Re: New user for logcheck
Michael Stone wrote:
>
> On Sat, Nov 20, 1999 at 04:09:28PM +0000, Rene Mayrhofer wrote:
> > Logcheck is a new package in potato and it's purpose is to check the
> > system log files for unusal parts. It is a shell script that is run from
> > cron.
> > I got a suggestion for the logcheck package that I like. The suggestion
> > was that logcheck should run as an own uid with the gid 'adm' (so that
> > it can read the system log files). That would mean that a new uid is
> > needed (or does it make sense to use an existing one - I don't think
> > so).
> > Would that be a problem ?
>
> What does the new userid buy us? Does the script accept user input? Does
> it create files? What about running it as nobody?
The script does not accept user input, it runs periodically from cron,
but it creates files.
It is not possible to let logcheck run as nobody because it writes to a
temporary directory (/var/state/logcheck) that is not readable by
everyone. This is done because logcheck reads the system log files and
works on them in the temporary directory. If these created tmp files
were world readable, everybody could instantly read the system logs.
Because of that logcheck now runs as root, but it can also do it's work
with less rights (running with an own uid and gid 'adm'). I think that
daemons should only run with the rights the really need, thus minimizing
the risk of security holes.
greets,
Rene
Reply to: