On Thu, 2023-03-16 at 09:34:56 +0100, Marc Haber wrote:
> Control: tags -1 severity serious
> thanks
>
> On Wed, Mar 15, 2023 at 07:44:06PM +0100, Guillem Jover wrote:
> > ,---
> > AIDEUSER="${AIDEUSER:-$(id -u -n)}"
> > `---
>
> Yes that one is absolutely needed or the daily cron job will fail. This
> is now an RC bug.
>
> Did we discuss this enough in depth so that I can close this one,
> #1032387 with the change given above? Or am I still missing something?
I still think though that the sending mail out-of-the-box regression
is avoidable (for both systemd and cron), but at least the cron one
requires very minimal changes to make it work automatically, and as I've
mentioned I'm no longer affected by this, so this would be mostly for
other people that might need to go over this, so if you'd still rather
change that part for trixie then sure the user setup change should be
enough to close this, otherwise I've still prepared the attached patch
for consideration.
Thanks,
Guillem
From f20ccedef8ba985fcb9766524bc68eae26f2e0cb Mon Sep 17 00:00:00 2001
From: Guillem Jover <[email protected]>
Date: Thu, 16 Mar 2023 10:07:54 +0100
Subject: [PATCH] dailyaidecheck: Automatically use mail(1) if called from cron
via capsh
The invocation from cron via capsh allows to run set-uid-root commands,
which might be needed on systems where sendmail is setup as such. The
systemd service does not currently allow such invocation so we still
do not let it use mail(1) automatically in that case, as long as we
are not running as root.
---
debian/bin/dailyaidecheck | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/debian/bin/dailyaidecheck b/debian/bin/dailyaidecheck
index aa4b59c..8929a80 100755
--- a/debian/bin/dailyaidecheck
+++ b/debian/bin/dailyaidecheck
@@ -118,12 +118,13 @@ elif command -v s-nail >/dev/null; then
MAILTO="${MAILTO}@${MAILNAME:-localhost}"
fi
elif command -v mail >/dev/null; then
- if [ "$(id -u)" -eq 0 ]; then
- # we have root and mail(1) is useable
+ if [ "${CALLER}" = "--crondaily" ] || [ "$(id -u)" -eq 0 ]; then
+ # We are called from cron via capsh or have root and thus mail(1) is
+ # useable, even if sendmail is set-uid-root.
MAILCMD="mail"
else
MAILCMD="true"
- printf >&2 "WARN: it is not possible to use mail(1) unless aide is run as root. See /usr/share/doc/aide-common/README.Debian.gz for more information.\n"
+ printf >&2 "WARN: it is not possible to use mail(1) unless aide is run as root or via capsh. See /usr/share/doc/aide-common/README.Debian.gz for more information.\n"
fi
else
MAILCMD="true"
--
2.39.2
