Re: pid file security

[Goswin von Brederlow <goswin-v-b@web.de>]

Stéphane Glondu <glondu@debian.org> writes:

> Yves-Alexis Perez a écrit :
>> And you usually need root access for invoke-rc.d or /etc/init.d scripts
>> (unless you have some kind of specific sudo permissions for that). So
>> you might be able to kill other process as well.
>
> I guess one (be it a human operator or a monit-like daemon) can be
> easily fooled into restarting a service without checking.
>
>
> Cheers,

If monit, runit, upstart, heartbeat or whatever is used to monitor
daemons does call stop+start then it is trivial. You are already the
user the daemon runs under (or you wouldn't have write permissions to
the pidfile) so just kill it. The next monitor run will then stop the
pid you wrote and restart the normal daemon wiping any trace of what you
did.

MfG
        Goswin