Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 683152 - net-misc/memcached: possible unsafe PID file ownership
Summary: net-misc/memcached: possible unsafe PID file ownership
Status: CONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Robin Johnson
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-04-12 13:10 UTC by Tomáš Mózes
Modified: 2019-04-12 13:34 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tomáš Mózes 2019-04-12 13:10:58 UTC
In default configuration, /run/memcached/memcached.pid is owned by memcached user. If that users changes the content of the pidfile and then /etc/init.d/memcached stop is called, it can cause any arbitrary process to be killed.

Lots of examples of this (and fixes): http://michael.orlitzky.com

Why not dropping the possibility to configure the pidfile location and set it to /run/${RC_SVCNAME}.pid? This will then work even for multiple instances.
Comment 1 Michael Orlitzky gentoo-dev 2019-04-12 13:34:07 UTC
*thumbs up*

Lots of good info here, too:

  https://github.com/OpenRC/openrc/blob/master/service-script-guide.md

Some daemons make it hard to get this right, by dropping permissions *before* they write the PID file. This usually happens when e.g. they want to dual-purpose the PID file as a lock file, or to prevent multiple instances of the same daemon from running, or something like that. But I have no idea if it applies here.

There's lots of other weird stuff in this service script that can probably go away, like

    local dir="$(dirname ${PIDFILE})"
    if [ ! -d "${dir}" ]; then
        einfo " Creating ${dir}"
        mkdir -p "${dir}"
    fi

    chown ${MEMCACHED_RUNAS} "${dir}"
    if [ -f "${PIDFILE}" ]; then
        einfo "  Removing stale pidfile ${PIDFILE}"
        rm -f "${PIDFILE}" 1>/dev/null
    fi

should be a single call to checkpath, but of course ideally should not be there at all (PID file should be where Tomas suggested, owned by root). And OpenRC cleans up the PID file for you.

These things,

      if [ -n "${SOCKET}" ]; then
        CONNECTION="-s ${SOCKET}"

can all be done at the top in a single line, declaratively, with ${parameter:+[word]} substitutions. And it's valid in any shell:

  http://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html

Afterwards, I'm pretty sure you can delete the start/stop functions and let the defaults do everything for you.