[Bug 1036780] New: rabbitmq-server wrapper script drops arguments
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1036780
Bug ID: 1036780
Summary: rabbitmq-server wrapper script drops arguments
Product: Fedora
Version: rawhide
Component: rabbitmq-server
Assignee: hubert.plociniczak(a)gmail.com
Reporter: rhbugs(a)rbu.sh
QA Contact: extras-qa(a)fedoraproject.org
CC: erlang(a)lists.fedoraproject.org,
hubert.plociniczak(a)gmail.com, lemenkov(a)gmail.com
Description of problem:
the wrapper script /usr/sbin/rabbitmqctl drops all arguments to the command in
certain cases, for example when the calling user is not root.
I am running a rabbitmq node as a local user (for development) as a regular
user, outside of /var. This works fine, however the Fedora-specific wrapper to
"rabbitctl" will obscure access to the rabbitctl script. It took me quite a
while to debug what was happening, until I found out the command is really a
wrapper whose sole purpose is munging arguments -- and it does it wrong.
Version-Release number of selected component (if applicable):
I am on 3.1.5-1.fc19 but I see the same bug in rawhide.
How reproducible:
Always.
Steps to Reproduce:
1. Be non-root / non-rabbitmq user
2. Run rabbitmqctl status
Actual results:
Error: could not recognise command
Usage:
rabbitmqctl [-n <node>] [-q] <command> [<command options>]
...
Expected results:
Status of node rabbit@localhost ...
[{pid,1234},...
Additional info:
The warning "Only root or rabbitmq should run" should really be "Only root or
rabbitmq must run", as currently it makes it impossible for anyone else.
However, this is not true, as any user *can* run rabbitmq.
Furthermore, users in the rabbitmq group should be able to run management
commands, given the correct parameters.
Lastly, the "rabbitmq-plugins" case looks fishy too, as it allows anyone to run
the rabbitmq-plugins command, and makes the first line obsolete.
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1028657] New: couchdb should also be usable under normal users
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1028657
Bug ID: 1028657
Summary: couchdb should also be usable under normal users
Product: Fedora
Version: rawhide
Component: couchdb
Assignee: lemenkov(a)gmail.com
Reporter: cickumqt(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: erlang(a)lists.fedoraproject.org, lemenkov(a)gmail.com
1. Running under normal user:
[rpmaker@fab fedpkg]$ couchdb
Apache CouchDB 1.3.1 (LogLevel=info) is starting.
Error opening log file /var/log/couchdb/couch.log: permission denied{"init
terminating in
do_boot",{{badmatch,{error,{bad_return,{{couch_app,start,[normal,["/etc/couchdb/default.ini","/etc/couchdb/local.ini"]]},{'EXIT',{{badmatch,{error,{shutdown,{failed_to_start_child,couch_primary_services,{shutdown,{failed_to_start_child,couch_log,{error,"permission
denied","/var/log/couchdb/couch.log"}}}}}}},[{couch_server_sup,start_server,1,[{file,"couch_server_sup.erl"},{line,98}]},{application_master,start_it_old,4,[{file,"application_master.erl"},{line,269}]}]}}}}}},[{couch,start,0,[{file,"couch.erl"},{line,18}]},{init,start_it,1,[]},{init,start_em,1,[]}]}}
2. Running under root:
[root@fab fedpkg]# couchdb
Apache CouchDB 1.3.1 (LogLevel=info) is starting.
Apache CouchDB has started. Time to relax.
[info] [<0.31.0>] Apache CouchDB has started on http://127.0.0.1:5984/
I don't know why this happened, but I think there might have some dirs/files
are operated by incorrect permissions setting.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 1 month
[Bug 1067367] New: [abrt] erlang-erts: wxEvtHandler::Disconnect(): beam.smp killed by SIGSEGV
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1067367
Bug ID: 1067367
Summary: [abrt] erlang-erts: wxEvtHandler::Disconnect():
beam.smp killed by SIGSEGV
Product: Fedora
Version: 20
Component: erlang
Assignee: lemenkov(a)gmail.com
Reporter: razorpeak(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: erlang(a)lists.fedoraproject.org, lemenkov(a)gmail.com,
rhbugs(a)n-dimensional.de, skottler(a)redhat.com
Version-Release number of selected component:
erlang-erts-R16B-03.1.fc20
Additional info:
reporter: libreport-2.1.12
backtrace_rating: 4
cmdline: /usr/lib64/erlang/erts-5.10.4/bin/beam.smp -- -root
/usr/lib64/erlang -progname erl -- -home /home/bikram -- -pa ebin -pa
../../deps/bullet/ebin ../../deps/cowboy/ebin ../../deps/dderloci/ebin
../../deps/erlimem/ebin ../../deps/erloci/ebin ../../deps/goldrush/ebin
../../deps/imem/ebin ../../deps/jsx/ebin ../../deps/lager/ebin
../../deps/mimetypes/ebin ../../deps/node_package/ebin ../../deps/proper/ebin
../../deps/ranch/ebin ../../deps/sqlparse/ebin -name
dderl(a)WKS01.k2informatics.ch -setcookie zdss4d2_6tP -s dderl -dderl port 8443
-imem tcp_port 8125 -imem erl_cluster_mgr '\'dderl(a)WKS01.k2informatics.ch\''
-imem mnesia_schema_name dderlstag
crash_function: wxEvtHandler::Disconnect
executable: /usr/lib64/erlang/erts-5.10.4/bin/beam.smp
kernel: 3.12.9-301.fc20.x86_64
runlevel: N 5
type: CCpp
uid: 1000
Truncated backtrace:
Thread no. 1 (10 frames)
#0 wxEvtHandler::Disconnect at src/common/event.cpp:1376
#1 WxeApp::wxe_dispatch at gen/wxe_funcs.cpp:122
#2 WxeApp::dispatch at wxe_impl.cpp:398
#3 WxeApp::dispatch_cmds at wxe_impl.cpp:351
#4 wxEvtHandler::ProcessEventIfMatches at src/common/event.cpp:1239
#5 wxEvtHandler::SearchDynamicEventTable at src/common/event.cpp:1421
#6 wxEvtHandler::ProcessEvent at src/common/event.cpp:1297
#7 wxAppBase::ProcessIdle at src/common/appcmn.cpp:449
#8 wxapp_idle_callback at src/gtk/app.cpp:213
#13 gtk_main at gtkmain.c:1257
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 10 months
[Bug 1064577] New: [abrt] erlang-erts: beam.smp killed by SIGSEGV
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1064577
Bug ID: 1064577
Summary: [abrt] erlang-erts: beam.smp killed by SIGSEGV
Product: Fedora
Version: 20
Component: erlang
Assignee: lemenkov(a)gmail.com
Reporter: redhat(a)astekk.se
QA Contact: extras-qa(a)fedoraproject.org
CC: erlang(a)lists.fedoraproject.org, lemenkov(a)gmail.com,
rhbugs(a)n-dimensional.de, skottler(a)redhat.com
Description of problem:
I used the debugger ( im() from eshell). and had a lot of processes breaking, w
auto attach on break enabled.
The gui got pretty unresponsive then, so I'm not entirely sure what I may have
done to it, to cause this.
Version-Release number of selected component:
erlang-erts-R16B-03.1.fc20
Additional info:
reporter: libreport-2.1.12
backtrace_rating: 3
cmdline: /usr/lib64/erlang/erts-5.10.4/bin/beam.smp -P 10000000 -K true
-- -root /usr/lib64/erlang -progname erl -- -home /home/kaos -- -pa
/home/kaos/src/zotonic/ebin /home/kaos/src/zotonic/deps/bear/ebin
/home/kaos/src/zotonic/deps/bert/ebin /home/kaos/src/zotonic/deps/dh_date/ebin
/home/kaos/src/zotonic/deps/edown/ebin /home/kaos/src/zotonic/deps/eiconv/ebin
/home/kaos/src/zotonic/deps/elog/ebin /home/kaos/src/zotonic/deps/emqtt/ebin
/home/kaos/src/zotonic/deps/folsom/ebin
/home/kaos/src/zotonic/deps/gen_smtp/ebin
/home/kaos/src/zotonic/deps/goldrush/ebin
/home/kaos/src/zotonic/deps/lager/ebin /home/kaos/src/zotonic/deps/meck/ebin
/home/kaos/src/zotonic/deps/mimetypes/ebin
/home/kaos/src/zotonic/deps/mochiweb/ebin
/home/kaos/src/zotonic/deps/parse_trans/ebin
/home/kaos/src/zotonic/deps/sendfile/ebin
/home/kaos/src/zotonic/deps/ua_classifier/ebin
/home/kaos/src/zotonic/deps/webzmachine/ebin
/home/kaos/src/zotonic/deps/z_stdlib/ebin
/home/kaos/src/zotonic/modules/mod_oauth/deps/erlang-oauth/ebin
/home/kaos/src/zotonic/priv/modules/*/deps/*/ebin
/home/kaos/src/zotonic/priv/sites/*/deps/*/ebin
/home/kaos/src/zotonic/priv/sites/*/modules/*/deps/*/ebin -sname
zotonic001@cypher -boot start_sasl -config
/home/kaos/src/zotonic/priv/erlang.config -sasl errlog_type error -s zotonic
executable: /usr/lib64/erlang/erts-5.10.4/bin/beam.smp
kernel: 3.12.9-301.fc20.x86_64
runlevel: N 5
type: CCpp
uid: 1000
Truncated backtrace:
Thread no. 1 (10 frames)
#0 ??
#1 WxeApp::wxe_dispatch at gen/wxe_funcs.cpp:8951
#2 WxeApp::dispatch at wxe_impl.cpp:398
#3 WxeApp::dispatch_cmds at wxe_impl.cpp:351
#4 wxEvtHandler::ProcessEventIfMatches at src/common/event.cpp:1239
#5 wxEvtHandler::SearchDynamicEventTable at src/common/event.cpp:1421
#6 wxEvtHandler::ProcessEvent at src/common/event.cpp:1297
#7 wxAppBase::ProcessIdle at src/common/appcmn.cpp:449
#8 wxapp_idle_callback at src/gtk/app.cpp:213
#13 gtk_main at gtkmain.c:1257
Potential duplicate: bug 1013431
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 10 months
[Bug 1059335] New: CVE-2014-1693 erlang: erlang-inets: command injection flaw in FTP module [epel-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1059335
Bug ID: 1059335
Summary: CVE-2014-1693 erlang: erlang-inets: command injection
flaw in FTP module [epel-all]
Product: Fedora EPEL
Version: el6
Component: erlang
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: rjones(a)redhat.com
Reporter: mprpic(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: erlang(a)lists.fedoraproject.org, gemi(a)bluewin.ch,
rjones(a)redhat.com, skottler(a)redhat.com
Blocks: 1059331 (CVE-2014-1693)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affects multiple supported versions of Fedora EPEL.
Only one tracking bug has been filed; please ensure that it is only closed
when all affected versions are fixed.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1059331
[Bug 1059331] CVE-2014-1693 erlang-inets: command injection flaw in FTP
module
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 4 months
[Bug 1059333] New: CVE-2014-1693 erlang: erlang-inets: command injection flaw in FTP module [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1059333
Bug ID: 1059333
Summary: CVE-2014-1693 erlang: erlang-inets: command injection
flaw in FTP module [fedora-all]
Product: Fedora
Version: 20
Component: erlang
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: lemenkov(a)gmail.com
Reporter: mprpic(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: erlang(a)lists.fedoraproject.org, lemenkov(a)gmail.com,
rhbugs(a)n-dimensional.de, skottler(a)redhat.com
Blocks: 1059331 (CVE-2014-1693)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affects multiple supported versions of Fedora.
Only one tracking bug has been filed; please ensure that it is only closed
when all affected versions are fixed.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1059331
[Bug 1059331] CVE-2014-1693 erlang-inets: command injection flaw in FTP
module
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 4 months
[Bug 1036280] New: selinux alerts about rabbitmq server ("access on the tcp_socket")
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1036280
Bug ID: 1036280
Summary: selinux alerts about rabbitmq server ("access on the
tcp_socket")
Product: Fedora
Version: 20
Component: rabbitmq-server
Assignee: hubert.plociniczak(a)gmail.com
Reporter: pavel.nedr(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: erlang(a)lists.fedoraproject.org,
hubert.plociniczak(a)gmail.com, lemenkov(a)gmail.com
Description of problem:
I've seen flood in journalctl from SEalert about that error.
It begins from startup of the system (rabbitmq is enabled in systemctl)
There is a lot of error messages. They causes "audispd[643]: queue is full -
dropping event" error :)
rabbitmq-server
noarch
3.1.5
1.fc20
$ sudo sealert -l 82db9030-74db-4e60-97ab-6aef447e582d
SELinux is preventing /usr/lib64/erlang/erts-5.10.3/bin/beam.smp from name_bind
access on the tcp_socket .
***** Plugin bind_ports (92.2 confidence) suggests ************************
If you want to allow /usr/lib64/erlang/erts-5.10.3/bin/beam.smp to bind to
network port 10097
Then you need to modify the port type.
Do
# semanage port -a -t PORT_TYPE -p tcp 10097
где PORT_TYPE может принимать значения: amqp_port_t, couchdb_port_t,
jabber_client_port_t, jabber_interserver_port_t.
***** Plugin catchall_boolean (7.83 confidence) suggests ******************
If вы хотите выполнить следующее: разрешить NIS
Then you must tell SELinux about this by enabling the 'nis_enabled' boolean.
Дополнительная документация на 'None' ман странице.
Do
setsebool -P nis_enabled 1
***** Plugin catchall (1.41 confidence) suggests **************************
If вы считаете, что beam.smp следует разрешить доступ name_bind к tcp_socket
по умолчанию.
Then рекомендуется создать отчет об ошибке.
Чтобы разрешить доступ, можно создать локальный модуль политики.
Do
чтобы разрешить доступ, выполните:
# grep beam.smp /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:rabbitmq_beam_t:s0
Target Context system_u:object_r:unreserved_port_t:s0
Target Objects [ tcp_socket ]
Source beam.smp
Source Path /usr/lib64/erlang/erts-5.10.3/bin/beam.smp
Port 10097
Host bb.lan
Source RPM Packages erlang-erts-R16B-02.7.fc20.x86_64
Target RPM Packages
Policy RPM selinux-policy-3.12.1-105.fc20.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name bb.lan
Platform Linux bb.lan 3.11.9-300.fc20.x86_64 #1 SMP Wed
Nov
20 22:23:25 UTC 2013 x86_64 x86_64
Alert Count 85
First Seen 2013-11-29 23:40:14 MSK
Last Seen 2013-11-30 15:01:23 MSK
Local ID 82db9030-74db-4e60-97ab-6aef447e582d
Raw Audit Messages
type=AVC msg=audit(1385809283.320:612): avc: denied { name_bind } for
pid=1897 comm="beam.smp" src=10097
scontext=system_u:system_r:rabbitmq_beam_t:s0
tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1385809283.320:612): arch=x86_64 syscall=bind success=no
exit=EACCES a0=12 a1=7fac88cfb900 a2=1c a3=a items=0 ppid=1 pid=1897
auid=4294967295 uid=989 gid=984 euid=989 suid=989 fsuid=989 egid=984 sgid=984
fsgid=984 ses=4294967295 tty=(none) comm=beam.smp
exe=/usr/lib64/erlang/erts-5.10.3/bin/beam.smp
subj=system_u:system_r:rabbitmq_beam_t:s0 key=(null)
Hash: beam.smp,rabbitmq_beam_t,unreserved_port_t,tcp_socket,name_bind
--
You are receiving this mail because:
You are on the CC list for the bug.
9 years, 5 months