Red Hat Bugzilla – Bug 134588
Change from using su to runuser in initscripts
Last modified: 2013-07-02 23:02:27 EDT
We have created a newversion of the su command called runuser, which will run a program as a different user. The command can only be run as root and will not use pam or prompt for passwords. Otherwize it works exactly as su. This change is needed by SELinux in order to support proper transitioning on process execution. Attached is a patch to the postgressql.init file to make the change.
Created attachment 104745 [details] Patch for changeing su to runuser
This seems mighty messy: instead of using the upstream-maintained init file, every Red Hat package will now have to roll its own, or at least resign ourselves to patching the upstream forevermore. Couldn't we fix things so that /etc/rc.d/init.d/functions aliases su to runuser, and then the init scripts would not need to be hacked individually?
Yes, it already is(will be). This is only for init scripts that are not using the daemon function in /etc/init.d/functions. Dan
Mph. daemon() isn't going to go over well either, so I guess I'm stuck. Will do. This is only for FC3 and beyond, right?
In hopes of not breaking the initscript for non-SELinux systems, I am thinking of if [ -x /bin/runuser ] then SU=runuser else SU=su fi then $SU -l postgres ... Do you have any objection to doing it that way?
runuser is not specific to SELinux. It is part of coreutils. You can do this if you think your app will be installed on a version of coreutils that does not include runuser. Runuser is going to be installed on /sbin/runuser also. This is for FC3/RHEL4 and beyond. Dan
Done in 7.4.5-3.