[chrony-dev] Wrong owner/group of /var/run/chrony

[Bryan Christianson <bryan@xxxxxxxxxxxxx>]

> On 13/08/2015, at 2:14 am, git@xxxxxxxxxxxxx wrote:
> 
> 
> 
> commit f1ed08abf020cec229af6d60104d37d5ee288ef6
> Author: Miroslav Lichvar <mlichvar@xxxxxxxxxx>
> Date:   Tue Aug 11 17:41:02 2015 +0200
> 
>    conf: create directory for Unix domain command socket
> 
>    Try to create the directory where will be the Unix domain command socket
>    bound to allow starting with empty /var/run. Check the permissions and
>    owner/group in case the directory already existed. It MUST NOT be
>    accessible by others as permissions on Unix domain sockets are ignored
>    on some systems (e.g. Solaris).
> 
> 

I'm getting the following at chronyd startup

2015-08-12T19:48:04Z Wrong owner/group of /var/run/chrony
2015-08-12T19:48:04Z Disabled command socket /var/run/chrony/chronyd.sock

/var/run/chrony does not exist and is being created by chronyd

On MacOS, /var/run (existing system directory) has permissions:
sh-3.2# ls -ld /var/run
drwxrwxr-x  34 root  daemon  1156 13 Aug 07:34 /var/run

and from the mkdir (2) man page
DESCRIPTION
     The directory's owner ID is set to the process's effective user ID.  The
     directory's group ID is set to that of the parent directory in which it
     is created.


Then in util.c create_dir() we have

  /* Change its ownership if requested */
  if ((uid || gid) && chown(p, uid, gid) < 0) {
    LOG(LOGS_ERR, LOGF_Util, "Could not change ownership of %s : %s", p, strerror(errno));
    /* Don't leave it there with incorrect ownership */
    rmdir(p);
    return 0;
  }

i.e. The directory was just created by mkdir with uid 0, gid 1 (gid 1 is daemon) but because we are requesting gid and uid to be 0, the chown() is not made.

This is followed by failure in UTI_CheckDirPermissions() because the newly created directory permissions do not match uid 0, gid 0

Maybe the call to chown() should just be unconditional

-- 
Bryan Christianson

 
--
To unsubscribe email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "unsubscribe" in the subject.
For help email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "help" in the subject.
Trouble?  Email listmaster@xxxxxxxxxxxxxxxxxxxx.