On Thu, Nov 18, 2021 at 07:26:50PM +0100, Jonas Smedegaard wrote: > > Quoting Elliott Mitchell (2021-11-18 16:45:58) > > Appears the documentation for `start-stop-daemon` is misleading or > > wrong, and the "--exec" option is needed if "--startas" is given a > > pathname. > > This sounds like a bug in start-stop-daemon: please report against the > package dpkg which seems to provide start-stop-daemon, and provide more > details on how it fails to work. > > > > Might be this is an issue for me, but not others since the "radicale" > > user's shell had been set to `/bin/false`. As this is strongly > > recommended security hardening, the radicale package should work with > > a system setup this way. > > Not sure what you are saying here, but seems a separate issue (even if > affecting the other one). > > If you mean to say that using shell /usr/sbin/nologin for radicale > account is strongly discouraged, then please file a separate bugreport > about that - preferably with more details, as that is not obvious to me. > > Also, please file a separate bugreport if you believe radicale should > work with custom shell setting and fails to do so (but works without > such change). Because I agree that should work, and am surprised if it > doesn't (but I don't use sysV init system myself so cannot easily test).
My guess is this could be a documentation problem for `start-stop-daemon`. Based upon observed behavior, I suspect "--exec" changes to the appropriate user and then does an execve() of the specified executeable. Whereas "--startas" is instead executing the shell of the specified user with arguments as specified. The latter requires the shell be valid. Unless there is an overwhelmingly important reason for the radicale user's shell to be valid, it should instead be `/bin/false`. This though requires use of "--exec". Since Radicale appears to function properly when started with "--exec" that seems a vastly superior approach (doesn't result in security concerns). -- (\___(\___(\______ --=> 8-) EHM <=-- ______/)___/)___/) \BS ( | ehem+sig...@m5p.com PGP 87145445 | ) / \_CS\ | _____ -O #include <stddisclaimer.h> O- _____ | / _/ 8A19\___\_|_/58D2 7E3D DDF4 7BA6 <-PGP-> 41D1 B375 37D0 8714\_|_/___/5445
