<strong>Report forwarded</strong> to <code>debian-bugs-dist@lists.debian.org, Martin Schulze &lt;joey@debian.org&gt;</code>:<br>
<code>Bug#35325</code>; Package <code>sysklogd</code>.


debian-bugs-dist@lists.debian.orgMartin Schulze <joey@debian.org>

Subject: Bug#35325: sysklogd: There should be a way to run sysklogd without root privileges
Reply-To: Thomas Roessler <roessler@sobolev.rhein.de>, 35325@bugs.debian.org
Resent-From: Thomas Roessler <roessler@sobolev.rhein.de>
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: Martin Schulze <joey@debian.org>
Resent-Date: Wed, 31 Mar 1999 08:18:04 GMT
Resent-Message-ID: <handler.35325.B.9228679518292@bugs.debian.org>
Resent-Sender: iwj@debian.org
X-Debian-PR-Message: report 35325
X-Debian-PR-Package: sysklogd
X-Debian-PR-Keywords: 
X-Loop: owner@bugs.debian.org
Received: via spool by bugs@bugs.debian.org id=B.9228679518292
          (code B ref -1); Wed, 31 Mar 1999 08:18:04 GMT
From: Thomas Roessler <roessler@sobolev.rhein.de>
To: submit@bugs.debian.org
X-Mailer: bug 3.1.7
Message-Id: <19990331081121.B0E6BF206@sobolev.rhein.de>
Date: Wed, 31 Mar 1999 10:11:21 +0200 (MEST)

Package: sysklogd
Version: 1.3-31

I'm too lazy to do this one myself now, so count it as a wishlist
item: syslogd should provide an easy way to run it without root
privileges.

The only actions which really require such privileges are binding to
the internet domain socket and creating the unix domain socket(s)
given on the command line.

These tasks can be done once and forever at a very early point in
syslogd's lifetime.  In particular, they can happen _before_ the
actual init() routine is called.

System log files (and /var/log) could be donated to a special log
user, so opening or writing them won't require any special
privileges.

tlr

-- System Information
Debian Release: 2.1
Kernel Version: Linux sobolev 2.0.36 #7 Wed Feb 10 01:26:04 MET 1999 i586 unknown

Versions of the packages sysklogd depends on:
ii  libc6           2.0.7.19981211 GNU C Library: shared libraries




<strong>Acknowledgement sent</strong> to <code>Thomas Roessler &lt;roessler@sobolev.rhein.de&gt;</code>:<br>
New bug report received and forwarded.  Copy sent to <code>Martin Schulze &lt;joey@debian.org&gt;</code>.


-t

From: owner@bugs.debian.org (Debian Bug Tracking System)
To: Thomas Roessler <roessler@sobolev.rhein.de>
Subject: Bug#35325: Acknowledgement (sysklogd: There should be a way to run sysklogd without root privileges)
Message-ID: <handler.35325.B.9228679518292.ack@bugs.debian.org>
In-Reply-To: <19990331081121.B0E6BF206@sobolev.rhein.de>
References: <19990331081121.B0E6BF206@sobolev.rhein.de>
X-Debian-PR-Message: ack 35325

Thank you for the problem report you have sent regarding Debian.
This is an automatically generated reply, to let you know your message has
been received.  It is being forwarded to the developers' mailing list for
their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 Martin Schulze <joey@debian.org>

If you wish to submit further information on your problem, please send
it to 35325@bugs.debian.org (and *not* to
bugs@bugs.debian.org).

Please do not reply to the address at the top of this message,
unless you wish to report a problem with the bug-tracking system.

Ian Jackson
(administrator, Debian bugs database)



Received: (at submit) by bugs.debian.org; 31 Mar 1999 08:12:31 +0000
Received: (qmail 8288 invoked from network); 31 Mar 1999 08:12:29 -0000
Received: from riemann.iam.uni-bonn.de (postfix@131.220.223.83)
  by master.debian.org with SMTP; 31 Mar 1999 08:12:29 -0000
Received: from sobolev.rhein.de (ascend-tk-p155.rhrz.uni-bonn.de [131.220.244.155])
	by riemann.iam.uni-bonn.de (Postfix) with ESMTP id 9181766B7
	for <submit@bugs.debian.org>; Wed, 31 Mar 1999 10:12:06 +0200 (MEST)
Received: by sobolev.rhein.de (Postfix, from userid 200)
	id B0E6BF206; Wed, 31 Mar 1999 10:11:21 +0200 (MEST)
From: Thomas Roessler <roessler@sobolev.rhein.de>
Subject: sysklogd: There should be a way to run sysklogd without root privileges
To: submit@bugs.debian.org
X-Mailer: bug 3.1.7
Message-Id: <19990331081121.B0E6BF206@sobolev.rhein.de>
Date: Wed, 31 Mar 1999 10:11:21 +0200 (MEST)

Package: sysklogd
Version: 1.3-31

I'm too lazy to do this one myself now, so count it as a wishlist
item: syslogd should provide an easy way to run it without root
privileges.

The only actions which really require such privileges are binding to
the internet domain socket and creating the unix domain socket(s)
given on the command line.

These tasks can be done once and forever at a very early point in
syslogd's lifetime.  In particular, they can happen _before_ the
actual init() routine is called.

System log files (and /var/log) could be donated to a special log
user, so opening or writing them won't require any special
privileges.

tlr

-- System Information
Debian Release: 2.1
Kernel Version: Linux sobolev 2.0.36 #7 Wed Feb 10 01:26:04 MET 1999 i586 unknown

Versions of the packages sysklogd depends on:
ii  libc6           2.0.7.19981211 GNU C Library: shared libraries




<strong>Information forwarded</strong> to <code>debian-bugs-dist@lists.debian.org, Martin Schulze &lt;joey@debian.org&gt;</code>:<br>
<code>Bug#35325</code>; Package <code>sysklogd</code>.


debian-bugs-dist@lists.debian.orgMartin Schulze <joey@debian.org>

Subject: Bug#35325: sysklogd: There should be a way to run sysklogd without root privileges
Reply-To: Martin Schulze <joey@infodrom.north.de>, 35325@bugs.debian.org
Resent-From: Martin Schulze <joey@finlandia.Infodrom.North.DE>
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: Martin Schulze <joey@debian.org>
Resent-Date: Wed, 07 Apr 1999 21:48:06 GMT
Resent-Message-ID: <handler.35325.B35325.92352161312567@bugs.debian.org>
Resent-Sender: iwj@debian.org
X-Debian-PR-Message: report 35325
X-Debian-PR-Package: sysklogd
X-Debian-PR-Keywords: 
X-Loop: owner@bugs.debian.org
Received: via spool by 35325-bugs@bugs.debian.org id=B35325.92352161312567
          (code B ref 35325); Wed, 07 Apr 1999 21:48:06 GMT
Date: Wed, 7 Apr 1999 23:46:46 +0200
From: Martin Schulze <joey@finlandia.Infodrom.North.DE>
To: Thomas Roessler <roessler@sobolev.rhein.de>, 35325@bugs.debian.org
Cc: control@bugs.debian.org
Message-ID: <19990407234646.J22111@finlandia.artis.uni-oldenburg.de>
References: <19990331081121.B0E6BF206@sobolev.rhein.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.95.4i
In-Reply-To: <19990331081121.B0E6BF206@sobolev.rhein.de>; from Thomas Roessler on Wed, Mar 31, 1999 at 10:11:21AM +0200

severity 35325 wishlist
thanks

Thomas Roessler wrote:
> Package: sysklogd
> Version: 1.3-31
> 
> I'm too lazy to do this one myself now, so count it as a wishlist
> item: syslogd should provide an easy way to run it without root
> privileges.

Just add

	Severity: wishlist

to the 2nd header netx time.

Topi Miet..something also tried to make syslogd run as different
user.  It might be possible, please check the BTS, there might
be a patch.

Regards,

	Joey

-- 
Beware of bugs in the above code; I have only proved it correct,
not tried it.  -- Donald E. Knuth

Please always Cc to me when replying to me on the lists.



<strong>Acknowledgement sent</strong> to <code>Martin Schulze &lt;joey@infodrom.north.de&gt;</code>:<br>
Extra info received and forwarded to list.  Copy sent to <code>Martin Schulze &lt;joey@debian.org&gt;</code>.


-t

From: owner@bugs.debian.org (Debian Bug Tracking System)
To: Martin Schulze <joey@infodrom.north.de>
Subject: Bug#35325: Info received (was Bug#35325: sysklogd: There should be a way to run sysklogd without root privileges)
Message-ID: <handler.35325.B35325.92352161312567.ackinfo@bugs.debian.org>
In-Reply-To: <19990407234646.J22111@finlandia.artis.uni-oldenburg.de>
References: <19990407234646.J22111@finlandia.artis.uni-oldenburg.de>
X-Debian-PR-Message: ack-info-maintonly 35325

Thank you for the additional information you have supplied regarding
this problem report.  It has been forwarded to the developer(s) and
to the developers' mailing list to accompany the original report.

Your message has been sent to the package maintainer(s):
 Martin Schulze <joey@debian.org>

If you wish to continue to submit further information on your problem,
please send it to 35325@bugs.debian.org, as before.

Please do not reply to the address at the top of this message,
unless you wish to report a problem with the bug-tracking system.

Ian Jackson
(administrator, Debian bugs database)



Received: (at 35325) by bugs.debian.org; 7 Apr 1999 21:46:53 +0000
Received: (qmail 12560 invoked from network); 7 Apr 1999 21:46:49 -0000
Received: from gimli.informatik.uni-oldenburg.de (134.106.1.10)
  by master.debian.org with SMTP; 7 Apr 1999 21:46:49 -0000
Received: from finlandia.Infodrom.North.DE ([134.106.121.3])
	by gimli.Informatik.Uni-Oldenburg.DE (Smail3.1.29.1)
	id <m10V09t-0003KWC>; Wed, 7 Apr 99 23:46 CES
Received: at Infodrom Oldenburg (/\##/\ Smail-3.2.0.102 1998-Aug-2 #2)
	by finlandia.Infodrom.North.DE
	via smail from stdin
	id <m10V09m-000alGC@finlandia.Infodrom.North.DE>
	for roessler@sobolev.rhein.de; Wed, 7 Apr 1999 23:46:46 +0200 (CEST) 
Date: Wed, 7 Apr 1999 23:46:46 +0200
From: Martin Schulze <joey@finlandia.Infodrom.North.DE>
To: Thomas Roessler <roessler@sobolev.rhein.de>, 35325@bugs.debian.org
Cc: control@bugs.debian.org
Subject: Re: Bug#35325: sysklogd: There should be a way to run sysklogd without root privileges
Message-ID: <19990407234646.J22111@finlandia.artis.uni-oldenburg.de>
Reply-To: Martin Schulze <joey@infodrom.north.de>
References: <19990331081121.B0E6BF206@sobolev.rhein.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.95.4i
In-Reply-To: <19990331081121.B0E6BF206@sobolev.rhein.de>; from Thomas Roessler on Wed, Mar 31, 1999 at 10:11:21AM +0200

severity 35325 wishlist
thanks

Thomas Roessler wrote:
> Package: sysklogd
> Version: 1.3-31
> 
> I'm too lazy to do this one myself now, so count it as a wishlist
> item: syslogd should provide an easy way to run it without root
> privileges.

Just add

	Severity: wishlist

to the 2nd header netx time.

Topi Miet..something also tried to make syslogd run as different
user.  It might be possible, please check the BTS, there might
be a patch.

Regards,

	Joey

-- 
Beware of bugs in the above code; I have only proved it correct,
not tried it.  -- Donald E. Knuth

Please always Cc to me when replying to me on the lists.



<strong>Severity set to `wishlist'.</strong>
Request was from <code>Martin Schulze &lt;joey@finlandia.Infodrom.North.DE&gt;</code>
to <code>control@bugs.debian.org</code>. 


Received: (at control) by bugs.debian.org; 7 Apr 1999 21:46:53 +0000
Received: (qmail 12560 invoked from network); 7 Apr 1999 21:46:49 -0000
Received: from gimli.informatik.uni-oldenburg.de (134.106.1.10)
  by master.debian.org with SMTP; 7 Apr 1999 21:46:49 -0000
Received: from finlandia.Infodrom.North.DE ([134.106.121.3])
	by gimli.Informatik.Uni-Oldenburg.DE (Smail3.1.29.1)
	id <m10V09t-0003KWC>; Wed, 7 Apr 99 23:46 CES
Received: at Infodrom Oldenburg (/\##/\ Smail-3.2.0.102 1998-Aug-2 #2)
	by finlandia.Infodrom.North.DE
	via smail from stdin
	id <m10V09m-000alGC@finlandia.Infodrom.North.DE>
	for roessler@sobolev.rhein.de; Wed, 7 Apr 1999 23:46:46 +0200 (CEST) 
Date: Wed, 7 Apr 1999 23:46:46 +0200
From: Martin Schulze <joey@finlandia.Infodrom.North.DE>
To: Thomas Roessler <roessler@sobolev.rhein.de>, 35325@bugs.debian.org
Cc: control@bugs.debian.org
Subject: Re: Bug#35325: sysklogd: There should be a way to run sysklogd without root privileges
Message-ID: <19990407234646.J22111@finlandia.artis.uni-oldenburg.de>
Reply-To: Martin Schulze <joey@infodrom.north.de>
References: <19990331081121.B0E6BF206@sobolev.rhein.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.95.4i
In-Reply-To: <19990331081121.B0E6BF206@sobolev.rhein.de>; from Thomas Roessler on Wed, Mar 31, 1999 at 10:11:21AM +0200

severity 35325 wishlist
thanks

Thomas Roessler wrote:
> Package: sysklogd
> Version: 1.3-31
> 
> I'm too lazy to do this one myself now, so count it as a wishlist
> item: syslogd should provide an easy way to run it without root
> privileges.

Just add

	Severity: wishlist

to the 2nd header netx time.

Topi Miet..something also tried to make syslogd run as different
user.  It might be possible, please check the BTS, there might
be a patch.

Regards,

	Joey

-- 
Beware of bugs in the above code; I have only proved it correct,
not tried it.  -- Donald E. Knuth

Please always Cc to me when replying to me on the lists.



<strong>Information forwarded</strong> to <code>debian-bugs-dist@lists.debian.org, Martin Schulze &lt;joey@debian.org&gt;</code>:<br>
<code>Bug#35325</code>; Package <code>sysklogd</code>.


debian-bugs-dist@lists.debian.orgMartin Schulze <joey@debian.org>

Subject: Bug#35325: sysklogd: There should be a way to run sysklogd without root privileges
Reply-To: Martin Schulze <joey@infodrom.north.de>, 35325@bugs.debian.org
Resent-From: Martin Schulze <joey@finlandia.Infodrom.North.DE>
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: Martin Schulze <joey@debian.org>
Resent-Date: Wed, 07 Apr 1999 22:03:05 GMT
Resent-Message-ID: <handler.35325.B35325.92352185613141@bugs.debian.org>
Resent-Sender: iwj@debian.org
X-Debian-PR-Message: report 35325
X-Debian-PR-Package: sysklogd
X-Debian-PR-Keywords: 
X-Loop: owner@bugs.debian.org
Received: via spool by 35325-bugs@bugs.debian.org id=B35325.92352185613141
          (code B ref 35325); Wed, 07 Apr 1999 22:03:05 GMT
Date: Wed, 7 Apr 1999 23:50:52 +0200
From: Martin Schulze <joey@finlandia.Infodrom.North.DE>
To: Thomas Roessler <roessler@sobolev.rhein.de>, 35325@bugs.debian.org
Message-ID: <19990407235052.K22111@finlandia.artis.uni-oldenburg.de>
References: <19990331081121.B0E6BF206@sobolev.rhein.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.95.4i
In-Reply-To: <19990331081121.B0E6BF206@sobolev.rhein.de>; from Thomas Roessler on Wed, Mar 31, 1999 at 10:11:21AM +0200

Thomas Roessler wrote:
> System log files (and /var/log) could be donated to a special log
> user, so opening or writing them won't require any special
> privileges.

Umm, no.  In that case all log files from syslogd would have to
be moved into /var/log/syslog since more than only syslog is
logging there and we would munch things.  Well, one could think
about /var/log being owned by `logger' and root still being able
to write to it but it might cause other confusion.

Regards,

	Joey

-- 
Beware of bugs in the above code; I have only proved it correct,
not tried it.  -- Donald E. Knuth

Please always Cc to me when replying to me on the lists.



<strong>Acknowledgement sent</strong> to <code>Martin Schulze &lt;joey@infodrom.north.de&gt;</code>:<br>
Extra info received and forwarded to list.  Copy sent to <code>Martin Schulze &lt;joey@debian.org&gt;</code>.


-t

From: owner@bugs.debian.org (Debian Bug Tracking System)
To: Martin Schulze <joey@infodrom.north.de>
Subject: Bug#35325: Info received (was Bug#35325: sysklogd: There should be a way to run sysklogd without root privileges)
Message-ID: <handler.35325.B35325.92352185613141.ackinfo@bugs.debian.org>
In-Reply-To: <19990407235052.K22111@finlandia.artis.uni-oldenburg.de>
References: <19990407235052.K22111@finlandia.artis.uni-oldenburg.de>
X-Debian-PR-Message: ack-info-maintonly 35325

Thank you for the additional information you have supplied regarding
this problem report.  It has been forwarded to the developer(s) and
to the developers' mailing list to accompany the original report.

Your message has been sent to the package maintainer(s):
 Martin Schulze <joey@debian.org>

If you wish to continue to submit further information on your problem,
please send it to 35325@bugs.debian.org, as before.

Please do not reply to the address at the top of this message,
unless you wish to report a problem with the bug-tracking system.

Ian Jackson
(administrator, Debian bugs database)



Received: (at 35325) by bugs.debian.org; 7 Apr 1999 21:50:56 +0000
Received: (qmail 13138 invoked from network); 7 Apr 1999 21:50:55 -0000
Received: from gimli.informatik.uni-oldenburg.de (134.106.1.10)
  by master.debian.org with SMTP; 7 Apr 1999 21:50:55 -0000
Received: from finlandia.Infodrom.North.DE ([134.106.121.3])
	by gimli.Informatik.Uni-Oldenburg.DE (Smail3.1.29.1)
	id <m10V0Dr-0003KWC>; Wed, 7 Apr 99 23:50 CES
Received: at Infodrom Oldenburg (/\##/\ Smail-3.2.0.102 1998-Aug-2 #2)
	by finlandia.Infodrom.North.DE
	via smail from stdin
	id <m10V0Dk-000alGC@finlandia.Infodrom.North.DE>
	for roessler@sobolev.rhein.de; Wed, 7 Apr 1999 23:50:52 +0200 (CEST) 
Date: Wed, 7 Apr 1999 23:50:52 +0200
From: Martin Schulze <joey@finlandia.Infodrom.North.DE>
To: Thomas Roessler <roessler@sobolev.rhein.de>, 35325@bugs.debian.org
Subject: Re: Bug#35325: sysklogd: There should be a way to run sysklogd without root privileges
Message-ID: <19990407235052.K22111@finlandia.artis.uni-oldenburg.de>
Reply-To: Martin Schulze <joey@infodrom.north.de>
References: <19990331081121.B0E6BF206@sobolev.rhein.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.95.4i
In-Reply-To: <19990331081121.B0E6BF206@sobolev.rhein.de>; from Thomas Roessler on Wed, Mar 31, 1999 at 10:11:21AM +0200

Thomas Roessler wrote:
> System log files (and /var/log) could be donated to a special log
> user, so opening or writing them won't require any special
> privileges.

Umm, no.  In that case all log files from syslogd would have to
be moved into /var/log/syslog since more than only syslog is
logging there and we would munch things.  Well, one could think
about /var/log being owned by `logger' and root still being able
to write to it but it might cause other confusion.

Regards,

	Joey

-- 
Beware of bugs in the above code; I have only proved it correct,
not tried it.  -- Donald E. Knuth

Please always Cc to me when replying to me on the lists.



<strong>Merged 24326 35325.</strong>
Request was from <code>Andreas Barth &lt;aba@not.so.argh.org&gt;</code>
to <code>control@bugs.debian.org</code>. 


Received: (at control) by bugs.debian.org; 28 Jul 2003 11:19:56 +0000
From aba@not.so.argh.org Mon Jul 28 06:19:54 2003
Return-path: <aba@not.so.argh.org>
Received: from svr7.m-online.net [62.245.150.229] 
	by master.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 19h62k-0005Wz-00; Mon, 28 Jul 2003 06:19:54 -0500
Received: from sol.so.argh.org (ppp-62-245-208-15.mnet-online.de [62.245.208.15])
	by svr7.m-online.net (Postfix) with ESMTP id 97EA56CABA
	for <control@bugs.debian.org>; Mon, 28 Jul 2003 13:19:53 +0200 (CEST)
Received: from aba by sol.so.argh.org with local (Exim 4.14 #1 (Debian) [+prerelease])
	id 19h62k-0001yW-MJ
	for <control@bugs.debian.org>; Mon, 28 Jul 2003 13:19:54 +0200
Date: Mon, 28 Jul 2003 13:19:54 +0200
From: Andreas Barth <aba@not.so.argh.org>
To: control@bugs.debian.org
Subject: house-keeping
Message-ID: <20030728111954.GK1900@mails.so.argh.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.3.28i
X-Editor: Vim http://www.vim.org/
Delivered-To: control@bugs.debian.org
X-Spam-Status: No, hits=-3.0 required=4.0
	tests=BAYES_20,USER_AGENT_MUTT
	version=2.53-bugs.debian.org_2003_07_20
X-Spam-Level: 
X-Spam-Checker-Version: SpamAssassin 2.53-bugs.debian.org_2003_07_20 (1.174.2.15-2003-03-30-exp)

retitle 37193 hangs if unable to talke to nameservers

# all about "hangs if can't log"
# perhaps 37193 should also be merged here, but I'm not sure
retitle 45245 syslogd got stuck if writing to one logfile is unavailable
severity 93594 normal
merge 93594 45245

# submitter said in Oct 2000 bug can be closed
close 72953

tags 135485 +patch

# all the same problem with potato to woody upgrade and using old init.d
severity 139621 normal
merge 139621 135818 153673

tags 165472 +patch

# mdz tried this before but failed
retitle 199554 Missing kernel messages
tags 199554 +unreproducible

tags 192841 +patch

# both reports are about running without root priviliges
merge 24326 35325

tags 56595 +patch

tags 104278 +patch

severity 126616 normal
tags 126616 +patch

tags 127620 +patch

tags 162688 +patch

# NMU was not accepted, so set all back
tags 132873 -fixed
severity 164153 normal
merge 132873 164153
-- 
   http://home.arcor.de/andreas-barth/
   PGP 1024/89FB5CE5  DC F1 85 6D A6 45 9C 0F  3B BE F1 D0 C5 D1 D9 0C




<strong>Information forwarded</strong> to <code>debian-bugs-dist@lists.debian.org, Martin Schulze &lt;joey@debian.org&gt;</code>:<br>
<code>Bug#35325</code>; Package <code>sysklogd</code>.


debian-bugs-dist@lists.debian.orgMartin Schulze <joey@debian.org>

X-Loop: owner@bugs.debian.org
Subject: Bug#35325: Ubuntu patch
Reply-To: Martin Pitt <martin@piware.de>, 35325@bugs.debian.org
Resent-From: Martin Pitt <martin@piware.de>
Original-Sender: Martin Pitt <martin@piware.de>
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: Martin Schulze <joey@debian.org>
Resent-Date: Thu, 25 Nov 2004 15:33:11 UTC
Resent-Message-ID: <handler.35325.B35325.110139616326861@bugs.debian.org>
Resent-Sender: owner@bugs.debian.org
X-Debian-PR-Message: report 35325
X-Debian-PR-Package: sysklogd
X-Debian-PR-Keywords: 
Received: via spool by 35325-submit@bugs.debian.org id=B35325.110139616326861
          (code B ref 35325); Thu, 25 Nov 2004 15:33:11 UTC
Received: (at 35325) by bugs.debian.org; 25 Nov 2004 15:22:43 +0000
Received: from box79162.elkhouse.de [213.9.79.162] 
	by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 1CXLSE-0006sL-00; Thu, 25 Nov 2004 07:22:42 -0800
Received: from martin by box79162.elkhouse.de with local (Exim 4.34)
	id 1CXLRj-0004ay-Pk; Thu, 25 Nov 2004 16:22:11 +0100
Date: Thu, 25 Nov 2004 16:22:11 +0100
From: Martin Pitt <martin@piware.de>
To: 35325@bugs.debian.org
Cc: control@bugs.debian.org
Message-ID: <20041125152211.GA17482@box79162.elkhouse.de>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="J/dobhs11T7y2rNN"
Content-Disposition: inline
User-Agent: Mutt/1.5.6+20040722i
Sender: Martin Pitt <martin@piware.de>
Delivered-To: 35325@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25 
	(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-5.0 required=4.0 tests=BAYES_00,VALID_BTS_CONTROL 
	autolearn=no version=2.60-bugs.debian.org_2004_03_25
X-Spam-Level: 


--J/dobhs11T7y2rNN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

tag 32325 patch
thanks

Hi Joey!

Yesterday I patched the Ubuntu package to let sysklogd run as normal
user "syslog" instead of root. The interdiff is available at

  http://patches.ubuntu.com/patches/sysklogd.no-root-syslogd.diff

Unfortunately I looked into Debian's BTS _after_ uploading the updated
package, otherwise I could have based my patch on the already existing
ones.

Some words to the various issues that were raised in #32325 and
#24326:

- ownership of log files: they stay as they are, sysklogd drops root
  privileges after opening the files

- initgroups() is used for the new user to clean up any groups root
  might be in and to activate any auxilliary groups of user "syslog"
  (admins could use this to tweak ownership of logfiles; "adm" would
  be an appropriate group)

- error return codes are checked for functions like setuid() and
  initgroups()

- reloading: I modified the init script to really restart sysklogd
  instead of sending SIGHUP. This solves the problems with log
  rotation etc.

- removing the unix socket on exit: this is the only issue that is not
  really solved by the Ubuntu patch. It's not a big deal since usually
  syslog runs all the time anyway and even if it does not, it is just
  an orphaned file in /dev/, which is cleared at the next reboot
  anyway (with udev, at least) or simply reused.

The patch does not modify klogd since I did not find a way to read
/proc/kmsg without being root other than granting CAP_SYS_ADMIN (which
is equivalent to root). However, I just found the=20

  su - syslogd "klogd -P -" </proc/kmsg

hack in the BTS which is worth investigating. If it works and does not
have security holes, I will update the patch.

Should you be hesitant to make this the default, do you at least
consider to include the code, but not use "-u syslog" by default in
the init script? You could provide a default file then which would
make it easy to enable privilege dropping.

Thanks for considering and have a nice day!

Martin

--=20
Martin Pitt                       http://www.piware.de
Ubuntu Developer            http://www.ubuntulinux.org
Debian GNU/Linux Developer       http://www.debian.org

--J/dobhs11T7y2rNN
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBpfijDecnbV4Fd/IRAqwVAKCP3ZCl9WNFg0tbAwcuTa69CNl16ACghrrv
BPmGgmxwpPc6JJ50tZsjjRI=
=jf0D
-----END PGP SIGNATURE-----

--J/dobhs11T7y2rNN--




<strong>Acknowledgement sent</strong> to <code>Martin Pitt &lt;martin@piware.de&gt;</code>:<br>
Extra info received and forwarded to list.  Copy sent to <code>Martin Schulze &lt;joey@debian.org&gt;</code>.


-t

X-Loop: owner@bugs.debian.org
From: owner@bugs.debian.org (Debian Bug Tracking System)
To: Martin Pitt <martin@piware.de>
Subject: Bug#35325: Info received (was Ubuntu patch)
Message-ID: <handler.35325.B35325.110139616326861.ackinfo@bugs.debian.org>
In-Reply-To: <20041125152211.GA17482@box79162.elkhouse.de>
References: <20041125152211.GA17482@box79162.elkhouse.de>
Precedence: bulk
X-Debian-PR-Message: ack-info 35325
X-Debian-PR-Package: sysklogd
X-Debian-PR-Keywords: 

Thank you for the additional information you have supplied regarding
this problem report.  It has been forwarded to the package maintainer(s)
and to other interested parties to accompany the original report.

Your message has been sent to the package maintainer(s):
 Martin Schulze <joey@debian.org>

If you wish to continue to submit further information on your problem,
please send it to 35325@bugs.debian.org, as before.

Please do not reply to the address at the top of this message,
unless you wish to report a problem with the Bug-tracking system.

Debian bug tracking system administrator
(administrator, Debian Bugs database)



Received: (at 35325) by bugs.debian.org; 25 Nov 2004 15:22:43 +0000
From martin@piware.de Thu Nov 25 07:22:43 2004
Return-path: <martin@piware.de>
Received: from box79162.elkhouse.de [213.9.79.162] 
	by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 1CXLSE-0006sL-00; Thu, 25 Nov 2004 07:22:42 -0800
Received: from martin by box79162.elkhouse.de with local (Exim 4.34)
	id 1CXLRj-0004ay-Pk; Thu, 25 Nov 2004 16:22:11 +0100
Date: Thu, 25 Nov 2004 16:22:11 +0100
From: Martin Pitt <martin@piware.de>
To: 35325@bugs.debian.org
Cc: control@bugs.debian.org
Subject: Ubuntu patch
Message-ID: <20041125152211.GA17482@box79162.elkhouse.de>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="J/dobhs11T7y2rNN"
Content-Disposition: inline
User-Agent: Mutt/1.5.6+20040722i
Sender: Martin Pitt <martin@piware.de>
Delivered-To: 35325@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25 
	(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-5.0 required=4.0 tests=BAYES_00,VALID_BTS_CONTROL 
	autolearn=no version=2.60-bugs.debian.org_2004_03_25
X-Spam-Level: 


--J/dobhs11T7y2rNN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

tag 32325 patch
thanks

Hi Joey!

Yesterday I patched the Ubuntu package to let sysklogd run as normal
user "syslog" instead of root. The interdiff is available at

  http://patches.ubuntu.com/patches/sysklogd.no-root-syslogd.diff

Unfortunately I looked into Debian's BTS _after_ uploading the updated
package, otherwise I could have based my patch on the already existing
ones.

Some words to the various issues that were raised in #32325 and
#24326:

- ownership of log files: they stay as they are, sysklogd drops root
  privileges after opening the files

- initgroups() is used for the new user to clean up any groups root
  might be in and to activate any auxilliary groups of user "syslog"
  (admins could use this to tweak ownership of logfiles; "adm" would
  be an appropriate group)

- error return codes are checked for functions like setuid() and
  initgroups()

- reloading: I modified the init script to really restart sysklogd
  instead of sending SIGHUP. This solves the problems with log
  rotation etc.

- removing the unix socket on exit: this is the only issue that is not
  really solved by the Ubuntu patch. It's not a big deal since usually
  syslog runs all the time anyway and even if it does not, it is just
  an orphaned file in /dev/, which is cleared at the next reboot
  anyway (with udev, at least) or simply reused.

The patch does not modify klogd since I did not find a way to read
/proc/kmsg without being root other than granting CAP_SYS_ADMIN (which
is equivalent to root). However, I just found the=20

  su - syslogd "klogd -P -" </proc/kmsg

hack in the BTS which is worth investigating. If it works and does not
have security holes, I will update the patch.

Should you be hesitant to make this the default, do you at least
consider to include the code, but not use "-u syslog" by default in
the init script? You could provide a default file then which would
make it easy to enable privilege dropping.

Thanks for considering and have a nice day!

Martin

--=20
Martin Pitt                       http://www.piware.de
Ubuntu Developer            http://www.ubuntulinux.org
Debian GNU/Linux Developer       http://www.debian.org

--J/dobhs11T7y2rNN
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBpfijDecnbV4Fd/IRAqwVAKCP3ZCl9WNFg0tbAwcuTa69CNl16ACghrrv
BPmGgmxwpPc6JJ50tZsjjRI=
=jf0D
-----END PGP SIGNATURE-----

--J/dobhs11T7y2rNN--




<strong>Information forwarded</strong> to <code>debian-bugs-dist@lists.debian.org, Martin Schulze &lt;joey@debian.org&gt;</code>:<br>
<code>Bug#35325</code>; Package <code>sysklogd</code>.


debian-bugs-dist@lists.debian.orgMartin Schulze <joey@debian.org>

X-Loop: owner@bugs.debian.org
Subject: Bug#35325: Second patch version, klogd as user
Reply-To: Martin Pitt <mpitt@debian.org>, 35325@bugs.debian.org
Resent-From: Martin Pitt <mpitt@debian.org>
Original-Sender: Martin Pitt <martin@piware.de>
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: Martin Schulze <joey@debian.org>
Resent-Date: Fri, 26 Nov 2004 10:48:12 UTC
Resent-Message-ID: <handler.35325.B35325.11014655704875@bugs.debian.org>
Resent-Sender: owner@bugs.debian.org
X-Debian-PR-Message: report 35325
X-Debian-PR-Package: sysklogd
X-Debian-PR-Keywords: 
Received: via spool by 35325-submit@bugs.debian.org id=B35325.11014655704875
          (code B ref 35325); Fri, 26 Nov 2004 10:48:12 UTC
Received: (at 35325) by bugs.debian.org; 26 Nov 2004 10:39:30 +0000
Received: from box79162.elkhouse.de [213.9.79.162] 
	by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 1CXdVi-0001FD-00; Fri, 26 Nov 2004 02:39:30 -0800
Received: from martin by box79162.elkhouse.de with local (Exim 4.34)
	id 1CXdVD-0007qN-He
	for 35325@bugs.debian.org; Fri, 26 Nov 2004 11:38:59 +0100
Date: Fri, 26 Nov 2004 11:38:59 +0100
From: Martin Pitt <mpitt@debian.org>
To: 35325@bugs.debian.org
Message-ID: <20041126103859.GA30048@box79162.elkhouse.de>
References: <20041125152211.GA17482@box79162.elkhouse.de>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="6c2NcOVqGQ03X4Wi"
Content-Disposition: inline
In-Reply-To: <20041125152211.GA17482@box79162.elkhouse.de>
User-Agent: Mutt/1.5.6+20040722i
Sender: Martin Pitt <martin@piware.de>
Delivered-To: 35325@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25 
	(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-3.0 required=4.0 tests=BAYES_00 autolearn=no 
	version=2.60-bugs.debian.org_2004_03_25
X-Spam-Level: 


--6c2NcOVqGQ03X4Wi
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi Joey!

Martin Pitt [2004-11-25 16:22 +0100]:
> The patch does not modify klogd since I did not find a way to read
> /proc/kmsg without being root other than granting CAP_SYS_ADMIN (which
> is equivalent to root). However, I just found the=20
>=20
>   su - syslogd "klogd -P -" </proc/kmsg
>=20
> hack in the BTS which is worth investigating. If it works and does not
> have security holes, I will update the patch.

Based on this idea I worked out a solution for letting klogd run
entirely with normal user privileges. I added a "-P file" option which
reads kernel messages from an alternative location (instead of from
/proc/kmsg). The init script now starts a dd process (as root) which
shovels /proc/kmsg/ to a pipe /var/run/klogd/kmsg (klog:klog, 0600).
klogd then reads the messages from this pipe. This looks a bit ugly,
but effectively separates the single privileged task (reading from
kmsg) from all the parsing and formatting stuff. dd is reasonably
small and safe and does not interact with any other process, so I do
not see many potential holes there.

The Ubuntu version now has this patch, it works fine.=20

I removed the patch I pointed to yesterday and replaced it by an
unified one which patches both sysklogd and klogd and applies cleanly
against the Debian version 1.4.1-16. You can get it from

  http://patches.ubuntu.com/patches/sysklogd.no-root.diff

Thanks for considering and for your work and have a nice day!

Martin

P.S. Should you consider an upload in the next time, can you please
fix the changelog encoding and the /usr/doc foo?=20

--=20
Martin Pitt                       http://www.piware.de
Ubuntu Developer            http://www.ubuntulinux.org
Debian GNU/Linux Developer       http://www.debian.org

--6c2NcOVqGQ03X4Wi
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBpwfDDecnbV4Fd/IRAgeAAKCVUGVyLJyKBKWpBKGB6FmmD5mEMwCfTaDD
saFOAZEt6hdsTu8qQCQz4yk=
=kSvZ
-----END PGP SIGNATURE-----

--6c2NcOVqGQ03X4Wi--




<strong>Acknowledgement sent</strong> to <code>Martin Pitt &lt;mpitt@debian.org&gt;</code>:<br>
Extra info received and forwarded to list.  Copy sent to <code>Martin Schulze &lt;joey@debian.org&gt;</code>.


-t

X-Loop: owner@bugs.debian.org
From: owner@bugs.debian.org (Debian Bug Tracking System)
To: Martin Pitt <mpitt@debian.org>
Subject: Bug#35325: Info received (was Second patch version, klogd as user)
Message-ID: <handler.35325.B35325.11014655704875.ackinfo@bugs.debian.org>
In-Reply-To: <20041126103859.GA30048@box79162.elkhouse.de>
References: <20041126103859.GA30048@box79162.elkhouse.de>
Precedence: bulk
X-Debian-PR-Message: ack-info 35325
X-Debian-PR-Package: sysklogd
X-Debian-PR-Keywords: 

Thank you for the additional information you have supplied regarding
this problem report.  It has been forwarded to the package maintainer(s)
and to other interested parties to accompany the original report.

Your message has been sent to the package maintainer(s):
 Martin Schulze <joey@debian.org>

If you wish to continue to submit further information on your problem,
please send it to 35325@bugs.debian.org, as before.

Please do not reply to the address at the top of this message,
unless you wish to report a problem with the Bug-tracking system.

Debian bug tracking system administrator
(administrator, Debian Bugs database)



Received: (at 35325) by bugs.debian.org; 26 Nov 2004 10:39:30 +0000
From martin@piware.de Fri Nov 26 02:39:30 2004
Return-path: <martin@piware.de>
Received: from box79162.elkhouse.de [213.9.79.162] 
	by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
	id 1CXdVi-0001FD-00; Fri, 26 Nov 2004 02:39:30 -0800
Received: from martin by box79162.elkhouse.de with local (Exim 4.34)
	id 1CXdVD-0007qN-He
	for 35325@bugs.debian.org; Fri, 26 Nov 2004 11:38:59 +0100
Date: Fri, 26 Nov 2004 11:38:59 +0100
From: Martin Pitt <mpitt@debian.org>
To: 35325@bugs.debian.org
Subject: Second patch version, klogd as user
Message-ID: <20041126103859.GA30048@box79162.elkhouse.de>
References: <20041125152211.GA17482@box79162.elkhouse.de>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="6c2NcOVqGQ03X4Wi"
Content-Disposition: inline
In-Reply-To: <20041125152211.GA17482@box79162.elkhouse.de>
User-Agent: Mutt/1.5.6+20040722i
Sender: Martin Pitt <martin@piware.de>
Delivered-To: 35325@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25 
	(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-3.0 required=4.0 tests=BAYES_00 autolearn=no 
	version=2.60-bugs.debian.org_2004_03_25
X-Spam-Level: 


--6c2NcOVqGQ03X4Wi
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi Joey!

Martin Pitt [2004-11-25 16:22 +0100]:
> The patch does not modify klogd since I did not find a way to read
> /proc/kmsg without being root other than granting CAP_SYS_ADMIN (which
> is equivalent to root). However, I just found the=20
>=20
>   su - syslogd "klogd -P -" </proc/kmsg
>=20
> hack in the BTS which is worth investigating. If it works and does not
> have security holes, I will update the patch.

Based on this idea I worked out a solution for letting klogd run
entirely with normal user privileges. I added a "-P file" option which
reads kernel messages from an alternative location (instead of from
/proc/kmsg). The init script now starts a dd process (as root) which
shovels /proc/kmsg/ to a pipe /var/run/klogd/kmsg (klog:klog, 0600).
klogd then reads the messages from this pipe. This looks a bit ugly,
but effectively separates the single privileged task (reading from
kmsg) from all the parsing and formatting stuff. dd is reasonably
small and safe and does not interact with any other process, so I do
not see many potential holes there.

The Ubuntu version now has this patch, it works fine.=20

I removed the patch I pointed to yesterday and replaced it by an
unified one which patches both sysklogd and klogd and applies cleanly
against the Debian version 1.4.1-16. You can get it from

  http://patches.ubuntu.com/patches/sysklogd.no-root.diff

Thanks for considering and for your work and have a nice day!

Martin

P.S. Should you consider an upload in the next time, can you please
fix the changelog encoding and the /usr/doc foo?=20

--=20
Martin Pitt                       http://www.piware.de
Ubuntu Developer            http://www.ubuntulinux.org
Debian GNU/Linux Developer       http://www.debian.org

--6c2NcOVqGQ03X4Wi
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBpwfDDecnbV4Fd/IRAgeAAKCVUGVyLJyKBKWpBKGB6FmmD5mEMwCfTaDD
saFOAZEt6hdsTu8qQCQz4yk=
=kSvZ
-----END PGP SIGNATURE-----

--6c2NcOVqGQ03X4Wi--