Date: Tue, 9 May 2023 08:11:04 +0000 From: Brooks Davis <brooks@freebsd.org> To: Felix Palmen <zirias@freebsd.org> Cc: ports@freebsd.org Subject: Re: Unprivileged default user for "tiny" daemons? Message-ID: <ZFoAGH3aIMRuPQUE@spindle.one-eyed-alien.net> In-Reply-To: <axmocd4atpwa6gckwlr6d3xwx3vduhgyzkywv6sbawtmssbgi6@o7dzq6knd4nr> References: <hsletitqldfbhrucakzl3vvotkwp7ghfdpuzyty3b4yu3qdn4d@sdjyu6koet2t> <axmocd4atpwa6gckwlr6d3xwx3vduhgyzkywv6sbawtmssbgi6@o7dzq6knd4nr>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, May 09, 2023 at 10:05:15AM +0200, Felix Palmen wrote:
> * Felix Palmen <zirias@FreeBSD.org> [20230508 18:39]:
> > I tend to think now that 'daemon' should really be the way to go when
> > you don't need a dedicated account. Am I overlooking something? Any
> > other comments?
>=20
> Seems I overlooked something indeed:
>=20
> #v+
> $ find [14-jail] \( -user daemon -or -group daemon \)
> [14-jail]/usr/sbin/lpc
> [14-jail]/usr/bin/lprm
> [14-jail]/usr/bin/lpr
> [14-jail]/usr/bin/lpq
> [14-jail]/var/rwho
> [14-jail]/var/spool/mqueue
> [14-jail]/var/spool/lpd
> [14-jail]/var/spool/output
> [14-jail]/var/spool/output/lpd
> [14-jail]/var/spool/opielocks
> [14-jail]/var/at/jobs
> [14-jail]/var/at/spool
> [14-jail]/var/msgs
> #v-
>=20
> So, daemon owns e.g. the print spool...
>=20
> Interestingly, ou even find something owned by nobody in base:
>=20
> #v+
> -rw-r--r-- 1 nobody wheel 0 Jul 8 2021 /var/db/locate.database
> #v-
This seems like a bug.
>=20
> So, takeaway is: There is no safe choice other than allocating a
> dedicated UID for every single daemon, even if it doesn't need to
> own/access any files? Is this really correct?
This is clearly the right choice even it's a bit of a pain.
-- Brooks
>=20
> Cheers, Felix
>=20
> --=20
> Felix Palmen <zirias@FreeBSD.org> {private} felix@palmen-it.de
> -- ports committer (mentee) -- {web} http://palmen-it.de
> {pgp public key} http://palmen-it.de/pub.txt
> {pgp fingerprint} 6936 13D5 5BBF 4837 B212 3ACC 54AD E006 9879 F231
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?ZFoAGH3aIMRuPQUE>