From 695042ff108f57fa190852f3fe1f06b2b1f6c967 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= Date: Thu, 11 May 2023 10:23:30 +0200 Subject: [PATCH] services: syslog: Do not call 'umask' in PID 1. Fixes a race condition when starting services in parallel with shepherd 0.10.x whereby a service might create files and directories with umask #o137. An example is the bitlbee service with its least-authority wrapper: the wrapper would create a tree with directories set to #o640, thereby making the whole directory tree inaccessible. * gnu/services/base.scm (syslog-shepherd-service): Pass #:file-creation-mask to 'make-forkexec-constructor' instead of calling 'umask' in PID 1. --- gnu/services/base.scm | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/gnu/services/base.scm b/gnu/services/base.scm index 4adb551796..a4005fc4fd 100644 --- a/gnu/services/base.scm +++ b/gnu/services/base.scm @@ -1574,16 +1574,11 @@ reload its settings file."))) (display #$(G_ "Service syslog is not running.")))))))) ;; Note: a static file name is used for syslog.conf so that the reload ;; action work as intended. - (start #~(let ((spawn (make-forkexec-constructor - (list #$(syslog-configuration-syslogd config) - #$(string-append "--rcfile=" syslog.conf)) - #:pid-file "/var/run/syslog.pid"))) - (lambda () - ;; Set the umask such that file permissions are #o640. - (let ((mask (umask #o137)) - (pid (spawn))) - (umask mask) - pid)))) + (start #~(make-forkexec-constructor + (list #$(syslog-configuration-syslogd config) + #$(string-append "--rcfile=" syslog.conf)) + #:file-creation-mask #o137 + #:pid-file "/var/run/syslog.pid")) (stop #~(make-kill-destructor)))) (define syslog-service-type