Package: sysvinit
Version: 2.88dsf-31
Severity: normal
sysvinit.postinst has the following code:
PID="$(pidof /sbin/init || true)"
[...]
kill -s USR1 "$PID"
But a normal user can cause "pidof /sbin/init" to produce more than
one output, e.g. with "chpst -b /sbin/init cat", or even (hoping for
some sort of race condition) "while true; do /sbin/init; done".
In that case, PID will be set to something like "1 15364", which means
that kill will fail with something like:
(bash):
kill: 1 15364: arguments must be process or job IDs
(dash):
kill: Illegal number: 1 23452
both return a non-zero error code, which will cause the maintainer
script to bail due to the "set -e", leaving a very cryptic message for
the upgrade.
It seems like a bad thing for a non-privileged user to be able to deny
the sysadmin the ability to effectively upgrade a package.
using pidof -s doesn't seem to fix things, because that is as likely
to return the non-privileged process ID as the privileged process ID.
If pidof could limit itself to only reporting on processes running as
a given user (the superuser in this case), that might avoid this
situation.
The core of the problem here is that argv[0] is an unreliable source
of information about what the proces actually is, since it is under
the control of the person running the process.
--dkg
-- System Information:
Debian Release: wheezy/sid
APT prefers testing
APT policy: (500, 'testing'), (200, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 3.2.0-3-686-pae (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages sysvinit depends on:
ii debianutils 4.3.2
ii initscripts 2.88dsf-31
ii libc6 2.13-35
ii libselinux1 2.1.9-5
ii libsepol1 2.1.4-3
ii sysv-rc 2.88dsf-31
ii sysvinit-utils 2.88dsf-31
sysvinit recommends no packages.
sysvinit suggests no packages.
-- no debconf information
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
