Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Running daemon under nobody user is not recommended (Closes: #970045) #633

Open
wants to merge 1 commit into
base: 4.x
Choose a base branch
from
Open

Running daemon under nobody user is not recommended (Closes: #970045) #633

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions debian/control
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ Vcs-Browser: https://github.com/codership/galera
Package: galera-4
Architecture: any
Section: libs
Pre-Depends: adduser
Depends: ${misc:Depends},
${shlibs:Depends}
Conflicts: galera-3,
Expand Down
15 changes: 15 additions & 0 deletions debian/galera-4.lintian-overrides
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
#Teemu Ollakka Nov 17th, 2020:
# SONAME is useful only for libraries which are intended to be linked
# against, but not so much for libraries which are loaded dynamically
# during runtime.
#
# Debian policy about shared libraries:
# https://www.debian.org/doc/debian-policy/ch-sharedlibs.html
#
# "Shared libraries that are internal to a particular package or that are
# only loaded as dynamic modules are not covered by this section and are
# not subject to its requirements."
#
# This seems also be the approach CMake has taken, see for example
# https://stackoverflow.com/a/42186654
galera-4: sharedobject-in-library-directory-missing-soname [usr/lib/libgalera_smm.so]
15 changes: 15 additions & 0 deletions debian/galera-4.preinst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
#!/bin/bash

set -e
set -o nounset
set -o pipefail
set -o posix

# creating _galera user, note that the '_' (underscore) before the name of the
# user is a recommendation from
# https://www.debian.org/doc/debian-policy/ch-opersys.html#users-and-groups
getent passwd _galera >/dev/null 2>&1 ||
adduser --system --no-create-home --home /nonexistent \
--disabled-password --disabled-login --force-badname _galera

#DEBHELPER#
2 changes: 1 addition & 1 deletion garb/files/garb.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ WantedBy=multi-user.target
Alias=garbd.service

[Service]
User=nobody
User=_galera
ExecStart=/usr/bin/garb-systemd start

# Use SIGINT because with the default SIGTERM
Expand Down
4 changes: 2 additions & 2 deletions garb/files/garb.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ program_start() {
local rcode
if [ -f /etc/redhat-release ]; then
echo -n $"Starting $prog: "
daemon --user nobody $prog "$@" >/dev/null
daemon --user _galera $prog "$@" >/dev/null
rcode=$?
if [ $rcode -eq 0 ]; then
pidof $prog > $PIDFILE || rcode=$?
Expand All @@ -58,7 +58,7 @@ program_start() {
echo
else
log_daemon_msg "Starting $prog: "
start-stop-daemon --start --quiet -c nobody --background \
start-stop-daemon --start --quiet -c _galera --background \
--exec $prog -- "$@"
rcode=$?
# Hack: sleep a bit to give garbd some time to fork
Expand Down