[sanlock] branch master updated: lockfile: Keep lockfile owned by root

[git repository hosting]

This is an automated email from the git hooks/post-receive script.

teigland pushed a commit to branch master
in repository sanlock.

The following commit(s) were added to refs/heads/master by this push:
     new af09f3d  lockfile: Keep lockfile owned by root
af09f3d is described below

commit af09f3d9a5a8c2cfcd364f3b3e26333f3472d825
Author: Nir Soffer <nsoffer(a)redhat.com&gt;
AuthorDate: Fri Nov 30 00:03:19 2018 +0200

    lockfile: Keep lockfile owned by root
    
    On Fedora 28, sanlock fails to create the lockfile before dropping
    privileges, because /run/sanlock is owned by sanlock, and selinux
    disables DAC_OVERRIDE.
    
    To allow root to create the lockfile before dropping privileges
    /run/sanlock is owned by group root, and group writable.  Since sanlock
    never write to the lockfile after dropping privileges, keep the lockfile
    owned by root.
    
    Here are /run/sanlock permissions with this change:
    
    $ ls -lhdZ /run/sanlock
    drwxrwxr-x. 2 sanlock root system_u:object_r:sanlock_var_run_t:s0 80 Nov 29 23:07
/run/sanlock
    
    $ ls -lhZ /run/sanlock
    total 4.0K
    -rw-r--r--. 1 root    root    system_u:object_r:sanlock_var_run_t:s0 5 Nov 29 23:07
sanlock.pid
    srw-rw----. 1 sanlock sanlock system_u:object_r:sanlock_var_run_t:s0 0 Nov 29 23:07
sanlock.sock
    
    Signed-off-by: Nir Soffer <nsoffer(a)redhat.com&gt;
---
 src/lockfile.c | 12 ++++--------
 src/main.c     |  6 +++++-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/lockfile.c b/src/lockfile.c
index 5a2518e..cffaaff 100644
--- a/src/lockfile.c
+++ b/src/lockfile.c
@@ -36,7 +36,10 @@ int lockfile(const char *dir, const char *name, int uid, int gid)
 	mode_t old_umask;
 	int fd, rv;
 
-	old_umask = umask(0022);
+	/* Make rundir group writable, allowing creation of the lockfile when
+	 * starting as root. */
+
+	old_umask = umask(0002);
 	rv = mkdir(dir, 0775);
 	if (rv < 0 && errno != EEXIST) {
 		umask(old_umask);
@@ -89,13 +92,6 @@ int lockfile(const char *dir, const char *name, int uid, int gid)
 		goto fail;
 	}
 
-	rv = fchown(fd, uid, gid);
-	if (rv < 0) {
-		log_error("lockfile fchown error %s: %s",
-			  path, strerror(errno));
-		goto fail;
-	}
-
 	return fd;
  fail:
 	close(fd);
diff --git a/src/main.c b/src/main.c
index b3898e2..9538cc5 100644
--- a/src/main.c
+++ b/src/main.c
@@ -1682,8 +1682,12 @@ static int do_daemon(void)
 	if (!privileged)
 		log_warn("Running in unprivileged mode");
 
+	/* If we run as root, make run_dir owned by root, so we can create the
+	 * lockfile when selinux disables DAC_OVERRIDE.
+	 * See https://danwalsh.livejournal.com/79643.html */
 
-	fd = lockfile(run_dir, SANLK_LOCKFILE_NAME, com.uid, com.gid);
+	fd = lockfile(run_dir, SANLK_LOCKFILE_NAME, com.uid,
+		      privileged ? 0 : com.gid);
 	if (fd < 0) {
 		close_logging();
 		return fd;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.