{"action":"created","issue":{"url":"https://api.github.com/repos/inversepath/tenshi/issues/9","repository_url":"https://api.github.com/repos/inversepath/tenshi","labels_url":"https://api.github.com/repos/inversepath/tenshi/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/inversepath/tenshi/issues/9/comments","events_url":"https://api.github.com/repos/inversepath/tenshi/issues/9/events","html_url":"https://github.com/inversepath/tenshi/pull/9","id":254172139,"number":9,"title":"Daemonize earlier to avoid abusing root","user":{"login":"bldewolf","id":457295,"avatar_url":"https://avatars2.githubusercontent.com/u/457295?v=4","gravatar_id":"","url":"https://api.github.com/users/bldewolf","html_url":"https://github.com/bldewolf","followers_url":"https://api.github.com/users/bldewolf/followers","following_url":"https://api.github.com/users/bldewolf/following{/other_user}","gists_url":"https://api.github.com/users/bldewolf/gists{/gist_id}","starred_url":"https://api.github.com/users/bldewolf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bldewolf/subscriptions","organizations_url":"https://api.github.com/users/bldewolf/orgs","repos_url":"https://api.github.com/users/bldewolf/repos","events_url":"https://api.github.com/users/bldewolf/events{/privacy}","received_events_url":"https://api.github.com/users/bldewolf/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-08-31T00:18:26Z","updated_at":"2017-08-31T13:28:13Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/inversepath/tenshi/pulls/9","html_url":"https://github.com/inversepath/tenshi/pull/9","diff_url":"https://github.com/inversepath/tenshi/pull/9.diff","patch_url":"https://github.com/inversepath/tenshi/pull/9.patch"},"body":"While reviewing gentoo bug 626654, I noticed tenshi now starts tail as root instead of the specified user.  After digging, it looks like the fix for the pidfile bug grouped the priv drop/daemonizing/pidfile tasks into the daemonize() function but left it at the end of startup.  Since the other startup tasks need to be done with the lowered privs, this pull request moves the daemonize call to where the priv drop used to happen.\r\n\r\nUnfortunately, forking this early means tenshi will be unable to report errors or even startup status to the calling process when in daemonize mode.  This could be worked around but would require more time than I have right now."},"comment":{"url":"https://api.github.com/repos/inversepath/tenshi/issues/comments/326295033","html_url":"https://github.com/inversepath/tenshi/pull/9#issuecomment-326295033","issue_url":"https://api.github.com/repos/inversepath/tenshi/issues/9","id":326295033,"user":{"login":"abarisani","id":8976118,"avatar_url":"https://avatars2.githubusercontent.com/u/8976118?v=4","gravatar_id":"","url":"https://api.github.com/users/abarisani","html_url":"https://github.com/abarisani","followers_url":"https://api.github.com/users/abarisani/followers","following_url":"https://api.github.com/users/abarisani/following{/other_user}","gists_url":"https://api.github.com/users/abarisani/gists{/gist_id}","starred_url":"https://api.github.com/users/abarisani/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abarisani/subscriptions","organizations_url":"https://api.github.com/users/abarisani/orgs","repos_url":"https://api.github.com/users/abarisani/repos","events_url":"https://api.github.com/users/abarisani/events{/privacy}","received_events_url":"https://api.github.com/users/abarisani/received_events","type":"User","site_admin":false},"created_at":"2017-08-31T13:28:13Z","updated_at":"2017-08-31T13:28:13Z","author_association":"CONTRIBUTOR","body":"Sigh, this is way I was so reluctant to change the way things were (I don't consider the pidfile issue to be a \"bug\" that needed solving in tenshi, rather something that init scripts should check for).\r\n\r\nBeing unable to report errors and startup status is not acceptable, so I can't accept the pull request as it is I am afraid.\r\n\r\nShould we be that paranoid about the tail process? I'd assume that if tail can get compromised the issue would spawn far aboce the importance of tenshi, and I see no other ways of abusing the pipe between them.\r\n\r\nCouldn't users that care about this just use \"sudo\" in \"set tail\" to make it drop its privileges?\r\n\r\n(I'd agree that if we keep this behavior documentation should be adjusted however)"}}
{"actor":{"display_login":"abarisani"}}