non-root process and PID files

Christopher Vance vance at
Wed Oct 29 16:32:02 PST 2003

On Mon, Oct 27, 2003 at 10:31:18AM -0500, Dan Langille wrote:
>If a process starts up and does a setuid, should it be writing the 
>PID file before or after the setuid?
>Two methods exists AFAIK:
>1 - write your PID immediately, and the file is chown root:wheel
>2 - write your PID to /var/run/myapp/ where /var/run/myapp/
>    is chown myapp:myapp
>Of the two, I think #1 is cleaner as it does not require another 
>directory with special permissions.

You can already mark a fd 'close on exec'.

May I suggest a different feature: the ability to mark an open file
(not just its fd) 'remove on close', with permission checked at mark
time rather than close time (this status forgotten if not permitted
when set) and the unlink actually done at close time only if the file
has exactly one link and one open file instance at that time.

That way your server can
	start as root
	open file to write/update
	downgrade/reopen file to readonly
	mark remove on close
	setuid non-root

Or you could call it a future unlink.

I'm sure there are holes in it, and I won't claim to have tried it, ...

Christopher Vance

More information about the freebsd-hackers mailing list