Your message dated Sun, 24 Jul 2022 16:50:24 +0000 with message-id <e1ofeoc-000faf...@fasolo.debian.org> and subject line Bug#1015765: fixed in openrc 0.45.2-1 has caused the Debian Bug report #1015765, regarding openrc: command_user flag in openrc-run does not function properly to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 1015765: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1015765 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: openrc Version: 0.42-2.1 Severity: grave Tags: newcomer security Justification: user security hole Dear Maintainer, I am coming from Devuan and was advised to submit a bug report here as the package is identical. I hope this will not be a problem. In any case, openrc-run's command_user flag does not function properly. If both a user and group are specified, an error is returned: "start-stop-daemon: user '$user:$group' not found", even if that user and group exist. If only the user is specified, the script will run, but as root, rather than as the user specified (which is the intended behavior); the username specified is then passed to the command run as an argument (not intended behavior). I was able to make this option work as intended by editing /lib/rc/sh/start-stop-daemon.sh, and changing --user in line 58 to --chuid. I have not submitted a PR because in upstream, --chuid is being deprecated in favor of --user, which does the same thing and therefore there is no issue. On Debian, however, these flags apparently do different things, which causes this problem. I don't understand very well Debian's package's differences from upstream or why this difference exists, but I assume it may be desirable to increase compatibility with upstream (though again, I don't know what the rationale for the current state of things is). That being said, simply changing --user to --chuid would be a fairly simple fix, and since I understand openrc is no longer maintained, this may be the best option. In case it's helpful, one of the Devuan maintainers found this issue on OpenRC's github, reporting the same issue: https://github.com/OpenRC/openrc/issues/383. I assume this was never reported. Best, Adam
--- End Message ---
--- Begin Message ---Source: openrc Source-Version: 0.45.2-1 Done: Mark Hindley <lee...@debian.org> We believe that the bug you reported is fixed in the latest version of openrc, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1015...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Mark Hindley <lee...@debian.org> (supplier of updated openrc package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sun, 24 Jul 2022 15:32:06 +0100 Source: openrc Architecture: source Version: 0.45.2-1 Distribution: unstable Urgency: medium Maintainer: OpenRC Debian Maintainers <ope...@packages.debian.org> Changed-By: Mark Hindley <lee...@debian.org> Closes: 973245 1015765 Changes: openrc (0.45.2-1) unstable; urgency=medium . * d/watch: update to version 4 and fix path. * New upstream version 0.45.2 - includes fix for CVE-2018-21269 (Closes: #973245). * d/control: - add myself to uploaders. - bump debhelper compat to 13. - add Build-Depends meson, pkg-config. - bump Standards Version to 4.6.1 (no changes). * debian/patches: - remove obsolete d/p/0001-no-rpath.patch. - delete patches applied upstream. - convert to meson - refresh. * d/rules: - convert to meson - override libexecdir to keep existing non-multiarch path. - cleanup and remove cruft. * Simplify d/rules and multiarch handling with dh-exec. * Install bash and zsh completions. * d/not-installed: add uninstalled files. * .gitignore backup files. * d/openrc.lintian-overrides: - update changed tag name. - update to pointed format. - remove unused override. * sh/start-stop-daemon.sh: use src:dpkg s-s-d compatible --chuid (Closes: #1015765). Checksums-Sha1: 960a37fa530d1e6eea59a7fc3e22a7956e415450 2283 openrc_0.45.2-1.dsc f61b8f40e9b2bd94a09a2ddd834d42c76a45b2d4 192020 openrc_0.45.2.orig.tar.xz 64a6daac79f69a67b41646d156f83a9bf37c2c03 24820 openrc_0.45.2-1.debian.tar.xz 04f4357d0257c144d67a68f1d5aa25695204d4f3 9205 openrc_0.45.2-1_amd64.buildinfo Checksums-Sha256: d3463a04d868c3c6c7416c2186b4676713bc7e11a64a1cbb4363ed525aa9a761 2283 openrc_0.45.2-1.dsc 2a47fbf6ef2d252bbee1232e7626f8cc445eaeeeabb49ced1e7b0d598dafeb66 192020 openrc_0.45.2.orig.tar.xz ae0aaeb164e701fcfe4f3228aecd09aefd032cd51653149a1cbb9d9e20f606d2 24820 openrc_0.45.2-1.debian.tar.xz 88b33ee6075f3cc5089ac0ad782ec020cf8173303f6fef82bfe6c68b56e7e7fd 9205 openrc_0.45.2-1_amd64.buildinfo Files: 9707f0f464c446b72050ffaff3c94b9d 2283 admin optional openrc_0.45.2-1.dsc 66c00b46950bf954d3e47b68999aa44a 192020 admin optional openrc_0.45.2.orig.tar.xz 0bacb081ef0275873328d96e0eea79bc 24820 admin optional openrc_0.45.2-1.debian.tar.xz acca86f8c757dacde74107ca2da3f53b 9205 admin optional openrc_0.45.2-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEUGwVpCsK9aCoVCPu0opFvzKH1kkFAmLdczEACgkQ0opFvzKH 1kljixAAoSSfckl/l3mP3JcClslCUAW9lbQbFHlLW+6pJaRy/ro4mV7G62MBeEpU fDMTZ8kwduibkbVjDetz3/hbIyUEN/dHXDH3apkAVs4OBXWEXhE9jY5VWAEKd+w6 mu2K1U/oQ0CO/GESKXSqJwAwoCaNtxJj3F5L8NfcfG4W40gpU5oUHZkZwddOPatf BuCnrlJjq4MdP1YHgWSLQRrrFQDe6KHlF0H/IVaD9AaXw6A//k3ZD6+KZ7Okh3OK 8EvKDli9SNp4g9AAPT1OsDXmlEVJ4nBeLTB3IQRdhgoDyIt64Kkq30wv2+a4rI48 QaObwFbZNshUsX5WeF5MiBSOKL1hREzk9Nsh2W0Zhdtfk1qfR0tfKd1/VcU/P8LR f10TYMQ0yYV645OmYT448j0Eh7Bnw0Ss1XIWWWqJa6Fq4dr988qGzRt2fD7S/2ax haWIJTGvWKZXQfvXFkTdZKqyrEqJwY4BO4LrQo9oqLggE/Bl8ciHqrubGZmmo0Fn NO5fgf782PALE5QK9RTyGfTAWHVrzY4pZHgaSp2HAhr3ny+RDLQJ6QudHZNAIWiL KjbhSThG/ag0l5V2dcXgoHU2Miph6yuTouhEi9x0J27sKmXVCK1wI43LvxWnvQK+ 3DZAOhOJGDef/cXXLlJK0zPKCUVUaKeOVYlTi3GvNU96EXvI+m4= =VWC4 -----END PGP SIGNATURE-----
--- End Message ---
