Bug 728685

Summary: fedora configuration of leafnode runs fetchnews as root
Product: [Fedora] Fedora Reporter: moabi2000
Component: leafnodeAssignee: Matěj Cepl <mcepl>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: kevin, mcepl, mcepl
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-12-15 18:04:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description moabi2000 2011-08-06 11:44:19 UTC
Description of problem:

For security, the leafnode-recommended setup has the various programmes run as user 'news'. The setup produced by the Fedora rpm has leafnode run as user news, but the programme fetchnews runs as root.

See /etc/crond.d/leafnode for cron job that runs fetchnews as root.

Trying to run fetchnews as user news fails with the error "/USR/SBIN/CROND[8135]: (CRON) ERROR chdir failed (/etc/news): No such file or directory"



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Kevin Fenzi 2011-08-06 18:01:17 UTC
That homedir for the news user I think was setup to match up with the inn package long ago. 
(Ie, if you have both leafnode and inn installed the news user should work ok for inn as well). 

If you change the news user's homedir to say '/tmp' does that cause it to work?

Comment 2 Fedora End Of Life 2012-08-07 19:55:03 UTC
This message is a notice that Fedora 15 is now at end of life. Fedora
has stopped maintaining and issuing updates for Fedora 15. It is
Fedora's policy to close all bug reports from releases that are no
longer maintained. At this time, all open bugs with a Fedora 'version'
of '15' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that
we were unable to fix it before Fedora 15 reached end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora, you are encouraged to click on
"Clone This Bug" (top right of this page) and open it against that
version of Fedora.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

The process we are following is described here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 3 Matěj Cepl 2012-11-08 15:59:22 UTC
This has not been fixed yet, /usr/sbin/fetchnews is still run as root. Moreover, the package adds a cron tidbit to /etc/cron.d ... wouldn't it better to add this shell script to /etc/cron.hourly/ ?


#!/bin/sh
sudo -u news /usr/sbin/fetchnews

Comment 4 Matěj Cepl 2012-11-09 06:11:59 UTC
(In reply to comment #3)
> #!/bin/sh
> sudo -u news /usr/sbin/fetchnews

Actually the working script is

#!/bin/sh

su news -s /bin/sh -c /usr/sbin/fetchnews

Maybe just changing the cron tidbit to

01 * * * * news /usr/sbin/fetchnews

would be an alternative.

Comment 5 Kevin Fenzi 2012-11-09 16:39:34 UTC
I actually don't use leafnode here anymore... would you like to take over maintaining it? :) 

Or at least would you care to just apply your changes? 

If not, I'll try and get to it...

Comment 6 Matěj Cepl 2012-11-09 19:51:18 UTC
(In reply to comment #5)
> Or at least would you care to just apply your changes? 

I am a provenpackager, so I suppose I could just play with leafnode packaging a little bit.

Comment 7 Fedora Update System 2012-11-27 14:24:12 UTC
leafnode-1.11.8-9.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/leafnode-1.11.8-9.fc17

Comment 8 Fedora Update System 2012-11-27 14:24:51 UTC
leafnode-1.11.8-9.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/leafnode-1.11.8-9.fc18

Comment 9 Fedora Update System 2012-11-28 02:05:02 UTC
Package leafnode-1.11.8-9.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing leafnode-1.11.8-9.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-19136/leafnode-1.11.8-9.fc18
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2012-12-15 18:04:36 UTC
leafnode-1.11.8-9.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2013-01-12 01:21:54 UTC
leafnode-1.11.8-9.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.