Community Packages

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#24358 - [ushare] should not be run as root

Attached to Project: Community Packages
Opened by Andreas Radke (AndyRTR) - Friday, 20 May 2011, 09:52 GMT
Last edited by Sergej Pupykin (sergej) - Thursday, 07 July 2011, 10:51 GMT
Task Type Feature Request
Category Packages
Status Closed
Assigned To Sergej Pupykin (sergej)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:

ushare is currently packaged to run as root. this is a potential security leak. please change the package to run it as an unprivileged user. (see our other daemon packages, the wiki page for user/group numbers and maybe the Fedora pkg spec file how they do it)

Additional info:
* package version(s)
* config and/or log files etc.


Steps to reproduce:
This task depends upon

Closed by  Sergej Pupykin (sergej)
Thursday, 07 July 2011, 10:51 GMT
Reason for closing:  Fixed
Comment by Andreas Radke (AndyRTR) - Wednesday, 22 June 2011, 18:36 GMT
Using sudo -u ushare is a strange solution. Is there no better way to use ushare ownership for the files and process?

At least sudo dependency is missing in the current solution and so the rc.d script fails to work.
Comment by Sergej Pupykin (sergej) - Wednesday, 22 June 2011, 19:51 GMT
http://pkgs.fedoraproject.org/gitweb/?p=ushare.git;a=tree

fedora adds user on install and do 'daemon --user ushare ...' which calls su or sudo I think.
Comment by Sergej Pupykin (sergej) - Wednesday, 22 June 2011, 19:58 GMT
sudo dep added
Comment by Jorge Villaseñor (salinasv) - Wednesday, 06 July 2011, 19:20 GMT
  • Field changed: Percent Complete (100% → 0%)
This may be a good solution but it was not implemented that well.

Now I have a ushare user in my login manager + I'm not able to use ushare as "ushare" user because it doesn't have permissions to read my media content (because it is not part of users).

I think that at leaste -s /sbin/nologin must be added to the useradd command (from the fedora package) and some other fixes that I can't get now needs to be done to get ushare working.
Comment by Sergej Pupykin (sergej) - Thursday, 07 July 2011, 10:49 GMT
/bin/false changed to /sbin/nologin
/etc/conf.d/ushare contains USHARE_USER variable

Loading...