Subject: bug#55450: closed (Re: bug#55450: bitlbee running as root)

From: [email-masked] (GNU bug Tracking System)
Date: Mon, 16 May 2022 13:54:02 +0000

Your bug report

#55450: bitlbee running as root

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
55450: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=55450
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#55450: bitlbee running as root
From: Ludovic Courtès <[email-masked]>
To: [email-masked]
Date: Mon, 16 May 2022 15:53:42 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Ludovic Courtès <[email-masked]> skribis:

> Starting from commit 211fe3f66e6dfdaa64974931c458ab1d92afc182, if PID 1
> is Shepherd 0.9.0, the bitlbee daemon was started on-demand as an inetd
> service.
>
> However, due to a logic bug, it was running as root (in a separate user
> namespace though) instead of running as “bitlbee”.  The bug is that we
> were spawning “bitlbee -u bitlbee” as root; normally, bitlbee would
> setuid to the “bitlbee” user early on, but since it was in a separate
> namespace and with a minimal /etc/passwd, it couldn’t do anything and
> kept the current UID (that UID was 1000 inside the user namespace, but 0
> outside).

Fixed by commit ecfcdff23a5ce390a7edc019c1f1216c4843dc04: the bitlbee
process is now started as “bitlbee” right from the start.

I reviewed other users of ‘least-authority-wrapper’ that were recently
introduced and didn’t see other mistakes of that kind.  You’re welcome
to take another look to make sure!

Ludo’.

Subject: bitlbee running as root
From: Ludovic Courtès <[email-masked]>
To: [email-masked]
Date: Mon, 16 May 2022 15:30:18 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Starting from commit 211fe3f66e6dfdaa64974931c458ab1d92afc182, if PID 1
is Shepherd 0.9.0, the bitlbee daemon was started on-demand as an inetd
service.

However, due to a logic bug, it was running as root (in a separate user
namespace though) instead of running as “bitlbee”.  The bug is that we
were spawning “bitlbee -u bitlbee” as root; normally, bitlbee would
setuid to the “bitlbee” user early on, but since it was in a separate
namespace and with a minimal /etc/passwd, it couldn’t do anything and
kept the current UID (that UID was 1000 inside the user namespace, but 0
outside).

Fix coming soon…

Ludo’.