intelmq icon indicating copy to clipboard operation
intelmq copied to clipboard

intelmqctl create log file before dropping privileges

Open wagner-intevation opened this issue 2 years ago • 0 comments

Preconditions:

  • No log file $logdir/intelmqctl.log exists

intelmqctl is called as root instead of user intelmq, e.g. in setup scripts or by user error. The initialization of intelmqctl is able to degrade its permissions to user intelmq, but first it creates the logging file:

https://github.com/certtools/intelmq/blob/0221a2507b05dcccaea9ac239bb9e13fa48ce4bc/intelmq/bin/intelmqctl.py#L103-L121

which causes the file to have owner root.

Solution:

  • swap the logging creation and the privilege drop

wagner-intevation avatar May 17 '22 09:05 wagner-intevation