Your message dated Tue, 16 Jul 2024 16:57:46 +0100
with message-id <ZpaYelJ4O88WmhE1@???>
and subject line Re: bug#851: openrc: Incorrect handling of 'no_new_privs' in openrc-run
has caused the Devuan bug report #851,
regarding openrc: Incorrect handling of 'no_new_privs' in openrc-run
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@???
immediately.)


--
851: https://bugs.devuan.org/cgi/bugreport.cgi?bug=851
Devuan Bug Tracking System
Contact owner@??? with problems
Subject: openrc: Incorrect handling of 'no_new_privs' in openrc-run
Package: openrc
X-Debbugs-Cc: lorietta2023@???
Version: 0.45.2-2+deb12u1
Severity: grave
Justification: renders package unusable
Tags: patch

Dear Maintainer,
Supervise-daemon handler
supervise_daemon.sh(/lib/rc/sh/supervise-daemon.sh) for openrc-run
has problems with handling the no_new_privs parameter!
at line 41 we have the following code:
${no_new_privs:+--no_new_privs} \
And there is no '--no_new_privs' option in supervise-daemon, only
'--no-new-privs'.
So, line 41 should be replaced with
${no_new_privs:+--no-new-privs} \
But, this is not the only problem.
Instead of checking if 'no_new_privs' is set to positive boolean value,
we are just checking if
its not empty! So, if there is 'no_new_privs=false' or even
'no_new_privs=BlaBla' in service file, we are setting '--no-new-privs'
flag anyway!
I think, the following code:
if ! yesno "$no_new_privs"; then
no_new_privs=""
fi
should be added before line 23.
With that, everything works as excepted and there is no more
'--no-new-privs' flag if
'no_new_privs' option is not positive boolean value.


-- System Information:
Distributor ID: Devuan
Description: Devuan GNU/Linux 5 (daedalus)
Release: 5
Codename: daedalus
Architecture: x86_64

Kernel: Linux 6.1.0-22-amd64 (SMP w/6 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN, TAINT_OOT_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: OpenRC (via /run/openrc), PID 1: openrc-init

Versions of packages openrc depends on:
ii insserv 1.24.0-1
ii libaudit1 1:3.0.9-1
ii libc6 2.36-9+deb12u7
ii libeinfo1 0.45.2-2+deb12u1
ii libpam0g 1.5.2-6+deb12u1
ii librc1 0.45.2-2+deb12u1
ii libselinux1 3.4-1+b6

openrc recommends no packages.

Versions of packages openrc suggests:
pn policycoreutils <none>
pn sysvinit-core <none>

-- Configuration Files:
/etc/init.d/agetty [Errno 13] Permission denied: '/etc/init.d/agetty'
/etc/init.d/cgroups [Errno 13] Permission denied: '/etc/init.d/cgroups'
/etc/init.d/rc [Errno 13] Permission denied: '/etc/init.d/rc'
/etc/init.d/rcS [Errno 13] Permission denied: '/etc/init.d/rcS'
/etc/init.d/savecache [Errno 13] Permission denied:
'/etc/init.d/savecache'
/etc/rc.conf changed [not included]

-- no debconf information

-- debsums errors found:
debsums: changed file /lib/rc/sh/supervise-daemon.sh (from openrc
package)


On Mon, Jul 15, 2024 at 05:33:45PM +0100, Mark Hindley wrote:
> Control: tags -1 upstream
> Control: fixed -1 0.52.1-1

Closing as fixed.

Mark