Quoting Elliott Mitchell (2021-11-18 20:54:58) > On Thu, Nov 18, 2021 at 07:26:50PM +0100, Jonas Smedegaard wrote: > > Quoting Elliott Mitchell (2021-11-18 16:45:58) > > > Appears the documentation for `start-stop-daemon` is misleading or > > > wrong, and the "--exec" option is needed if "--startas" is given a > > > pathname. > > > > This sounds like a bug in start-stop-daemon: please report against > > the package dpkg which seems to provide start-stop-daemon, and > > provide more details on how it fails to work. > > > > > Might be this is an issue for me, but not others since the > > > "radicale" user's shell had been set to `/bin/false`. As this is > > > strongly recommended security hardening, the radicale package > > > should work with a system setup this way. > > > > Not sure what you are saying here, but seems a separate issue (even > > if affecting the other one). > > > > If you mean to say that using shell /usr/sbin/nologin for radicale > > account is strongly discouraged, then please file a separate > > bugreport about that - preferably with more details, as that is not > > obvious to me. > > > > Also, please file a separate bugreport if you believe radicale > > should work with custom shell setting and fails to do so (but works > > without such change). Because I agree that should work, and am > > surprised if it doesn't (but I don't use sysV init system myself so > > cannot easily test). > > My guess is this could be a documentation problem for > `start-stop-daemon`. > > Based upon observed behavior, I suspect "--exec" changes to the > appropriate user and then does an execve() of the specified > executeable. Whereas "--startas" is instead executing the shell of the > specified user with arguments as specified. > > The latter requires the shell be valid. Unless there is an > overwhelmingly important reason for the radicale user's shell to be > valid, it should instead be `/bin/false`. This though requires use of > "--exec". > > Since Radicale appears to function properly when started with "--exec" > that seems a vastly superior approach (doesn't result in security > concerns).
Thanks for the additional info. You continue posting to same bugreport despite my urging you to file as a separate one. I take that as indication that you do not consider this relevant to track on its own, and I will respect that. - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private
signature.asc
Description: signature
