Having /proc with 755 is a privacy problem: Another user can, for example, see by using "ps" what movies others are watching, etc. A solution for this is making /proc 750 and chown it to root:procers. Only users who are added to procers may monitor proc support. In order to get hald running that way, the "haldaemon" user obviously has to be added to the procers group. When everything is set up this way, hald still will refuse to work and crash immediately on startup. This is because the hald developers are not calling initgroups(2). Obviously, auxiliary groups are not needed to be initialized when /proc has 755 permissions. However, in a setup like the above described, it is necessary for hald to perform the initgroups(2) call. Luckily, the change to the code is minimal as such a thing was already thought of (the appropriate function receives a parameter, which is in the current code always set to "0" however). The patch I propose (because HAL is out of maintenance and they won't accept patches) will enable the user to supply a command line parameter which will optionally enable auxiliary group support ("--keep-auxgroups"). If it is not specified, everything will run normally. Reproducible: Always Steps to Reproduce: 1. chmod 750 /proc 2. chown root:procers /proc 3. Add "haldaemon" to "procers" groups 4. Start hald Actual Results: 09:59:12.577 [I] hald.c:671: hal 0.5.12rc1 09:59:12.577 [I] hald.c:736: Will not daemonize 09:59:12.577 [I] hald_dbus.c:5417: local server is listening at unix:abstract=/var/run/hald/dbus-zf0EZzH5vG,guid=298760b1518ad88b9c6405a84b10e660 09:59:12.578 [I] ck-tracker.c:391: got seat '/org/freedesktop/ConsoleKit/Seat1' 09:59:12.579 [I] ck-tracker.c:321: got session '/org/freedesktop/ConsoleKit/Session2' for seat '/org/freedesktop/ConsoleKit/Seat1' 09:59:12.579 [I] ck-tracker.c:274: Got active state (ACTIVE) and uid 1000 on session '/org/freedesktop/ConsoleKit/Session2' 09:59:12.579 [I] ck-tracker.c:342: Got all sessions on seat '/org/freedesktop/ConsoleKit/Seat1' 09:59:12.579 [I] ck-tracker.c:418: Got seats 09:59:12.579 [I] ck-tracker.c:816: Got seats and sessions Runner started - allowed paths are '/usr/libexec:/usr/lib64/hal/scripts:/usr/bin' 09:59:12.581 [I] hald_runner.c:301: Runner has pid 4358 09:59:12.581 [I] hald_runner.c:182: runner connection is 0x664320 09:59:12.581 [W] osspec.c:383: Unable to open /proc/mdstat: No such file or directory 09:59:12.582 [I] mmap_cache.c:274: cache mtime is 1257707879 *** [DIE] osspec.c:osspec_init():439 : Unable to read /proc/mounts Expected Results: Hald starts nicely. Portage 2.1.6.13 (default/linux/amd64/10.0, gcc-4.1.2, glibc-2.9_p20081201-r2, 2.6.31 x86_64) ================================================================= System uname: Linux-2.6.31-x86_64-Intel-R-_Core-TM-2_Quad_CPU_Q9550_@_2.83GHz-with-gentoo-1.12.13 Timestamp of tree: Fri, 27 Nov 2009 21:00:01 +0000 app-shells/bash: 4.0_p28 dev-java/java-config: 1.3.7-r1, 2.1.9-r1 dev-lang/python: 2.4.6, 2.5.4-r3, 2.6.2-r1 dev-python/pycrypto: 2.0.1-r8 dev-util/cmake: 2.6.4-r3 sys-apps/baselayout: 1.12.13 sys-apps/sandbox: 1.6-r2 sys-devel/autoconf: 2.13, 2.63-r1 sys-devel/automake: 1.4_p6, 1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.2 sys-devel/binutils: 2.18-r3 sys-devel/gcc-config: 1.4.1 sys-devel/libtool: 2.2.6a virtual/os-headers: 2.6.27-r2 ACCEPT_KEYWORDS="amd64" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -march=nocona" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/config" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/eselect/postgresql /etc/fonts/fonts.conf /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c /etc/udev/rules.d" CXXFLAGS="-O2 -pipe -march=nocona" DISTDIR="/usr/portage/distfiles" FEATURES="distlocks fixpackages parallel-fetch protect-owned sandbox sfperms strict unmerge-orphans userfetch" GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo" LANG="de_DE" LDFLAGS="-Wl,-O1" LINGUAS="de" MAKEOPTS="-j7" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/portage/local/layman/sunrise /usr/portage/local/layman/hollow /usr/local/portage" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="3dnow 3dnowext X X509 a52 aac acl acpi aiglx alsa amd64 apache2 avi bash-completion berkdb bluetooth bzip2 cairo cddb cdparanoia cdr cli cracklib crypt cups dri dts dvb dvd dvdr dvdread encode exif fbcon ffmpeg flac foomaticdb gd gdbm gimp gimpprint gnome gpm gstreamer gtk gtk2 hbci iconv ipv6 jpeg kpathsea kqemu lirc matroska mikmod mmx mmxext mng modules mp3 mpeg multilib ncurses nls nodrm nptl nptlonly nvidia ogg oggvorbis opengl openmp openntpd pam pcre png postgres postscript ppds pppd python readline recode reflection replytolist rtc rtsp samba sasl session smartcard smp snmp spl sqlite sse sse2 ssl subversion svg sysfs tcpd theora threads tiff timidity truetype unicode usb v4l v4l2 vorbis wavpack x264 xanim xinerama xmms xorg xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="serialvfd" LINGUAS="de" SANE_BACKENDS="epson2" USERLAND="GNU" VIDEO_CARDS="nvidia" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Created attachment 211392 [details, diff] The patch descibed above
You actually want to submit such patch upstream as it could make its way into upstream repository for 0.5.14.
Ok, I've reposted the patch to the HAL mailing list (http://lists.freedesktop.org/archives/hal/2009-December/013683.html) just now. I'm curious as to what the HAL developers have to say to this, but because of HAL being in maintenance mode am afraid we could be out of luck. If they refuse to include the patch, wouldn't it still be worth for consideration as a Gentoo patch?
sys-apps/hal was removed from tree wrt #313389, closing as OBSOLETE
