init script incorrectly 'su's

[Herb McNew]

Binary package hint: couchdb

If the init script is run as the COUCHDB_USER it still attempts to su to the COUCHDB_USER. This doesn't work. The script should check to see if it's already COUCHDB_USER before trying to su.

[Alex Lourie (alourie)]

Herb,

Thank you for taking the time to report this bug and helping to make Ubuntu better.

Can you please be more specific? What do you mean by "doesn't work"? Do you get an error while starting it?
I've checked the init script, and it is perfectly normal to run su $USER being already a $USER.

[Herb McNew (herb)]

If you run su as $USER the su process will either a) prompt you for a password (if one is set) or b) return "su: Permission denied" if the password field is a *. Either way this blocks the startup of the process or the machine.

Example a:
herb@ramble:~$ id
uid=1000(herb) gid=1000(herb) groups=1000(herb)
herb@ramble:~$ su herb
Password:

Example b:
couchdb@ramble:~$ id
uid=111(couchdb) gid=120(couchdb) groups=120(couchdb)
couchdb@ramble:~$ su couchdb
su: Permission denied

[Alex Lourie (alourie)]

Herb,

You are correct; this would be a problem if the script would run by anyone
but root.

But is it executed as non-root user? Ever?

  status confirmed

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Use GnuPG with Firefox : http://getfiregpg.org (Version: 0.7.8)

iEYEARECAAYFAkq7yxMACgkQCQNxSZx9L7svNACghf7mqfG8zYGUGVIFTsJRTbjr
rrQAmwcB81rcycp4HxKQgXKLR2wPiffl
=84nh
-----END PGP SIGNATURE-----

[Herb McNew (herb)]

It is run as a non-root user. That's how we found this bug. On our production systems we on occasion give people access to certain role accounts, but don't want them to have root access. This includes the ability to start and stop services associated with said role accounts. In particular some members of our team have access to the COUCHDB_USER account and couldn't restart the service despite the fact they were operating as the process owner.

[Chad Miller (cmiller)]

Reported upstream at https://issues.apache.org/jira/browse/COUCHDB-603.

(LP does not track JIRA tickets yet.)

[Steve Langasek (vorlon)]

init scripts should never call su. They should call start-stop-daemon instead.