Bug#924312: marked as done (stunnel4: Fails to stop with sysvinit: start-stop-daemon: matching only on non-root pidfile /var/lib/stunnel4///stunnel4.pid is insecure)

This is a multi-part message in MIME format...

------------=_1552511347-31612-2
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

Your message dated Wed, 13 Mar 2019 21:04:19 +0000
with message-id <[email protected]>
and subject line Bug#921558: fixed in lsb 10.2019031300
has caused the Debian Bug report #921558,
regarding stunnel4: Fails to stop with sysvinit: start-stop-daemon: matchin=
g only on non-root pidfile /var/lib/stunnel4///stunnel4.pid is insecure
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


--=20
921558: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D921558
Debian Bug Tracking System
Contact [email protected] with problems

------------=_1552511347-31612-2
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at submit) by bugs.debian.org; 11 Mar 2019 13:23:10 +0000
X-Spam-Checker-Version: SpamAssassin 3.4.2-bugs.debian.org_2005_01_02
	(2018-09-13) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-20.6 required=4.0 tests=BAYES_00,FOURLA,
	FROMDEVELOPER,HAS_PACKAGE,HEADER_FROM_DIFFERENT_DOMAINS,TXREP,
	X_DEBBUGS_CC autolearn=ham autolearn_force=no
	version=3.4.2-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 50; hammy, 150; neutral, 246; spammy,
	0. spammytokens: hammytokens:0.000-+--H*F:U*abe, 0.000-+--libsystemd0,
	0.000-+--IIRC, 0.000-+--cutf8, 0.000-+--CUTF8
Return-path: <[email protected]>
Received: from kote1.ethz.ch ([129.132.74.21])
	by buxtehude.debian.org with esmtp (Exim 4.89)
	(envelope-from <[email protected]>)
	id 1h3Kta-0001Ke-2M
	for [email protected]; Mon, 11 Mar 2019 13:23:10 +0000
Received: by kote1.ethz.ch (Postfix, from userid 1000)
	id 731908010; Mon, 11 Mar 2019 14:15:25 +0100 (CET)
From: Axel Beckert <[email protected]>
To: Debian Bug Tracking System <[email protected]>
Subject: stunnel4: Fails to stop with sysvinit: start-stop-daemon: matching only on non-root pidfile /var/lib/stunnel4///stunnel4.pid is insecure
X-Debbugs-CC: Axel Beckert <[email protected]>, Guillem Jover <[email protected]>
Date: Mon, 11 Mar 2019 14:15:25 +0100
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain
Delivered-To: [email protected]

Package: stunnel4
Version: 3:5.50-3
Severity: serious

stopping or restarting stunnel4 on systems with sysvinit (or probably
also any other init system using start-stop-daemon) fails as follows for
me:

 invoke-rc.d stunnel4 restart
Restarting TLS tunnels: /etc/stunnel/stunnel.conf: /sbin/start-stop-daemon: matching only on non-root pidfile /var/lib/stunnel4///stunnel4.pid is insecure
stopped

And despite it claims at the end "stopped", stunnel is not stopped as ps
shows:

stunnel4 26991  0.0  0.0  87196   156 ?        Ssl  Jan21   0:00 /usr/bin/stunnel4 /etc/stunnel/stunnel.conf

This is caused by the following change in dpkg 1.19.3 from 22 Jan 2019:

  * start-stop-daemon: Check whether standalone --pidfile use is secure.
    Prompted by Michael Orlitzky <[email protected]>.

The usual fix seems to be to also specify the binary to be stopped with
IIRC the --exec option.

-- System Information:
Debian Release: buster/sid
  APT prefers unstable
  APT policy: (990, 'unstable'), (600, 'testing'), (500, 'unstable-debug'), (500, 'buildd-unstable'), (110, 'experimental'), (1, 'experimental-debug'), (1, 'buildd-experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.18.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)
LSM: AppArmor: enabled

Versions of packages stunnel4 depends on:
ii  adduser      3.118
ii  libc6        2.28-8
ii  libssl1.1    1.1.1b-1
ii  libsystemd0  241-1
ii  libwrap0     7.6.q-28
ii  lsb-base     10.2018112800
ii  netbase      5.6
ii  openssl      1.1.1b-1
ii  perl         5.28.1-4

stunnel4 recommends no packages.

Versions of packages stunnel4 suggests:
pn  logcheck-database  <none>

-- Configuration Files:
/etc/stunnel/stunnel.conf changed:
; Sample stunnel configuration file by Michal Trojnara 2002-2009
; Some options used here may not be adequate for your particular configuration
; Please make sure you understand them (especially the effect of the chroot jail)
; Certificate/key is needed in server mode and optional in client mode
;cert = /etc/ssl/certs/stunnel.pem
;key = /etc/ssl/certs/stunnel.pem
; Protocol version (all, SSLv2, SSLv3, TLSv1)
sslVersion = TLSv1
; Some security enhancements for UNIX systems - comment them out on Win32
chroot = /var/lib/stunnel4/
setuid = stunnel4
setgid = stunnel4
; PID is created inside the chroot jail
pid = /stunnel4.pid
; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
;compression = zlib
; Workaround for Eudora bug
;options = DONT_INSERT_EMPTY_FRAGMENTS
; Authentication stuff
;verify = 2
; Don't forget to c_rehash CApath
; CApath is located inside chroot jail
;CApath = /certs
; It's often easier to use CAfile
;CAfile = /etc/stunnel/certs.pem
; Don't forget to c_rehash CRLpath
; CRLpath is located inside chroot jail
;CRLpath = /crls
; Alternatively you can use CRLfile
;CRLfile = /etc/stunnel/crls.pem
; Some debugging stuff useful for troubleshooting
;debug = 7
;output = /var/log/stunnel4/stunnel.log
; Use it for client mode
;client = yes
; Service-level configuration
;[pop3s]
;accept  = 995
;connect = 110
;[imaps]
;accept  = 993
;connect = 143
;[ssmtp]
;accept  = 465
;connect = 25
;[https]
;accept  = 443
;connect = 80
;TIMEOUTclose = 0
[bbs]
;accept  = localhost:1984
accept  = 127.0.0.1:1984
connect = sym.noone.org:1983
client = yes
[bbs2]
;accept  = localhost:1984
accept  = 127.0.0.2:1984
connect = c3pio.deuxchevaux.org:1983
client = yes
; vim:ft=dosini


-- no debconf information

------------=_1552511347-31612-2
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at 921558-close) by bugs.debian.org; 13 Mar 2019 21:04:22 +0000
X-Spam-Checker-Version: SpamAssassin 3.4.2-bugs.debian.org_2005_01_02
	(2018-09-13) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-23.6 required=4.0 tests=BAYES_00,DIGITS_LETTERS,
	FROMDEVELOPER,FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,
	PGPSIGNATURE,RCVD_IN_DNSWL_MED,TXREP autolearn=ham autolearn_force=no
	version=3.4.2-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 72; hammy, 150; neutral, 108; spammy,
	0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK,
	0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload,
	0.000-+--Hx-spam-relays-external:sk:envelop, 0.000-+--H*r:138.16.160
Return-path: <[email protected]>
Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33])
	from C=NA,ST=NA,L=Ankh Morpork,O=Debian SMTP,OU=Debian SMTP CA,CN=muffat.debian.org,[email protected] (verified)
	by buxtehude.debian.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.89)
	(envelope-from <[email protected]>)
	id 1h4B2z-0007m1-SZ
	for [email protected]; Wed, 13 Mar 2019 21:04:21 +0000
Received: from fasolo.debian.org ([138.16.160.17])
	from C=NA,ST=NA,L=Ankh Morpork,O=Debian SMTP,OU=Debian SMTP CA,CN=fasolo.debian.org,[email protected] (verified)
	by muffat.debian.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.89)
	(envelope-from <[email protected]>)
	id 1h4B2y-0003eu-KO; Wed, 13 Mar 2019 21:04:20 +0000
Received: from dak by fasolo.debian.org with local (Exim 4.89)
	(envelope-from <[email protected]>)
	id 1h4B2x-000Azv-6v; Wed, 13 Mar 2019 21:04:19 +0000
From: Didier Raboud <[email protected]>
To: [email protected]
X-DAK: dak process-upload
X-Debian: DAK
X-Debian-Package: lsb
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Subject: Bug#921558: fixed in lsb 10.2019031300
Message-Id: <[email protected]>
Date: Wed, 13 Mar 2019 21:04:19 +0000

Source: lsb
Source-Version: 10.2019031300

We believe that the bug you reported is fixed in the latest version of
lsb, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Didier Raboud <[email protected]> (supplier of updated lsb package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 13 Mar 2019 21:42:26 +0100
Source: lsb
Architecture: source
Version: 10.2019031300
Distribution: unstable
Urgency: low
Maintainer: Debian LSB Team <[email protected]>
Changed-By: Didier Raboud <[email protected]>
Closes: 921558
Changes:
 lsb (10.2019031300) unstable; urgency=low
 .
   [ Dmitry Bogatov ]
   * init-functions: in killproc, pass '--name' to start-stop-daemon
     (Closes: #921558)
Checksums-Sha1:
 ba44df4600d285880f68e50cb271e324c42ce3c7 1695 lsb_10.2019031300.dsc
 1635aec3dc49e88e6f0761bdfbcd1b32946762d0 42132 lsb_10.2019031300.tar.xz
Checksums-Sha256:
 7b71ba5ea22d9d650d4066aeff92f63b2795e02b2b23b8f2ad4328b02a67e646 1695 lsb_10.2019031300.dsc
 a956c45c7e0830b9c9a17407ed91c3373972493cead42b9c4dc53a8619a3898a 42132 lsb_10.2019031300.tar.xz
Files:
 523af3064863251feef1391e2aad0744 1695 misc extra lsb_10.2019031300.dsc
 c19e974983e70abcb128ed03999023b7 42132 misc extra lsb_10.2019031300.tar.xz

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEEe+WPIRpjNw1/GSB7i8+nHsoWNFUFAlyJbCUACgkQi8+nHsoW
NFWwaQv/VT0mLI+9BRMz5WL7idk11YSzBQj7msbocPUFF0u9L/wj8lk1FFUgaXeV
SlszkjmT6snzjR1RjvTdlVIe7YosXHu73u3fsq+WsvV3DRU7anx3sL+rRCTmh1Hk
g360mPzwmNvfDgHYuymnESEbV96qSCWhcmiBwKuta3QnBDcBYrJUbeLGDkXsLmuB
r0T6gNSel5Nmwn+yX+e7kR1Vv6o0X31fa0O/HVg2Fi+Nf9Z8VA9NP3GN2QqlXV7L
vYEY0w1gMROy1om88Ixkcszdeew19K2rnSb3beWQ93fYZsErvjv5W1gjGtl68GV6
pg/q/k20ybHhrjsoMS7XgsmiC1IIkcfXmWodcWrqyoaYLOfgfxjxvU8D82X3+Njd
nnp43nTjy4JijoYikKqMT+diFzTan3OxiurMq6vQ0CQ5oo3PbHS6eafW8m3fbENs
MibXktv3S9nkqiLCUcV+/n+Q5zEM3WmhAd6Gt6kTFrvP4pGm5bDhI47RgY3U1EX5
F1IPmL4L
=xeQT
-----END PGP SIGNATURE-----
------------=_1552511347-31612-2--