Bug 157046 - Stunnel pid file should be created by root *not* by stunnel user
Stunnel pid file should be created by root *not* by stunnel user
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: stunnel (Show other bugs)
ia64 Linux
medium Severity low
: ---
: ---
Assigned To: Miloslav Trmač
Brian Brock
Depends On:
  Show dependency treegraph
Reported: 2005-05-06 08:50 EDT by David Tonhofer
Modified: 2007-11-30 17:07 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-06-01 07:45:23 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description David Tonhofer 2005-05-06 08:50:47 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

Description of problem:
The stunnel pid file, when created, is owned by the stunnel user (in my
case stunnel.stunnel). This means stunnel creates the pid file *after* it
has dropped its root privileges. Consequently, the pid file cannot be created
in /var/run but must be created someplace that is accessible by the stunnel
user (in my case, /tmp).

This is an old, old problem (back from stunnel 3 and RH 7.3 or so) but
I wanted to write this up...

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Define pid file in /etc/stunnel/stunnel.conf as a file in /var/run
2. Start stunnel
3. Stunnel complains that it could not write the pid file

Actual Results:  Pid file cannot be created in /var/run

Expected Results:  Pid file should be created in /var/run

Additional info:
Comment 1 Miloslav Trmač 2005-06-01 07:45:23 EDT
Thanks for your report.

The stunnel user should also be able to remove the pid file when stunnel
is exiting (long after it has dropped its privileges), so the pid file
should to be in a directory writable by the stunnel user anyway.
Comment 2 David Tonhofer 2005-06-01 12:45:42 EDT
Hmmm...you may be right. OTOH, "rpc.statd" for example
creates a PID file owned by "rpcuser.rpcuser" in /var/run.

But then again, stunnel server might be run by any ordinary
user who wants to have a tunneling setup. So out of pure
symmetry considerations, I agree that the stunnel.pid should
be owned by the user running it. 

Note You need to log in before you can comment on or make changes to this bug.