From owner-freebsd-security Thu Feb 17 18:58: 7 2000 Delivered-To: freebsd-security@freebsd.org Received: from cc942873-a.ewndsr1.nj.home.com (cc942873-a.ewndsr1.nj.home.com [24.2.89.207]) by hub.freebsd.org (Postfix) with ESMTP id D0AFA37B913 for ; Thu, 17 Feb 2000 18:58:03 -0800 (PST) (envelope-from cjc@cc942873-a.ewndsr1.nj.home.com) Received: (from cjc@localhost) by cc942873-a.ewndsr1.nj.home.com (8.9.3/8.9.3) id WAA53700; Thu, 17 Feb 2000 22:02:32 -0500 (EST) (envelope-from cjc) Date: Thu, 17 Feb 2000 22:02:32 -0500 From: "Crist J. Clark" To: Brad Guillory Cc: freebsd-security@FreeBSD.ORG Subject: Re: Nonpriveleged daemons and pid files Message-ID: <20000217220232.A53575@cc942873-a.ewndsr1.nj.home.com> Reply-To: cjclark@home.com References: <00021720524101.23691@newbee.web2000.ru> <20000217122140.D11118@baileylink.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: <20000217122140.D11118@baileylink.net>; from round@baileylink.net on Thu, Feb 17, 2000 at 12:21:40PM -0600 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Thu, Feb 17, 2000 at 12:21:40PM -0600, Brad Guillory wrote: > Write a startup script for the application that "touch"es the pid > file then "chown"s it to the appriopriate user. Or make a daemon > group and put all the daemons in it, then chgrp the /var/run directory > to daemon group and chmod it to 775. (Sorry neither are tested.) ^^^ Don't you mean, 1775? That prevents a compromised daemon from removing a file and putting a new, dangerous one in its place, but it does open up the potential for a DOS if a compromised daemon takes up filenames before the others can use them. Having root touch and chown files at startup (with the directory still 755), seems the best option... Unless the daemons think that the existence of the file means they are already running and they refuse to start. =) > On Thu, Feb 17, 2000 at 08:47:26PM +0300, Andrey Novikov wrote: > > Hello, > > > > now more and more daemons can be run from non-priveleged > > account - BIND, MTAs, DBMS'es and so on, but it > > sometimes leads to two minor problems - either this daemon > > can't create pid file in /var/run or it can't update it on > > restart. What is the common way to overcome that problem - > > it's very convinient to store them in one place. > > > > Andrey Novikov > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > with "unsubscribe freebsd-security" in the body of the message > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message -- Crist J. Clark cjclark@home.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message