with git-1.5.6.4 and bl2/openrc. Could you please check that you did etc-update properly? plaes@plaes.org 2008-11-27 19:24:48 0000 (In reply to comment #24) > haubi: the new init.d works 100% perfectly here with git-1.5.6.4 and > bl2/openrc. Could you please check that you did etc-update properly? > Could you please add "--name git-daemon" to git-daemon start() for baselayout1 compatibility. ;) robbat2@gentoo.org 2008-11-27 20:33:57 0000 Adding "--name git-daemon" unconditionally ends up causing bl2 to fail. I did some magic instead, please merge+test again. --name should now only be passed on baselayout1 systems, with --pidfile being passed always. I did dig out a bl1 system to test myself, and had no issues there. yrusinov@gmail.com 2009-04-15 21:29:52 0000 Why does patch does not apply onto git-1.6.2*. /etc/init.d/git-daemon does not started as daemon. 166056 2008-09-22 03:12 0000 patch to exec git-daemon instead of git -- daemon git-daemon.patch text/plain LS0tIGdpdC1kYWVtb24ub3JpZwkyMDA4LTA5LTIwIDAwOjI2OjM1LjAwMDAwMDAwMCAtMDcwMAor KysgZ2l0LWRhZW1vbgkyMDA4LTA5LTIwIDAwOjMxOjA3LjAwMDAwMDAwMCAtMDcwMApAQCAtOSwx MSArOSwxMSBAQAogfQogCiBzdGFydCgpIHsKIAllYmVnaW4gIlN0YXJ0aW5nIGdpdC1kYWVtb24i CiAJCXN0YXJ0LXN0b3AtZGFlbW9uIC0tc3RhcnQgLS1iYWNrZ3JvdW5kIFwKLQkJLS1leGVjIC91 c3IvYmluL2dpdCAtLSBkYWVtb24gJHtHSVREQUVNT05fT1BUU30KKwkJLS1leGVjIC91c3IvYmlu L2dpdC1kYWVtb24gLS0gJHtHSVREQUVNT05fT1BUU30KIAllZW5kICQ/CiB9CiAKIHN0b3AoKSB7 CiAJZWJlZ2luICJTdG9wcGluZyBnaXQtZGFlbW9uIgo= 166132 2008-09-22 20:14 0000 Launch git daemon with --pid-file git-daemon.diff text/plain LS0tIGdpdC1kYWVtb24uaW5pdGQJMjAwOC0wOS0xNiAxOTowNTo1OC4wMDAwMDAwMDAgKzAxMDAK KysrIC9ldGMvaW5pdC5kL2dpdC1kYWVtb24JMjAwOC0wOS0yMiAyMToxMDo1Mi4wMDAwMDAwMDAg KzAxMDAKQEAgLTMsNiArMyw4IEBACiAjIERpc3RyaWJ1dGVkIHVuZGVyIHRoZSB0ZXJtcyBvZiB0 aGUgR05VIEdlbmVyYWwgUHVibGljIExpY2Vuc2UgdjIKICMgJEhlYWRlcjogL3Zhci9jdnNyb290 L2dlbnRvby14ODYvZGV2LXV0aWwvZ2l0L2ZpbGVzL2dpdC1kYWVtb24uaW5pdGQsdiAxLjMgMjAw OC8wOS8xNiAxNzo1MjoxNSByb2JiYXQyIEV4cCAkCiAKK1BJREZJTEU9JHtQSURGSUxFOi0vdmFy L3J1bi9naXQtZGFlbW9uLnBpZH0KKwogZGVwZW5kKCkgewogCW5lZWQgbmV0CiAJdXNlIGxvZ2dl cgpAQCAtMTAsMTMgKzEyLDE0IEBACiAKIHN0YXJ0KCkgewogCWViZWdpbiAiU3RhcnRpbmcgZ2l0 LWRhZW1vbiIKLQkJc3RhcnQtc3RvcC1kYWVtb24gLS1zdGFydCAtLXF1aWV0IC0tYmFja2dyb3Vu ZCBcCi0JCS0tZXhlYyAvdXNyL2Jpbi9naXQgLS0gZGFlbW9uICR7R0lUREFFTU9OX09QVFN9CisJ c3RhcnQtc3RvcC1kYWVtb24gLS1zdGFydCAtLWJhY2tncm91bmQgXAorCQktLWV4ZWMgL3Vzci9i aW4vZ2l0IC0tcGlkZmlsZSAiJHtQSURGSUxFfSIgXAorCQktLSBkYWVtb24gLS1waWQtZmlsZT0i JHtQSURGSUxFfSIgJHtHSVREQUVNT05fT1BUU30KIAllZW5kICQ/CiB9CiAKIHN0b3AoKSB7CiAJ ZWJlZ2luICJTdG9wcGluZyBnaXQtZGFlbW9uIgotCQlzdGFydC1zdG9wLWRhZW1vbiAtLXN0b3Ag LS1xdWlldCAtLW5hbWUgZ2l0LWRhZW1vbgorCXN0YXJ0LXN0b3AtZGFlbW9uIC0tc3RvcCAtLXBp ZGZpbGUgIiR7UElERklMRX0iCiAJZWVuZCAkPwogfQo= 172921 2008-11-23 11:42 0000 add-git-user-group.patch add-git-user-group.patch text/plain LS0tIGEvZGV2LXV0aWwvZ2l0L2dpdC0xLjYuMC40LmVidWlsZAorKysgYi9kZXYtdXRpbC9naXQv Z2l0LTEuNi4wLjQuZWJ1aWxkCkBAIC01NSw2ICs1NSwxMCBAQCBwa2dfc2V0dXAoKSB7CiAJaWYg dXNlIHdlYmRhdiAmJiAhIHVzZSBjdXJsIDsgdGhlbgogCQlld2FybiAiVVNFPXdlYmRhdiBuZWVk cyBVU0U9Y3VybC4gSWdub3JpbmciCiAJZmkKKworCSMgQ3JlYXRlIGdpdCBhbmQgZ3JvdXAKKwll bmV3Z3JvdXAgZ2l0CisJZW5ld3VzZXIgZ2l0IC0xIC0xIC92YXIvc3Bvb2wvZ2l0IGdpdAogfQog CiAjIFRoaXMgaXMgbmVlZGVkIGJlY2F1c2UgZm9yIHNvbWUgb2JzY3VyZSByZWFzb25zIGZ1dHVy ZSBjYWxscyB0byBtYWtlIGRvbid0Cg== 172922 2008-11-23 11:44 0000 fix-git-daemon-initscript.patch init-d-git-daemon.patch text/plain LS0tIGEvZGV2LXV0aWwvZ2l0L2ZpbGVzL2dpdC1kYWVtb24uaW5pdGQKKysrIGIvZGV2LXV0aWwv Z2l0L2ZpbGVzL2dpdC1kYWVtb24uaW5pdGQKQEAgLTExLDEyICsxMSwxNiBAQCBkZXBlbmQoKSB7 CiBzdGFydCgpIHsKIAllYmVnaW4gIlN0YXJ0aW5nIGdpdC1kYWVtb24iCiAJCXN0YXJ0LXN0b3At ZGFlbW9uIC0tc3RhcnQgLS1xdWlldCAtLWJhY2tncm91bmQgXAotCQktLWV4ZWMgL3Vzci9iaW4v Z2l0IC0tIGRhZW1vbiAke0dJVERBRU1PTl9PUFRTfQorCQktLWV4ZWMgL3Vzci9saWJleGVjL2dp dC1jb3JlL2dpdC1kYWVtb24gLS0gXAorCQkJLS1waWQtZmlsZT0vdmFyL3J1bi9naXQtZGFlbW9u LnBpZCBcCisJCQktLXVzZXI9Z2l0IC0tZ3JvdXA9Z2l0IFwKKwkJCSR7R0lUREFFTU9OX09QVFN9 CiAJZWVuZCAkPwogfQogCiBzdG9wKCkgewogCWViZWdpbiAiU3RvcHBpbmcgZ2l0LWRhZW1vbiIK LQkJc3RhcnQtc3RvcC1kYWVtb24gLS1zdG9wIC0tcXVpZXQgLS1uYW1lIGdpdC1kYWVtb24KKwkJ c3RhcnQtc3RvcC1kYWVtb24gLS1zdG9wIC0tcXVpZXQgXAorCQktLXBpZGZpbGUgL3Zhci9ydW4v Z2l0LWRhZW1vbi5waWQKIAllZW5kICQ/CiB9Cg==