Bug 157046 - Stunnel pid file should be created by root *not* by stunnel user
Summary: Stunnel pid file should be created by root *not* by stunnel user
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: stunnel
Version: 4.0
Hardware: ia64
OS: Linux
medium
low
Target Milestone: ---
: ---
Assignee: Miloslav Trmač
QA Contact: Brian Brock
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-05-06 12:50 UTC by David Tonhofer
Modified: 2007-11-30 22:07 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2005-06-01 11:45:23 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description David Tonhofer 2005-05-06 12:50:47 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

Description of problem:
The stunnel pid file, when created, is owned by the stunnel user (in my
case stunnel.stunnel). This means stunnel creates the pid file *after* it
has dropped its root privileges. Consequently, the pid file cannot be created
in /var/run but must be created someplace that is accessible by the stunnel
user (in my case, /tmp).

This is an old, old problem (back from stunnel 3 and RH 7.3 or so) but
I wanted to write this up...



Version-Release number of selected component (if applicable):
stunnel-4.05-3

How reproducible:
Always

Steps to Reproduce:
1. Define pid file in /etc/stunnel/stunnel.conf as a file in /var/run
2. Start stunnel
3. Stunnel complains that it could not write the pid file
  

Actual Results:  Pid file cannot be created in /var/run

Expected Results:  Pid file should be created in /var/run

Additional info:

Comment 1 Miloslav Trmač 2005-06-01 11:45:23 UTC
Thanks for your report.

The stunnel user should also be able to remove the pid file when stunnel
is exiting (long after it has dropped its privileges), so the pid file
should to be in a directory writable by the stunnel user anyway.

Comment 2 David Tonhofer 2005-06-01 16:45:42 UTC
Hmmm...you may be right. OTOH, "rpc.statd" for example
creates a PID file owned by "rpcuser.rpcuser" in /var/run.

But then again, stunnel server might be run by any ordinary
user who wants to have a tunneling setup. So out of pure
symmetry considerations, I agree that the stunnel.pid should
be owned by the user running it. 


Note You need to log in before you can comment on or make changes to this bug.