From owner-freebsd-java@FreeBSD.ORG Fri Jul 29 13:28:53 2005 Return-Path: X-Original-To: freebsd-java@freebsd.org Delivered-To: freebsd-java@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8EBAB16A41F for ; Fri, 29 Jul 2005 13:28:53 +0000 (GMT) (envelope-from herve.quiroz@esil.univ-mrs.fr) Received: from arabica.esil.univ-mrs.fr (arabica.esil.univ-mrs.fr [139.124.41.108]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3B6E243D48 for ; Fri, 29 Jul 2005 13:28:50 +0000 (GMT) (envelope-from herve.quiroz@esil.univ-mrs.fr) Received: from arabica.esil.univ-mrs.fr (localhost [127.0.0.1]) by arabica.esil.univ-mrs.fr (8.13.3/8.13.3) with ESMTP id j6TDSn7B008894 for ; Fri, 29 Jul 2005 15:28:49 +0200 (CEST) (envelope-from herve.quiroz@esil.univ-mrs.fr) Received: (from rv@localhost) by arabica.esil.univ-mrs.fr (8.13.3/8.13.3/Submit) id j6TDSmin008885 for freebsd-java@freebsd.org; Fri, 29 Jul 2005 15:28:48 +0200 (CEST) (envelope-from herve.quiroz@esil.univ-mrs.fr) X-Authentication-Warning: arabica.esil.univ-mrs.fr: rv set sender to herve.quiroz@esil.univ-mrs.fr using -f Date: Fri, 29 Jul 2005 15:28:48 +0200 From: Herve Quiroz To: freebsd-java@freebsd.org Message-ID: <20050729132848.GA96141@arabica.esil.univ-mrs.fr> Mail-Followup-To: freebsd-java@freebsd.org References: <88B5DDE8C1A06741B754B910DE2DEFBB49AA2A@HERMES.swistgroup.com> <20050725212138.GA13849@arabica.esil.univ-mrs.fr> <20050726192511.GD56293@osiris.chen.org.nz> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050726192511.GD56293@osiris.chen.org.nz> User-Agent: Mutt/1.4.2.1i Subject: Re: Tomcat 5.5 --- tomcat55ctl --- increase max vm heap space ? X-BeenThere: freebsd-java@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Porting Java to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2005 13:28:53 -0000 Hi Jonathan, On Wed, Jul 27, 2005 at 07:25:11AM +1200, Jonathan Chen wrote: > On Mon, Jul 25, 2005 at 11:21:38PM +0200, Herve Quiroz wrote: > The major reason why Ernst introduced the daemonctl program was so that > tomcat/jboss wouldn't be running as root. Having it run as root > introduces the possibility of a root-hack via tomcat/jboss. If you can > make it easily run under the `www' pseudo user that would be cool. > > The secondary purpose of the daemonctl program was convenience > related: you don't have to be root to start the service, just a > member of `www'. Dunno if you can easily replicate this with a shell > script though. Actually, the logic which allows to run the service as user 'www' is implemented in the rc script, not in daemonctl. Moreover, as reported in PR 83434 [1], there are already permission issues with Tomcat ports. The executables should indeed belong to root:wheel whereas data files and dirs should belong to www:www and be 664/775. Hence, any user from the 'www' group would be able to run Tomcat but not to modify Tomcat core itself (as it is now). After a deeper look at daemonctl.c, it appears that the most logic in it is about PID storing/retrieving, arguments validating, and other features that rcNG just happens do provide to any service daemon. So IMHO, the only real problem we have with the rcNG/catalina.sh approach lies in what Panagiotis just mentioned, that is the ability to open port 80 for instance. Anyway, if we actually ensure that Tomcat is run as 'www' and not as 'root', even daemonctl will not be able to use port 80. This leaves us with the following choice: should we enforce strong security (i.e. PR 83434) and use ${name}_user from rcNG or should we allow the daemon to open port 80 (running the daemon as superuser)? I definitively believe we should go for security first. User can just set tomcat55_user=root when then need to. Either way, I don't see any more reason to use daemonctl.c, unless I missed (or misunderstood) some point here. The ports freeze is due to 1st of August, which leaves us with no much time to implement the chosen approach. IMHO, such change right before a release is no good anyway. OTOH, I think we should settle this issue once and for all so that I may commit the changes right when the freeze is over. Herve [1] http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/83434