Forums before death by AOL, social media and spammers... "We can't have nice things"
|    linux.debian.bugs.dist    |    Ohh some weird Debian bug report thing    |    28,835 messages    |
[   << oldest   |   < older   |   list   |   newer >   |   newest >>   ]
|    Message 28,217 of 28,835    |
|    Alexandre Rossi to Michael Paoli    |
|    Bug#1128380: uwsgi[-core] insecure PID f    |
|    19 Feb 26 18:00:01    |
   
   From: niol@zincube.net   
      
   Hi,   
      
   On Thu Feb 19, 2026 at 5:49 AM CET, Michael Paoli wrote:   
   > My successfully tested workaround   
   > (at least covering use under mailman3-web):   
   >   
   > $ diff -U 4 /etc/init.d/mailman3-web{.BAK,}   
   > --- /etc/init.d/mailman3-web.BAK 2019-06-07 18:03:29.000000000 +0000   
   > +++ /etc/init.d/mailman3-web 2026-02-19 04:42:45.000000000 +0000   
   > @@ -33,8 +33,14 @@   
   > do_start () {   
   > start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON \   
   > --test >/dev/null|| return 1   
   >   
   > + # https://bugs.debian.org/1128380 work-around:   
   > + if [ -f $PIDFILE ]; then   
   > + chmod o-w $PIDFILE   
   > + else   
   > + (umask 022 && >> $PIDFILE)   
   > + fi   
   > start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON \   
   > -- $DAEMON_ARGS || return 2   
   > }   
   >   
   > $   
      
   uwsgi does not try to mess with umask of existing pidfiles. Should it? I'm   
   not sure how this is used by external scripts... My guess is that scripts   
   using uwsgi --pidfile should set umask as they wish and correctly cleanup   
   left over pidfiles if uwsgi crashes.   
      
   systemd users are clearly not concerned, not using pidfiles in default   
   conf.   
      
   Conclusion: I think mailman3-web needs fixing, maybe removing exiting pidfiles   
   before starting uwsgi, or using start-stop-daemon --remove-pidfile. But I'm   
   open to discussions, maybe looking at chmod'ing existing pidfiles at uwsgi   
   startup.   
      
   Thanks,   
      
   Alex   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)   
|
[   << oldest   |   < older   |   list   |   newer >   |   newest >>   ]
(c) 1994, bbs@darkrealms.ca