8 Bře
2013
8 Bře
'13
22:04
Dear Knot developers,
I've been playing with Knot version 1.2.0-rc3, and run into a small
issue. Apologies if it has already been reported.
I'm using a configuration like this:
system {
...
...
user knot.knot;
}
log {
file "/var/log/knot/knot.log" { ... }
}
When I start Knot, it starts running as root, and creates the file
/var/log/knot/knot.log, as root. It then switches to the non-privileged
user "knot". Now it can no longer continue writing to the log file.
Could you please add some code (to go before it changes the UID) to
change the ownership of the log file to the user it is about to switch to?
Regards,
Anand
8 Bře
8 Bře
23:24
Anand,
thanks for reporting. I think the logfile needs to be created after the pribiledges are
dropped. Well include the fix into final 1.2.0.
Ondřej Surý
On 8. 3. 2013, at 22:04, Anand Buddhdev <anandb(a)ripe.net> wrote:
Dear Knot developers,
I've been playing with Knot version 1.2.0-rc3, and run into a small
issue. Apologies if it has already been reported.
I'm using a configuration like this:
system {
...
...
user knot.knot;
}
log {
file "/var/log/knot/knot.log" { ... }
}
When I start Knot, it starts running as root, and creates the file
/var/log/knot/knot.log, as root. It then switches to the non-privileged
user "knot". Now it can no longer continue writing to the log file.
Could you please add some code (to go before it changes the UID) to
change the ownership of the log file to the user it is about to switch to?
Regards,
Anand
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
23:45
On 08/03/2013 23:24, Ondřej Surý wrote:
Anand,
thanks for reporting. I think the logfile needs to be created after
the pribiledges are dropped. Well include the fix into final 1.2.0.
Hi Ondrej,
If the log file is created after privileges are dropped, then the first
few log entries (such as binding to interface) would have nowhere to go.
So you should still consider changing the ownership just before dropping
privileges.
As a compromise, perhaps Knot could log those lines to syslog, and then
switch to the log file (similar to what BIND does on startup), but
that's kind of messy too, with log entries in different places.
Regards,
Anand
11 Bře
11 Bře
13:56
Hi Anand,
well spotted. I agree that it's better to change logfiles ownership
before dropping privileges.
I have fixed it in the git, and it will be present in the next release shortly.
Kind regards,
Marek
On 8 March 2013 23:45, Anand Buddhdev <anandb(a)ripe.net> wrote:
On 08/03/2013 23:24, Ondřej Surý wrote:
Anand,
thanks for reporting. I think the logfile needs to be created after
the pribiledges are dropped. Well include the fix into final 1.2.0.
Hi Ondrej,
If the log file is created after privileges are dropped, then the first
few log entries (such as binding to interface) would have nowhere to go.
So you should still consider changing the ownership just before dropping
privileges.
As a compromise, perhaps Knot could log those lines to syslog, and then
switch to the log file (similar to what BIND does on startup), but
that's kind of messy too, with log entries in different places.
Regards,
Anand
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
4072
days inactive
4075
days old
3 comments
3 participants
participants (3)
-
Anand Buddhdev -
Marek Vavruša -
Ondřej Surý