Re: Default permissions on supervise/ok

[eam@frap.net]

On Mon, May 20, 2013 at 08:47:37PM -0400, Charlie Brady wrote:
> 
> On Mon, 20 May 2013, eam@frap.net wrote:
> 
> > I'd like to allow any user to access supervise/ok, in order to run
> > `sv stat`, but not to access supervise/control. My understanding is that
> > this is safe, as supervise/ok is a read-only interface. Is this accurate,
> > and is this a reasonable idea? Anything I should be warned about? Am I
> > overlooking anything important?
> > 
> > chmod 755 supervise
> > chmod 666 supervise/ok
> 
> Why wouldn't you use 644 for supervise/ok? Remember that you have no 
> guarantee that Joe User will use 'sv' to access the file.

sv refuses to run if it can't open the fifo as writable. My intent is to
allow any user to inspect the process state, but not influence it.

My understanding is that runsv will never read from the fifo, and will
only use opening it as a test to verify the process exists the other end.
This doesn't seem exploitable as it's a read-only channel. At least, as
far as I can tell.

supervise/status already has 644 perms, which is fine because `sv` opens
it readonly, but the default permission on the parent supervise/ directory
are 700 which prohibits access.

Control of runsv is performed over supervise/control, which I would not
make world or group writable, of course.