Home | Devuan | Git | Forum | Packages | Popcon
Donate now!
Download

Devuan bug report logs - #851
openrc: Incorrect handling of 'no_new_privs' in openrc-run

version graph

Package: openrc; Maintainer for openrc is (unknown); Source for openrc is src:openrc.

Reported by: murzik <lorietta2023@gmail.com>

Date: Tue, 2 Jul 2024 14:14:01 UTC

Severity: grave

Tags: patch, upstream

Found in version 0.45.2-2+deb12u1

Fixed in version 0.52.1-1

Done: Mark Hindley <mark@hindley.org.uk>

Full log

Message #5 received at submit@bugs.devuan.org (full text, mbox, reply):

Received: (at submit) by bugs.devuan.org; 2 Jul 2024 14:13:33 +0000
Return-Path: <lorietta2023@gmail.com>
Delivered-To: bugs@devuan.org
Received: from email.devuan.org [2a01:4f9:fff1:13::5fd9:f9e4]
	by doc.devuan.org with IMAP (fetchmail-6.4.16)
	for <debbugs@localhost> (single-drop); Tue, 02 Jul 2024 14:13:33 +0000 (UTC)
Received: from email.devuan.org
	by email.devuan.org with LMTP
	id QHhXMdUKhGbzXwAAmSBk0A
	(envelope-from <lorietta2023@gmail.com>)
	for <bugs@devuan.org>; Tue, 02 Jul 2024 14:12:37 +0000
Received: by email.devuan.org (Postfix, from userid 109)
	id B24394A0; Tue,  2 Jul 2024 14:12:37 +0000 (UTC)
Authentication-Results: email.devuan.org;
	dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=MwSjUzz4;
	dkim-atps=neutral
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on email.devuan.org
X-Spam-Level: 
X-Spam-Status: No, score=-0.1 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,SPF_PASS,
	T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2a00:1450:4864:20::341; helo=mail-wm1-x341.google.com; envelope-from=lorietta2023@gmail.com; receiver=<UNKNOWN> 
Received: from mail-wm1-x341.google.com (mail-wm1-x341.google.com [IPv6:2a00:1450:4864:20::341])
	by email.devuan.org (Postfix) with ESMTPS id 7659981
	for <submit@bugs.devuan.org>; Tue,  2 Jul 2024 14:12:35 +0000 (UTC)
Received: by mail-wm1-x341.google.com with SMTP id 5b1f17b1804b1-42138eadf64so30411515e9.3
        for <submit@bugs.devuan.org>; Tue, 02 Jul 2024 07:12:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1719929554; x=1720534354; darn=bugs.devuan.org;
        h=mime-version:message-id:to:subject:from:date:from:to:cc:subject
         :date:message-id:reply-to;
        bh=0oYeu9AFI2tebeHJity4PI3ISvJxR67lW7pFZd03yJQ=;
        b=MwSjUzz4dMBcVF4Yp6gIhkaIQhrryzaV2DV4TnCymdA2M5KZmBQKlY1kZnZKv3nD6f
         Vauu/3Fg1NlQ3NnjSjv4fsWSKGkctXJSbH+bplj9ygelobKntanNLNdDSSBM9VXKa+Qh
         ZHitJDlMYWCeeMMJ5qJy4b+6sgkLzzqnGXXWZdeNgaBOpwwFCT1QqdR8Ouj1jVVSG2q4
         RbpAL2apF4hiaasinI3mdwC0eWdMU5JH9IRCZybYo6GRnKSVRvKXpXtaFSePWTcbOKU2
         Q4/4GIWQVaQ4ychSkC8tXeI4SopZDYLUCHBIylHvPYl0Gi6xzVxUq+UKbpSci2LWFVBQ
         mHEw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1719929554; x=1720534354;
        h=mime-version:message-id:to:subject:from:date:x-gm-message-state
         :from:to:cc:subject:date:message-id:reply-to;
        bh=0oYeu9AFI2tebeHJity4PI3ISvJxR67lW7pFZd03yJQ=;
        b=q8ZpgDI4M8I5Iw1duS1kckyFD8jq5S/DTjmYo6bjoYYvOku3+SbfXItwlpSqSmnHWU
         JpRqHAKX6VYmGRAKFRdzo4LLelJXtvYDc9ykOrQOLOl/TwGf0IkIQI9wiajdNV3wvRvT
         VLi2SZ2fHer+wMjzxwN/Np0Rpq/vhy11sBgqzqPW4oHGskeS1QS/s31Cs+Ys8u04lb+5
         tgzO9EfBX/g3u5Gsvm8PfJbhPnGFGuaVPwU2HPueZbTOk7OddLGYfMuiY7W84tutbFgt
         0YBAaAFCkiVqis25ipgMlPBPpvdvDNZ0GzPZDfUBG334RbFMp3kfQetyAhj0huuhziQl
         wXUg==
X-Gm-Message-State: AOJu0YyUZenmpVxkIMMiAdPbaSoRjWFsNvLhUBkkQad84aZ6cyN7By8v
	qCl0V5R3ZK+g/iFjazcoFLMmR/7OolIKgpJgqdpdC35Q0aWXWE28CVD/xGRJ
X-Google-Smtp-Source: AGHT+IGRxAJGtH3zifNzogohybp6nlP7fmaKu8Blleuv70E1/YywIli5LqaULo5ZbihT8QEeXT/ZHg==
X-Received: by 2002:a05:600c:4589:b0:424:abef:e952 with SMTP id 5b1f17b1804b1-4257a05fa08mr56936375e9.29.1719929553972;
        Tue, 02 Jul 2024 07:12:33 -0700 (PDT)
Received: from [192.168.0.70] ([188.113.129.161])
        by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4256d664052sm190311485e9.27.2024.07.02.07.12.32
        for <submit@bugs.devuan.org>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Tue, 02 Jul 2024 07:12:33 -0700 (PDT)
Date: Wed, 03 Jul 2024 01:12:57 +1100
From: murzik <lorietta2023@gmail.com>
Subject: openrc: Incorrect handling of 'no_new_privs' in openrc-run
To: submit@bugs.devuan.org
Message-Id: <L520GS.458ZUPZ6DXCP3@gmail.com>
X-Mailer: geary/43.0
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="=-SyMU96NB4oB+1PMXweai"

[Message part 1 (text/plain, inline)]
Subject: openrc: Incorrect handling of 'no_new_privs' in openrc-run
Package: openrc
X-Debbugs-Cc: lorietta2023@gmail.com
Version: 0.45.2-2+deb12u1
Severity: grave
Justification: renders package unusable
Tags: patch

Dear Maintainer,
Supervise-daemon handler 
supervise_daemon.sh(/lib/rc/sh/supervise-daemon.sh) for openrc-run
has problems with handling the no_new_privs parameter!
at line 41 we have the following code:
  ${no_new_privs:+--no_new_privs} \
And there is no '--no_new_privs' option in supervise-daemon, only 
'--no-new-privs'.
So, line 41 should be replaced with
  ${no_new_privs:+--no-new-privs} \
But, this is not the only problem.
Instead of checking if 'no_new_privs' is set to positive boolean value, 
we are just checking if
its not empty! So, if there is 'no_new_privs=false'  or even 
'no_new_privs=BlaBla' in service file, we are setting '--no-new-privs'
flag anyway!
I think, the following code:
if ! yesno "$no_new_privs"; then
 no_new_privs=""
fi
should be added before line 23.
With that, everything works as excepted and there is no more 
'--no-new-privs' flag if
'no_new_privs' option is not positive boolean value.


-- System Information:
Distributor ID: Devuan
Description: Devuan GNU/Linux 5 (daedalus)
Release: 5
Codename: daedalus
Architecture: x86_64

Kernel: Linux 6.1.0-22-amd64 (SMP w/6 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN, TAINT_OOT_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), 
LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: OpenRC (via /run/openrc), PID 1: openrc-init

Versions of packages openrc depends on:
ii insserv 1.24.0-1
ii libaudit1 1:3.0.9-1
ii libc6 2.36-9+deb12u7
ii libeinfo1 0.45.2-2+deb12u1
ii libpam0g 1.5.2-6+deb12u1
ii librc1 0.45.2-2+deb12u1
ii libselinux1 3.4-1+b6

openrc recommends no packages.

Versions of packages openrc suggests:
pn policycoreutils <none>
pn sysvinit-core <none>

-- Configuration Files:
/etc/init.d/agetty [Errno 13] Permission denied: '/etc/init.d/agetty'
/etc/init.d/cgroups [Errno 13] Permission denied: '/etc/init.d/cgroups'
/etc/init.d/rc [Errno 13] Permission denied: '/etc/init.d/rc'
/etc/init.d/rcS [Errno 13] Permission denied: '/etc/init.d/rcS'
/etc/init.d/savecache [Errno 13] Permission denied: 
'/etc/init.d/savecache'
/etc/rc.conf changed [not included]

-- no debconf information

-- debsums errors found:
debsums: changed file /lib/rc/sh/supervise-daemon.sh (from openrc 
package)



[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.

Devuan BTS -- Powered by Debian bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.

Devuan Bugs Owner <owner@bugs.devuan.org>.
Last modified: Thu Sep 19 01:12:19 2024;