Attachment 294118 Details for Bug 431276 – create pid files in /var/run, start ipa_webgui as root and drop privs

[patch] create pid files in /var/run, start ipa_webgui as root and drop privs

freeipa-633-pid.patch (text/plain), 3.28 KB, created by Rob Crittenden on 2008-02-06 16:03:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Crittenden

Created: 2008-02-06 16:03:49 UTC

Size: 3.28 KB

patch

obsolete

># HG changeset patch
># User Rob Crittenden <rcritten@redhat.com>
># Date 1202313725 18000
># Node ID 499ecc88f88a8209b729ba4545dda577992d22a7
># Parent  3b41b5ac44e43e42e218230ef8983228bb1d62eb
>Create /var/run/<process>.pid to play nicers with the start scripts
>Need to start ipa_webgui as root and drop privs in order to write in /var/run
>
>diff -r 3b41b5ac44e4 -r 499ecc88f88a ipa-server/ipa-gui/ipa_webgui
>--- a/ipa-server/ipa-gui/ipa_webgui	Wed Feb 06 09:05:47 2008 -0500
>+++ b/ipa-server/ipa-gui/ipa_webgui	Wed Feb 06 11:02:05 2008 -0500
>@@ -17,7 +17,7 @@
> # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
> #
> 
>-import os, sys
>+import os, sys, pwd, grp
> from optparse import OptionParser
> import ipa.config
> import traceback
>@@ -119,6 +119,27 @@ def main():
>             sys.stderr.write("error becoming daemon: " + str(e))
>             sys.exit(1)
> 
>+    # Drop privileges and write our pid file only if we're running as root
>+    if os.getuid() == 0:
>+        # Write out our pid file
>+        pidfile = open("/var/run/ipa_webgui.pid", "w")
>+        pidfile.write(str(os.getpid()))
>+        pidfile.close()
>+
>+        # Drop privs
>+        apache_uid = pwd.getpwnam("apache")[2]
>+        apache_gid = grp.getgrnam("apache")[2]
>+
>+        try:
>+            os.setgid(apache_gid)
>+        except OSError, e:
>+            log.error("Could not set effective group id: %s" % e)
>+
>+        try:
>+            os.setuid(apache_uid)
>+        except OSError, e:
>+            log.error("Could not set effective user id: %s" % e)
>+
>     sys.path.append("/usr/share/ipa")
> 
>     # this must be after sys.path is changed to work correctly
>diff -r 3b41b5ac44e4 -r 499ecc88f88a ipa-server/ipa-gui/ipa_webgui.init
>--- a/ipa-server/ipa-gui/ipa_webgui.init	Wed Feb 06 09:05:47 2008 -0500
>+++ b/ipa-server/ipa-gui/ipa_webgui.init	Wed Feb 06 11:02:05 2008 -0500
>@@ -30,7 +30,7 @@ RUNAS="apache"
> 
> start() {
> 	echo -n $"Starting $NAME: "
>-	daemon --user $RUNAS $PROG
>+	daemon $PROG
> 	RETVAL=$?
> 	echo
> 	[ $RETVAL -eq 0 ] && touch /var/lock/subsys/ipa_webgui || \
>diff -r 3b41b5ac44e4 -r 499ecc88f88a ipa-server/ipa-kpasswd/ipa_kpasswd.c
>--- a/ipa-server/ipa-kpasswd/ipa_kpasswd.c	Wed Feb 06 09:05:47 2008 -0500
>+++ b/ipa-server/ipa-kpasswd/ipa_kpasswd.c	Wed Feb 06 11:02:05 2008 -0500
>@@ -1110,7 +1110,7 @@ int main(int argc, char *argv[])
> 	/* do not keep any fs busy */
> 	ret = chdir("/");
> 	if (ret == -1) {
>-		syslog(LOG_ERR, "Unable to chage dir to '/'");
>+		syslog(LOG_ERR, "Unable to change dir to '/'");
> 		exit(-1);
> 	}
> 
>@@ -1126,8 +1126,8 @@ int main(int argc, char *argv[])
> 
> 	/* new session */
> 	setsid();
>+
> 	/* close std* descriptors */
>-
> 	close(0);
> 	close(1);
> 	close(2);
>@@ -1142,7 +1142,7 @@ int main(int argc, char *argv[])
> 		exit(0);
> 	}
> 
>-	/* source evn vars */
>+	/* source env vars */
> 	env = getenv("KRB5_KTNAME");
> 	if (!env) {
> 		env = DEFAULT_KEYTAB;
>@@ -1165,6 +1165,16 @@ int main(int argc, char *argv[])
> 	if (ret) {
> 		syslog(LOG_ERR, "getaddrinfo failed: %s", gai_strerror(ret));
> 		exit(1);
>+	}
>+
>+	/* Write out the pid file after the sigterm handler */
>+	FILE *f = fopen("/var/run/ipa_kpasswd.pid", "w");
>+	if (f == NULL) {
>+		syslog(LOG_ERR,"Couldn't create pid file /var/run/ipa_kpasswd.pid: %s", strerror(errno));
>+		exit(1);
>+	} else {
>+		fprintf(f, "%ld\n", (long) getpid());
>+		fclose(f);
> 	}
> 
> 	tai = ai;

Actions: View | Diff

Attachments on bug 431276: 294118