Red Hat Bugzilla – Bug 157046
Stunnel pid file should be created by root *not* by stunnel user
Last modified: 2007-11-30 17:07:17 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3
Description of problem:
The stunnel pid file, when created, is owned by the stunnel user (in my
case stunnel.stunnel). This means stunnel creates the pid file *after* it
has dropped its root privileges. Consequently, the pid file cannot be created
in /var/run but must be created someplace that is accessible by the stunnel
user (in my case, /tmp).
This is an old, old problem (back from stunnel 3 and RH 7.3 or so) but
I wanted to write this up...
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Define pid file in /etc/stunnel/stunnel.conf as a file in /var/run
2. Start stunnel
3. Stunnel complains that it could not write the pid file
Actual Results: Pid file cannot be created in /var/run
Expected Results: Pid file should be created in /var/run
Thanks for your report.
The stunnel user should also be able to remove the pid file when stunnel
is exiting (long after it has dropped its privileges), so the pid file
should to be in a directory writable by the stunnel user anyway.
Hmmm...you may be right. OTOH, "rpc.statd" for example
creates a PID file owned by "rpcuser.rpcuser" in /var/run.
But then again, stunnel server might be run by any ordinary
user who wants to have a tunneling setup. So out of pure
symmetry considerations, I agree that the stunnel.pid should
be owned by the user running it.