Red Hat Bugzilla – Bug 157046
Stunnel pid file should be created by root *not* by stunnel user
Last modified: 2007-11-30 17:07:17 EST
From Bugzilla Helper: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3 Description of problem: The stunnel pid file, when created, is owned by the stunnel user (in my case stunnel.stunnel). This means stunnel creates the pid file *after* it has dropped its root privileges. Consequently, the pid file cannot be created in /var/run but must be created someplace that is accessible by the stunnel user (in my case, /tmp). This is an old, old problem (back from stunnel 3 and RH 7.3 or so) but I wanted to write this up... Version-Release number of selected component (if applicable): stunnel-4.05-3 How reproducible: Always Steps to Reproduce: 1. Define pid file in /etc/stunnel/stunnel.conf as a file in /var/run 2. Start stunnel 3. Stunnel complains that it could not write the pid file Actual Results: Pid file cannot be created in /var/run Expected Results: Pid file should be created in /var/run Additional info:
Thanks for your report. The stunnel user should also be able to remove the pid file when stunnel is exiting (long after it has dropped its privileges), so the pid file should to be in a directory writable by the stunnel user anyway.
Hmmm...you may be right. OTOH, "rpc.statd" for example creates a PID file owned by "rpcuser.rpcuser" in /var/run. But then again, stunnel server might be run by any ordinary user who wants to have a tunneling setup. So out of pure symmetry considerations, I agree that the stunnel.pid should be owned by the user running it.