Re: regression in logger output to syslog

[Karel Zak <kzak@redhat.com>]

On Thu, Oct 29, 2015 at 03:36:16PM +0100, Lennart Poettering wrote:
> On Thu, 29.10.15 15:20, Olaf Hering (olaf@aepfle.de) wrote:
> > +                   && geteuid() == 0 && kill(ctl->pid, 0) == 0) {
> > 
> > For me its required to run logger as non-root and still get the
> > specified number, like it used to do it years ago.
> 
> Sorry, but this is something we are unlikely to support in
> systemd. Allowing unprivileged processes to fake arbitrary UIDs is
> a security problem, and it's really nothing we should provide support
> for.

I think the problem is how Olaf see the log (e.g. by journal -f),
because journal contains *both* (fake and real) PIDs:

as non-root:

 $ echo $PPID
 1550

 $ logger -p info --id=$PPID "This is message baby!"


in the log:

 # journalctl -n 1
 Oct 29 16:23:26 ws kzak[30917]: This is message baby!


 # journalctl --output json-pretty -n 1
 {
        "__CURSOR" : "s=bbb763e3c9a144809dfe81e768d5a062;i=272c4;b=4f6802931e38450fa2bfd5f549f5103d;m=2c1ada2db1;t=5233fe472ce01;x=aaadb4455972d31",
        "__REALTIME_TIMESTAMP" : "1446132206194177",
        "__MONOTONIC_TIMESTAMP" : "189429067185",
        "_BOOT_ID" : "4f6802931e38450fa2bfd5f549f5103d",
        "PRIORITY" : "6",
        "_UID" : "1000",
        "_GID" : "1000",
        "_MACHINE_ID" : "160952cecfb7413db963a880ce10c399",
        "_HOSTNAME" : "ws",
        "_TRANSPORT" : "syslog",
        "SYSLOG_FACILITY" : "1",
        "SYSLOG_IDENTIFIER" : "kzak",
        "_COMM" : "logger",
        "SYSLOG_PID" : "1550",
        "MESSAGE" : "This is message baby!",
        "_PID" : "30917",
        "_SOURCE_REALTIME_TIMESTAMP" : "1446132206193526"
 }


_PID is the real PID, SYSLOG_PID is what has been specified by --id on
logger command line.

    Karel

-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com