Re: start of patch to dpkg's start-stop-daemon

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Fri, May 21, 2004 at 03:33:37AM +1000, Russell Coker wrote:
> On Fri, 21 May 2004 02:23, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > > > it's a patch to dpkg 1.10.21's utils/start-stop-daemon.c
> > > > which causes a context switch just before
> > > > the setuid/setgid calls.
> > >
> > > What is the benefit in that?
> >
> >  it's easier than breaking pre-existing /etc/init.d/* scripts where
> >  people expect the -u option to act as it should?
> 
> How is it broken?  initrc_t has setuid and setgid capabilities so SE Linux 
> does not stop the regular function of start-stop-daemon.
 
 ..o*??  ah, cool, that's very smart, i wasn't expecting that.

 i learn something new every day :)

> >  in other words, the benefit in patching start-stop-daemon is to
> >  provide legacy transition support.
> 
> My systems have been working fine with a non-patched start-stop-daemon for two 
> years.  When I first started working on SE Linux I had a similar idea to 
> avoid the use of run_init, that turned out to be a bad idea and I've been 
> using the regular start-stop-daemon since then.
> 
> >  i _really_ don't want the -u option on my custom /etc/init.d/custom
> >  script to suddenly start running the daemon as root.
> 
> Why not?
 
 ignore all the rest of my comments: they were based on the assumption
 that initrc_t would not allow setuid or setgid.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.