Pkg xen devel - Sep 2015 - Bug#799986: xen-utils-common: please create /var/run/xen-hotplug from an init script

Package: xen-utils-common
Version: 4.4.1-9+deb8u1
Severity: normal

With SE Linux it's desirable to give utilities and daemons the minimum 
privileges.
That includes not permitting general utilities to create directories under 
/var/run.

I think it would be best if /var/run/xen-hotplug was created by an init script 
such
as /etc/init.d/xen (or by systemd-tmpfiles when using systemd units).

Below is a patch for /etc/init.d/xen which makes everything work well on SE 
Linux and
which does no harm on non-SE systems.

--- /etc/init.d/xen.orig	2015-09-25 15:02:41.542277474 +1000
+++ /etc/init.d/xen	2015-09-25 15:03:38.961681475 +1000
@@ -63,6 +63,8 @@
 
 env_setup()
 {
+	mkdir -m 755 /var/run/xen-hotplug
+	[ -x /sbin/restorecon ] && /sbin/restorecon /var/run/xen-hotplug
 	[ -d /run/xen ] && return 0
 
 	mkdir -m 700 /run/xen

-- System Information:
Debian Release: 8.2
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages xen-utils-common depends on:
ii  lsb-base        4.1+Debian13+nmu1
ii  python          2.7.9-1
ii  ucf             3.0030
ii  udev            215-17+deb8u2
ii  xenstore-utils  4.4.1-9+deb8u1

xen-utils-common recommends no packages.

xen-utils-common suggests no packages.

tags 799986 + moreinfo
thanks

Hi Russel,

I'm hunting down old bug reports in the Xen packages, and also ran into
this one. I see why it's useful.

I can see that current init scripts (well, for Xen 4.11) do create
/run/xen, as wel as /run/xenstored/:

https://salsa.debian.org/xen-team/debian-xen/blob/master/debian/xen-utils-common.xen.init#L67

https://salsa.debian.org/xen-team/debian-xen/blob/master/debian/xen-utils-common.xen.init#L243

Do you think this is already enough?

If not, I suspect it needs the help of someone who is actually using Xen
and SE Linux as combination to properly test other necessary changes.

And, now, I will still add my cleanup template:

---- >8 ----

Your bug report was targeted at a Xen package in a Debian distribution
older than the current stable (Stretch).

Can you please help us by confirming that any of the following scenarios
does apply to your situation?

* I had this problem a long time ago. It was never solved, but I found a
workaround, which is ...
* I had this problem a long time ago, and I solved it by not using Xen
any more, but by doing ...
* I still experience this problem, and I'm still using Xen
3.2/4.1/4.4/etc. I cannot upgrade to Debian Stretch or Buster because ...
* I had this problem, and since upgrading to Stretch / Buster / ? it
seems it was solved, and I forgot to report it again. Please close it,
thanks.
* Other: ...

Note that even if you found a solution, it's still very useful to report
it back to our bug tracker. There might be someone else running into the
same problem, who can be helped with your information.

Please note that unless there's a response within a month from now, we
will close the bug report. If you discover this message later, and this
case is important to you, then you can try unarchiving the bug and
replying to it, or reach out to the maintainers email list at
pkg-xen-devel at lists.alioth.debian.org (no subscription required) and
post a message.

Thanks,
Hans van Kranenburg

Processing commands for control at bugs.debian.org:
> tags 799986 + moreinfo
Bug #799986 [xen-utils-common] xen-utils-common: please create
/var/run/xen-hotplug from an init script
Added tag(s) moreinfo.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
799986: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799986
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems

On Wednesday, 23 January 2019 6:23:05 AM AEDT Hans van Kranenburg
wrote:
> I'm hunting down old bug reports in the Xen packages, and also ran into
> this one. I see why it's useful.
> 
> I can see that current init scripts (well, for Xen 4.11) do create
> /run/xen, as wel as /run/xenstored/:
> 
>
https://salsa.debian.org/xen-team/debian-xen/blob/master/debian/xen-utils-co
> mmon.xen.init#L67
> 
>
https://salsa.debian.org/xen-team/debian-xen/blob/master/debian/xen-utils-co
> mmon.xen.init#L243
> 
> Do you think this is already enough?
That is good.  Also systemd-tmpfiles entries for those directories would be 
good, systemd-tmpfiles has internal support for restorecon which makes this 
easy.
> Can you please help us by confirming that any of the following scenarios
> does apply to your situation?
> 
> * I had this problem, and since upgrading to Stretch / Buster / ? it
> seems it was solved, and I forgot to report it again. Please close it,
> thanks.
Yes this seems to be solved.  I don't use Xen any more due to unrelated 
reasons, but from examining the code it seems fixed.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

Your message dated Tue, 22 Jan 2019 21:24:03 +0100
with message-id <c828450f-6ec6-c558-b8eb-3c1d6fbe6eca at knorrie.org>
and subject line Re: xen-utils-common: please create /var/run/xen-hotplug from
an init script
has caused the Debian Bug report #799986,
regarding xen-utils-common: please create /var/run/xen-hotplug from an init
script
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
799986: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799986
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Russell Coker <russell at coker.com.au>
Subject: xen-utils-common: please create /var/run/xen-hotplug from an init
script
Date: Fri, 25 Sep 2015 15:28:13 +1000
Size: 3461
URL:
<http://alioth-lists.debian.net/pipermail/pkg-xen-devel/attachments/20190122/441627f9/attachment.mht>
-------------- next part --------------
An embedded message was scrubbed...
From: Hans van Kranenburg <hans at knorrie.org>
Subject: Re: xen-utils-common: please create /var/run/xen-hotplug from an init
script
Date: Tue, 22 Jan 2019 21:24:03 +0100
Size: 9066
URL:
<http://alioth-lists.debian.net/pipermail/pkg-xen-devel/attachments/20190122/441627f9/attachment-0001.mht>