Hi!

I just noticed a pid file that only root can read. There is no
sensitive information there, and it prevents normal users to check for
the service status for example.

It would be nice if adequate could check for pid files to be
world-readable. I'm not sure how it would match the pacakge with the
pid filename though?

Thanks,
Guillem

* Guillem Jover <guillem@debian.org>, 2015-11-19, 22:41:

Hmm, I'm not sure there's consensus that all pid files should be
world-readable. Could you ask on debian-devel?

Maybe something like this?

dpkg -S $(readlink /proc/$(cat /path/to/pidfile)/exe)

But it's not pretty, and it would work only for the root user, and
wouldn't work for scripts...

hola Guillem, bon dia ;)

do you think that this bug is still relevant, especially with most daemons now
being handled internally by systemd? if so, can you please point me to a
specific package with non-readable pid file(s)?

gràcies,
Serafeim

tags 805592 moreinfo

Hola!

Personally I think portability is very important, and systemd being
Linux-only, it means any other port cannot rely or make use of it.

And I still think that these pid files are buggy, yes. :)

On a bookworm system, I just listed what I had on /run and noticed,
dovecot, fail2ban and smartd for example.

Salut,
Guillem