Subject: [Pkg-cacti-maint] Bug#923309: cacti-spine_1.1.37-2~bpo9+1 fails to run under non-root user

From: Paul Allen <[email-masked]>
Date: Mon, 25 Feb 2019 23:39:44 -0700

Package: cacti-spine
Version: 1.1.37-1~bpo9+1
Severity: normal

Dear Maintainer,

   * What led up to the situation?
        Upgrading from cacti-spine_1.1.37-1~bpo9+1 to cacti-spine_1.1.37-2~bpo9+1 caused execution of cacti-spine for non-root users to break, even with setuid bits set for either just user or all.
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
        Attempted to set setuid bits on /usr/sbin/spine to permit execution by non-root users (eg, cacti). Attempted to debug by running "/usr/sbnin/spine -H=180 -R -S -V=5" and "/usr/sbin/spine -h" as both root and cacti users.
   * What was the outcome of this action?
        /usr/sbin/spine would fail silently when executed by cacti user but would run successfully when executed by root user. Example: 
    cacti@mon1:~# /usr/sbin/spine -H=180 -R -S -V=5
    cacti@mon1:~#
    cacti@mon1:~# /usr/sbin/spine -h
    cacti@mon1:~#

   * What outcome did you expect instead?
        Expected spine to execute successfully for non-root cacti user once setuid bit(s) were set.

Re-installing cacti-spine_1.1.37-2~bpo9+1 had no effect, Removing and re-adding setuid bits had no effect. Once I rolled the package back to cacti-spine_1.1.37-1~bpo9+1 and set the setuid bit for the user it started executing successfully again for the no-root cacti user with no other changes necessary.

-- System Information:
Debian Release: 9.8
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-6-amd64 (SMP w/16 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages cacti-spine depends on:
ii  cacti                  1.1.38+ds1-1~bpo9+1
ii  dbconfig-no-thanks     2.0.11~bpo9+1
ii  debconf [debconf-2.0]  1.5.61
ii  libc6                  2.24-11+deb9u4
ii  libmariadbclient18     10.1.37-0+deb9u1
ii  libsnmp30              5.7.3+dfsg-1.7+deb9u1
ii  ucf                    3.0036

cacti-spine recommends no packages.

Versions of packages cacti-spine suggests:
ii  snmp-mibs-downloader  1.1+nmu1

-- no debconf information

---

From: Paul Gevers <[email-masked]>
Date: Wed, 27 Feb 2019 21:35:38 +0100

Hi Paul, Allan,

@Paul, Thanks for reporting this issue. Please check the existing
comments in bug 904332

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=904332

@Sven can you please help us and maybe explain how Paul should be using
the cacti-spine binary with these Linux capabilities enabled that we
added in that version by your patch. I guess he needs to install
libcap2-bin and run $(chmod u-s /usr/sbin/spine)

Paul

---

From: Sven Hartge <[email-masked]>
Date: Wed, 27 Feb 2019 21:53:57 +0100

> libcap2-bin and run $(chmod u-s /usr/sbin/spine)

Yes, but one additional step:

You also need to set the capabilities:

   setcap cap_net_raw+ep /usr/sbin/spine

After that, everything should be back in working order.

If not, then the bug is at a different place. Also the missing setuid
bit and the missing capabilities only prevent the use of the
ICMP-Checker for Host Liveliness Checking, but not the failure to run at
all.

Without those two bits in place, SNMP gathering will still work.

Grüße,
Sven.

---

From: Paul Gevers <[email-masked]>
Date: Thu, 14 Mar 2019 12:03:06 +0100

Control: tags -1 moreinfo

Hi Paul

> Without those two bits in place, SNMP gathering will still work.

Did the reply from Sven help? I.e. do you think this bug can be closed?

Paul

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Thu, 14 Mar 2019 11:06:03 +0000

Processing control commands:

> tags -1 moreinfo
Bug #923309 [cacti-spine] cacti-spine_1.1.37-2~bpo9+1 fails to run under non-root user
Added tag(s) moreinfo.

-- 
923309: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=923309
Debian Bug Tracking System
Contact [email-masked] with problems

---

From: Paul Allen <[email-masked]>
Date: Wed, 8 May 2019 15:14:37 -0600

Sorry for the late reply, work became insane after this.

I upgraded to the new cacti-spine again and ran the setcap command and
it is working for the non-root user now. Thanks for the assistance on
this. The bug can now be closed.

Paul Allen

Inetz Sr. Systems Administrator
801-415-2562

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Thu, 09 May 2019 07:18:03 +0000

Your message dated Thu, 9 May 2019 09:14:23 +0200
with message-id <[email-masked]>
and subject line Re: Bug#923309: cacti-spine_1.1.37-2~bpo9+1 fails to run under non-root user
has caused the Debian Bug report #923309,
regarding cacti-spine_1.1.37-2~bpo9+1 fails to run under non-root user
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

Subject: cacti-spine_1.1.37-2~bpo9+1 fails to run under non-root user
From: Paul Allen <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Mon, 25 Feb 2019 23:39:44 -0700

Package: cacti-spine
Version: 1.1.37-1~bpo9+1
Severity: normal

Dear Maintainer,

-- System Information:
Debian Release: 9.8

Subject: Re: Bug#923309: cacti-spine_1.1.37-2~bpo9+1 fails to run under non-root user
From: Paul Gevers <[email-masked]>
To: [email-masked], Paul Allen <[email-masked]>
Date: Thu, 9 May 2019 09:14:23 +0200

Hi Paul

> Sorry for the late reply, work became insane after this.

Happens, yes.

> this. The bug can now be closed.

Doing so with this e-mail.

Paul