[prev in list] [next in list] [prev in thread] [next in thread] 

List:       jakarta-commons-user
Subject:    [daemon] init method runs as downgraded user when the -user option is used with jsvc
From:       AGRO AGRO <agro-29 () hotmail ! com>
Date:       2014-03-14 9:19:52
Message-ID: BLU174-W10B84AA5C0E7CBD95B0A5CF2700 () phx ! gbl
[Download RAW message or body]


I've pretty much resigned to the fact that jsvc doesn't work as documented, \
specifically:

Daemon : Java Service
Downgrading user
On Linux setuid()/setgid() + capabilities are used. On other unix setgid/initgroups \
are used. We have something like: /* as root */
init_JVM().
load_service. /*  java_load() calls the load method */
downgrade user (set_caps() or set_user_group())
/* as the user $USER (from -user $USER parameter) */
umask()
start_service. /* java_start() calls the start method */
http://commons.apache.org/proper/commons-daemon/jsvc.html

This document should probably read:

Downgrading user
On Linux setuid()/setgid() + capabilities are used. On other unix setgid/initgroups \
are used. We have something like: /* as root */
downgrade user (set_caps() or set_user_group())
/* as the user $USER (from -user $USER parameter) */
init_JVM().
load_service. /*  java_load() calls the init method */
umask()
start_service. /* java_start() calls the start method */

The only avenue I wasn't able to exhaustively evaluate was loading the capability \
module. From what I can tell, this module was removed from a kernel version around \
2.6.x and, since I'm using 3.10.x, I wasn't able to locate and load this module, \
which I'm not confident would have resulted in jsvc operating according to its \
documentation anyway.

To: user@commons.apache.org
Subject: [daemon]
Date: Fri, 7 Mar 2014 20:35:35 +1100

Hi,
    I'm using Daemon in a Java program on Linux using jsvc and find that, when using \
the -user option, the init method runs as the specified user rather than the user \
that launched jsvc, which according to the documentation and in my case is root. I \
have tried implementing this by implementing the Daemon interface and also the Direct \
way. If I understand the documentation correctly, when using the -user option, the \
init method is supposed to run as the calling user and then the process is forked and \
setuid is used to downgrade the process at which point the start method is called and \
runs as the non-privileged user specified by the user option, but this is not the \
behaviour I'm experiencing. I've compiled jsvc version 1.0.15 and am using Sun Java \
1.7.0_45. When I run jsvc with the debug option, the output indicates it has changed \
the user to the non-privileged user before initialising the JVM. If I remove the \
-user option and run jsvc as root the code executed by the start method has elevated \
privilidges i.e. those of the root account. Is this expected behaviour, a bug or \
something I'm doing wrong?   



[prev in list] [next in list] [prev in thread] [next in thread]