Re: Parfait and UoM (java) RPM packages

Hi,

On 2016-10-19 17:30, Frank Ch. Eigler wrote:
> 
>> Hmm, when starting first instance of the might HelloWorld test case and
>> monitoring mmv.HelloWorld.java.uptime for a while, I see the expected
>> uptime:
>> [...]
>> But when starting second instance, this happens:
>> # pminfo -f mmv.HelloWorld.java.uptime
>> [...]
> 
>> It seems that any user who is able (*) to start the same application can
>> "override" the metrics for everyone else.
>>
>> *) Btw, what's the recommended way to enable MMV for non-root users? I did
>> # mkdir -p /var/lib/pcp/tmp/mmv
>> # chgrp testuser /var/lib/pcp/tmp/mmv
>> # chmod g+rwx /var/lib/pcp/tmp/mmv
>> [...]
> 
> See [man pmdammv] for some discussion of the security aspects.  The
> current mmv ./Install script includes this bit:
> 
> if [ ! -e "$PCP_TMP_DIR/mmv" ]
> then
>     echo "creating $PCP_TMP_DIR/mmv"
>     mkdir -p -m 1777 "$PCP_TMP_DIR/mmv"
> fi
> 
> which makes the mmv directory world-writeable.  The sticky bit should
> prevent users from overwriting each other's files.  There are other
> security concerns (DoS, namespace squatting, etc.) that are not addressed.

Hmm, there's something else in the play as well; after uninstalling all
PCP packages, removing /var/lib/pcp and reinstalling, I see by running
"pcp" that MMV is enabled but /var/lib/pcp/tmp/mmv does not exist.
However, after starting as root our favorite Java program, I see:

# stat /var/lib/pcp/tmp/mmv | grep -m1 Access
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)

If the directory does not exist, non-root gets an error that can't
create the directory. If the dir has perms 1777 then root can override a
regular user's MMV file. And as you mention, anyone else starts the
application first, then any non-root user can't start the application
due to being unable to remove the file.

The man page certainly should be clarified.

Cheers,

-- 
Marko Myllynen

-=-=-=-=-=-=-=-=-=-=-=-
pcp mailing list
[email protected]
https://groups.io/g/pcp/messages
-=-=-
Groups.io Links:

You receive all messages sent to this group.

View/Reply Online (#14549): https://groups.io/g/pcp/message/14549
View All Messages In Topic (13): https://groups.io/g/pcp/topic/2895998
Mute This Topic: https://groups.io/mt/2895998?uid=174580
New Topic: https://groups.io/g/pcp/post

Change Your Subscription: https://groups.io/g/pcp/editsub?uid=174580

Group Home: https://groups.io/g/pcp
Contact Group Owner: [email protected]

Terms of Service: https://groups.io/static/tos

Unsubscribe: https://groups.io/g/pcp/leave/354243/563757577/xyzzy
-=-=-=-=-=-=-=-=-=-=-=-