The conf.d/epmd default file starts epmd with the parameter "-relaxed_command_check". This effectively means that a user can take down any erlang-based service, as one can send the kill command (with epmd -kill or by directly sending the appropriate command to the TCP port) [1]. If this is not passed then epmd can only be killed if no service is using it. (Unfortunately it seems not allowing to kill epmd by any user is not a considered scenario.) It seems to me this is a dangerous default configuration and this shouldn't be enabled by default. I recommend we remove it from the conf.d file installed by default (and maybe add a comment pointing out the potential risk). [1] http://erlang.org/doc/man/epmd.html
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=118840a378b33af02851ba097c08fcb0f93cda98 commit 118840a378b33af02851ba097c08fcb0f93cda98 Author: Sergei Trofimovich <slyfox@gentoo.org> AuthorDate: 2019-11-22 13:59:20 +0000 Commit: Sergei Trofimovich <slyfox@gentoo.org> CommitDate: 2019-11-22 13:59:35 +0000 dev-lang/erlang: drop -relaxed_command_check from defaults Reported-by: Hanno Böck Bug: https://bugs.gentoo.org/700930 Package-Manager: Portage-2.3.79, Repoman-2.3.18 Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org> dev-lang/erlang/erlang-22.1.8-r1.ebuild | 150 ++++++++++++++++++++++++++++++++ dev-lang/erlang/files/epmd.confd-r2 | 2 + 2 files changed, 152 insertions(+)
