pkgsrc-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: pkg/40532: privoxy ignores user:group and has wheelpermissionsandso everyone accessing privoxy admin page




This didn't fix the problem. Also i checked /etc/rc.d/privoxy it is as

#!/bin/sh
#
# $NetBSD: privoxy.sh,v 1.4 2009/02/02 20:00:40 jnemeth Exp $
#

# PROVIDE: privoxy
# REQUIRE: DAEMON

. /etc/rc.subr

name="privoxy"
rcvar=$name
command="/usr/pkg/sbin/${name}"
pidfile="/var/run/${name}.pid"
pconfig="/usr/pkg/etc/privoxy/config"
puser="privoxy"
pgroup="@PRIVOXY_GROUP@"
required_files="$pconfig"
command_args="--pidfile ${pidfile} --user ${puser}.${pgroup} ${pconfig} 2>/dev/null"

load_rc_config $name
run_rc_command "$1"


Well, maybe we should move this issue to netbsd-user etc mailing list.




Matthias Drochner, 02/03/09 00:29:
cemkayali%eticaret.com.tr@localhost said:
It is well possible that privoxy opens its config file
before changing its privileges.

If a program opens a file descriptor before changing its
uig/gid, the file descriptor remains valid. But a "ktrace"
did show that this is not the case here.
The reason for the unexpected behaviour is that privoxy
changes its group but does not give up the supplementary
group memberships. Since "root" is member of "wheel" and
provoxy is started by "root" it runs with "wheel" permissions.
This is certainly a misfeature of "privoxy", if not
a serious bug.
Can you try the appended patch?

best regards
Matthias





-------------------------------------------------------------------
-------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich

Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzende des Aufsichtsrats: MinDir'in Baerbel Brumme-Bothe
Geschaeftsfuehrung: Prof. Dr. Achim Bachem (Vorsitzender),
Dr. Ulrich Krafft (stellv. Vorsitzender), Prof. Dr. Harald Bolt,
Dr. Sebastian M. Schmidt
-------------------------------------------------------------------
-------------------------------------------------------------------



Home | Main Index | Thread Index | Old Index