Your message dated Mon, 09 May 2011 09:18:29 +0000
with message-id <[email protected]>
and subject line Bug#35325: fixed in sysklogd 1.5-6.1
has caused the Debian Bug report #35325,
regarding sysklogd: syslogd shouldn't run as root
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
35325: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=35325
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: sysklogd
Version: 1.3-26
Severity: wishlist
Syslogd does not need superuser privileges except for startup. Klogd needs
privileges to open /proc/kmsg, but in current kernels (2.0.34, 2.1.107)
non-root reading from the file descriptor fails. That should eventually
be fixed.
This patch implements a new flag, -u user which causes syslogd and klogd
to call setuid(user).
diff -ru ./klogd.c.orig ./klogd.c
--- ./klogd.c.orig Sun Jun 28 23:22:48 1998
+++ ./klogd.c Sun Jun 28 23:26:49 1998
@@ -216,6 +216,7 @@
#include <stdarg.h>
#include <paths.h>
#include <stdlib.h>
+#include <pwd.h>
#include "klogd.h"
#include "ksyms.h"
#include "pidfile.h"
@@ -240,7 +241,7 @@
static char *PidFile = "/etc/klogd.pid";
#endif
-static int kmsg,
+static int kmsg = -1,
change_state = 0,
terminate = 0,
caught_TSTP = 0,
@@ -490,7 +491,7 @@
return(kernel);
}
- if ( (kmsg = open(_PATH_KLOG, O_RDONLY)) < 0 )
+ if ( kmsg == -1 && (kmsg = open(_PATH_KLOG, O_RDONLY)) < 0 )
{
fprintf(stderr, "klogd: Cannot open proc file system, " \
"%d - %s.\n", errno, strerror(errno));
@@ -878,10 +879,13 @@
auto char *log_level = (char *) 0,
*output = (char *) 0;
+ uid_t uid = 0;
+ gid_t gid;
+ struct passwd *pw;
chdir ("/");
/* Parse the command-line. */
- while ((ch = getopt(argc, argv, "c:df:iIk:nopsvx")) != EOF)
+ while ((ch = getopt(argc, argv, "c:df:iIk:nopsu:vx")) != EOF)
switch((char)ch)
{
case 'c': /* Set console message level. */
@@ -915,6 +919,15 @@
case 's': /* Use syscall interface. */
use_syscall = 1;
break;
+ case 'u':
+ pw = getpwnam(optarg);
+ if (!pw) {
+ printf("Bad user name %s\n", optarg);
+ break;
+ }
+ uid = pw->pw_uid;
+ gid = pw->pw_gid;
+ break;
case 'v':
printf("klogd %s-%s\n", VERSION, PATCHLEVEL);
exit (1);
@@ -1044,6 +1057,11 @@
if (symbol_lookup) {
InitKsyms(symfile);
InitMsyms();
+ }
+
+ if (uid > 0) {
+ setgid(gid);
+ setuid(uid);
}
/* The main loop. */
diff -ru ./syslogd.c.orig ./syslogd.c
--- ./syslogd.c.orig Sun Jun 28 23:22:49 1998
+++ ./syslogd.c Tue Jun 23 15:07:01 1998
@@ -400,6 +400,7 @@
#include <arpa/nameser.h>
#include <arpa/inet.h>
#include <resolv.h>
+#include <pwd.h>
#include "pidfile.h"
#include "version.h"
@@ -700,9 +701,12 @@
char line[MAXLINE +1];
extern int optind;
extern char *optarg;
+ uid_t uid = 0;
+ gid_t gid;
+ struct passwd *pw;
chdir ("/");
- while ((ch = getopt(argc, argv, "dhf:l:m:np:rs:v")) != EOF)
+ while ((ch = getopt(argc, argv, "dhf:l:m:np:rs:u:v")) != EOF)
switch((char)ch) {
case 'd': /* debug */
Debug = 1;
@@ -741,6 +745,15 @@
}
StripDomains = crunch_list(optarg);
break;
+ case 'u': /* user */
+ pw = getpwnam(optarg);
+ if (!pw) {
+ printf("Bad user name %s\n", optarg);
+ break;
+ }
+ uid = pw->pw_uid;
+ gid = pw->pw_gid;
+ break;
case 'v':
printf("syslogd %s-%s\n", VERSION, PATCHLEVEL);
exit (0);
@@ -865,6 +878,11 @@
{
dprintf("Debugging disabled, SIGUSR1 to turn on debugging.\n");
debugging_on = 0;
+ }
+
+ if (uid > 0) {
+ setgid(gid);
+ setuid(uid);
}
/* Main loop begins here. */
--- Begin /etc/init.d/sysklogd (modified conffile)
test -f /sbin/klogd || exit 0
test -f /sbin/syslogd || exit 0
SYSLOGD="-u syslogd"
KLOGD="-u syslogd"
case "$1" in
start)
echo -n "Starting system log daemon: syslogd"
start-stop-daemon --start --quiet --exec /sbin/syslogd -- $SYSLOGD
echo -n " klogd"
start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD
echo "."
;;
stop)
echo -n "Stopping system log daemon: klogd"
start-stop-daemon --stop --quiet --pidfile /var/run/klogd.pid
echo -n " syslogd"
start-stop-daemon --stop --quiet --pidfile /var/run/syslogd.pid
echo "."
;;
reload|force-reload)
start-stop-daemon --stop --quiet --signal 1 --pidfile /var/run/syslogd.pid
;;
restart)
echo -n "Stopping system log daemon: klogd"
start-stop-daemon --stop --quiet --pidfile /var/run/klogd.pid
echo " syslogd"
start-stop-daemon --stop --quiet --pidfile /var/run/syslogd.pid
sleep 1
echo -n "Starting system log daemon: syslogd"
start-stop-daemon --start --quiet --exec /sbin/syslogd -- $SYSLOGD
echo -n " klogd"
start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD
echo "."
;;
*)
echo "Usage: /etc/init.d/sysklogd {start|stop|reload|restart|force-reload}"
exit 1
esac
exit 0
--- End /etc/init.d/sysklogd
--- Begin /etc/cron.daily/sysklogd (modified conffile)
cd /var/log
for LOG in `syslogd-listfiles`
do
if [ -f $LOG ]; then
savelog -g adm -m 640 -u syslogd -c 7 $LOG >/dev/null
fi
done
for LOG in `syslogd-listfiles --auth`
do
if [ -f $LOG ]; then
chown syslogd.adm $LOG
chmod o-rwx $LOG
fi
done
/etc/init.d/sysklogd reload
--- End /etc/cron.daily/sysklogd
--- Begin /etc/cron.weekly/sysklogd (modified conffile)
cd /var/log
for LOG in `syslogd-listfiles --weekly`
do
if [ -f $LOG ]; then
savelog -g adm -m 640 -u syslogd -c 4 $LOG >/dev/null
fi
done
for LOG in `syslogd-listfiles --auth`
do
if [ -f $LOG ]; then
chown syslogd.adm $LOG
chmod o-rwx $LOG
fi
done
/etc/init.d/sysklogd reload
--- End /etc/cron.weekly/sysklogd
--- End Message ---
--- Begin Message ---
Source: sysklogd
Source-Version: 1.5-6.1
We believe that the bug you reported is fixed in the latest version of
sysklogd, which is due to be installed in the Debian FTP archive:
klogd_1.5-6.1_amd64.deb
to main/s/sysklogd/klogd_1.5-6.1_amd64.deb
sysklogd_1.5-6.1.diff.gz
to main/s/sysklogd/sysklogd_1.5-6.1.diff.gz
sysklogd_1.5-6.1.dsc
to main/s/sysklogd/sysklogd_1.5-6.1.dsc
sysklogd_1.5-6.1_amd64.deb
to main/s/sysklogd/sysklogd_1.5-6.1_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Matt Zimmerman <[email protected]> (supplier of updated sysklogd package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Thu, 14 Apr 2011 06:52:27 -0400
Source: sysklogd
Binary: sysklogd klogd
Architecture: source amd64
Version: 1.5-6.1
Distribution: unstable
Urgency: low
Maintainer: Martin Schulze <[email protected]>
Changed-By: Matt Zimmerman <[email protected]>
Description:
klogd - Kernel Logging Daemon
sysklogd - System Logging Daemon
Closes: 35325
Changes:
sysklogd (1.5-6.1) unstable; urgency=low
.
* Non-maintainer upload.
* Merge Ubuntu patch to enable klogd and syslogd to run as non-root users
(Closes: Bug#35325)
- debian/control: add dependency on adduser
- debian/postrm.klogd, postinst.klogd: handle addition/removal of klogd
user
- debian/rc.klogd, default.klogd: run klogd as user klogd
- klogd.c, debian/rules, Makefile, klogd.8: specify location of klogd pid
file
.
- syslogd.c, syslogd.8: add -u <user> option
- debian/cron.daily, cron.weekly, rc: run syslogd as user syslogd
Checksums-Sha1:
c1440b957f979f513dc8419cd2a768638f08795b 947 sysklogd_1.5-6.1.dsc
fd9b7ef4c69f17fea711b3e9241cec82e73f6a9a 30266 sysklogd_1.5-6.1.diff.gz
2ce89f5d46c11d034989cdb1d612f5f528c90caa 65246 sysklogd_1.5-6.1_amd64.deb
e9e0791b39b6065e78eb0264ac5a145d326f7b98 45352 klogd_1.5-6.1_amd64.deb
Checksums-Sha256:
2d2467e3ea111b8f3173684a0fb9758fbcc943a6d1e8fbd8a623c99f39849682 947
sysklogd_1.5-6.1.dsc
232320db4d25ccbd0bac1a7c23c228eed9032691837d51b4d7a7695bd69e4338 30266
sysklogd_1.5-6.1.diff.gz
1afacc74f61fe63b54dd5293d98888374fa1769a1b79efa79d1b100ba23d51ea 65246
sysklogd_1.5-6.1_amd64.deb
41f2b6f58b1a5e1850d4eb875ea7a3e032f83397a47f7309c91500486cd7aed0 45352
klogd_1.5-6.1_amd64.deb
Files:
d4eb5600bd17066d824128766d00d691 947 admin extra sysklogd_1.5-6.1.dsc
c7d191ba5af9b24bc004dc9d37b44ef9 30266 admin extra sysklogd_1.5-6.1.diff.gz
55abaa940aa2a3e1bcb0d3b783340229 65246 admin extra sysklogd_1.5-6.1_amd64.deb
9dcd37262845fb81ca81fe3fdef9e29f 45352 admin extra klogd_1.5-6.1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iD8DBQFNs9qf1cqbBPLEI7wRAiePAKCWZCzryXQpGPKQQcvF8+vWEOZzVACgkTUo
1D/M/ghDrtJ6bw1/4kjAItQ=
=qKOu
-----END PGP SIGNATURE-----
--- End Message ---
