I struggled for quite some time to get opensips-cli working on Ubuntu
20.04 LTS.
It seems that there are now some security protections within the Linux
kernel (|fs.protected_fifos) |against users other then the original
creator from writing to fifo files in /tmp.
https://unix.stackexchange.com/questions/503111/group-permissions-for-root-not-working-in-tmp
<https://unix.stackexchange.com/questions/503111/group-permissions-for-root-not-working-in-tmp>
I eventually got opensips-cli working by moving the opensips_fifo into
/var/run/opensip/ instead of /tmp and then setting up an
opensips-cli.cnf file that pointed opensips-cli to the new fifo path.
I don't fully undertand the reasons for protecting fifos in this manner
but I'm guessing that the intent is to prevent something other then the
intended application from creating the fifo first and then snooping in
to any data sent by client applications. Although the risk for something
like opensips-cli is probably minimal, I can see how this may present a
security risk for other applications.
This calls into question whether it is sensible to continue creating the
opensips_fifo within /tmp by default? Perhaps, for future versions, the
default should be in a directory owned by the opensips user (rather than
one with the sticky bit set)?
_______________________________________________
Users mailing list
Users@lists.opensips.org
http://lists.opensips.org/cgi-bin/mailman/listinfo/users
