irrdnet / irrd

IRRd version 4
http://irrd.readthedocs.io/en/stable/
Other
157 stars 52 forks source link

Fix #937 - Fix incorrect log access check in setuid startup #941

Closed mxsasha closed 7 months ago

mxsasha commented 7 months ago

Introduced in #666

tangledhelix commented 7 months ago

@mxsasha This seems it will cover the case I described. I haven't tested again, but what would happen with this code, if you have this situation:

Would that be handled properly? In that case the unprivileged user cannot write to the file, e.g.:

❯ ls -la
total 16
drwxr-xr-x  2 dan  eng   4096 Apr 25 15:17 .
drwxr-xr-x 62 dan  eng  12288 Apr 25 15:17 ..
-rw-r--r--  1 root root     0 Apr 25 15:17 myfile

❯ echo "test" >> myfile
zsh: permission denied: myfile

The unprivileged user could delete the file and create a new one, in this situation, but I don't see that in the code. So I wonder if this change would result in the server starting up without complaint, but then either failing later because it can't write to the logfile, or else silently failing to log due to permissions?

mxsasha commented 7 months ago

Yes, this would cause the same failure #666 was meant to prevent. I think we should add that check too - though #666 was mostly meant to help people avoid a somewhat common misconfiguration, not catch every scenario :)