On Sat, 2017-06-03 at 14:12 +0000, Sergio Gelato wrote: > I've now successfully tested the fix from #827444 on both jessie and > stretch. > > Specifically, I created > /etc/systemd/system/nslcd.service.d/forking.conf with the following > contents: > > [Service] > Type=forking > PIDFile=/var/run/nslcd/nslcd.pid > RemainAfterExit=no > Restart=on-failure
Hi Sergio, Thanks for your service description. I am a bit reluctant to add restart-on-crash to nslcd and it could be a security risk in general for daemons. One reason for this is that it potentially turns a denial of service vulnerability into something much worse (e.g. remote code execution). This is especially true when address space randomisation is used. If, for example, there is a flaw in a daemon that you can use to trigger remote code execution only in a certain percentage of exploit attempts (and otherwise causing a crash) with auto-restart you will have more attempts at the exploit. If I read the systemd documentation correctly it has some mechanisms to limit this though (StartLimitIntervalSec and StartLimitBurst). Another issue is that if a daemon crashes there certainly is a bug somewhere. If the service is silently restarted on crashes the bug will less likely be reported and fixed leaving a bug around longer. The biggest reason however for not switching to a systemd service file is that I want to keep is starting k5start if nslcd.conf has sasl_mech and krb5_ccname configured. This is now implemented in the init script and configurable in /etc/default/nslcd. I have not been able to figure out how to do this in systemd yet. -- -- arthur - [email protected] - https://people.debian.org/~adejong --
signature.asc
Description: This is a digitally signed message part
