Bug 703426

Description of problem:

While I'm just improving our FhGFS init scripts, I also checked what your functions in /etc/rc.d/init.d/functions are doing if the pid is provided. And in fact it seems, those RedHat functions are rather broken when it comes to possible stale pids in /var/run.
Given by the default max pid limit of 32768, running into stale pids might easily happen.

Please look into your /etc/rc.d/init.d/functions:

__pids_var_run() {
        local base=${1##*/}
        local pid_file=${2:-/var/run/$base.pid}

        pid=
        if [ -f "$pid_file" ] ; then
                local line p
                read line < "$pid_file"
                for p in $line ; do
                        [ -z "${p//[0-9]/}" -a -d "/proc/$p" ] && pid="$pid $p"
                done
                if [ -n "$pid" ]; then
                        return 0
                fi
                return 1 # "Program is dead and /var/run pid file exists"
        fi
        return 3 # "Program is not running"
}


As you can see, it does not check if $base matches the name in /proc/$pid/

(as for example given by /proc/$pid/{exe,stat,status}).


Now in killproc():

        __pids_var_run "$1" "$pid_file"
        if [ -z "$pid_file" -a -z "$pid" ]; then
                pid="$(__pids_pidof "$1")"
        fi

So if  __pids_var_run() finds a pid in /var/run/$PIDFILE and sees that pid is in use, killproc will happily use that pid without even further checking if this pid really belongs to the right daemon! But as I said before, it might easily happen another process takes that PID and then this process would be killed!

The same applies to daemon() and status(), daemon() would not continue to start the daemon if there is a stale pid file and another process has taken that pid and status() would simply return "ok" for a non-running pid.


Version-Release number of selected component (if applicable):

5.6

How reproducible:

1) start a $daemon and let it write to /var/pid/some_pid_file

2) kill -9 $daemon

3) start other threads (just something so that many PIDs are taken, e.g. compilization or NFSD with thousands of threads). Do that until something is running with the same PID as in 1) (/var/pid/some_pid_file)

4) Run status/start/stop of our daemon, the scripts will do the wrong action.