Bugzilla – Bug 918434
Change /var/{cache,log}/squid ownership to squid:squid
Last modified: 2016-01-08 20:23:48 UTC
I am not sure why both folders are owned by root group since the user squid processes run on is squid:squid (Factory). Perhaps because the 'nogroup' group used by older packages is somewhat unprivileged and changing it artificially to root was a security measuse. So I propose as a RFC (to Factory) the attached patches, that: - Remove remaining permissions bits: it is unused. - Change id/getent checks to use exit codes. - Apply new group to /var/{cache,log}/squid contents if necessary on upgrade. - Drop 'create' from logrotate config. Log files will be created by squid itself as squid:squid 640. Also supress errors from squid invocation there. - Requires adjustments. I tested these modifications (3.4.10-1.2 as base) upgrading from 3.4.4-3.4.2 (which still uses squid:nogroup) in 13.2 and everything is working so far. After a broader testing round, it can go to 13.2 updates. Once this hits stable, #894636 and #894840 can be closed.
Created attachment 623716 [details] squid.spec
Created attachment 623717 [details] squid.logrotate
trhe permiussions are requiored for future or local usage, e.g. the pinger and basic_pam_auth have been requested recently. please get in contact with the regular maintainers. security will need to review if the log directory can be changed this way or if it is insecure.
Created attachment 623993 [details] squid.spec (V2) - Put permissions back in - Remove /etc/permissions.d/squid on %post - Fix etc/ path and use more %{name} macros where appropriate
Created attachment 623994 [details] squid.logrotate (V2) - Add missing 'nocreate' - Drop 2>/dev/null from squid call. If it is running and something goes wrong, we want the information
sorry don't see your problem ... ... %verify(not user group mode) %attr(750,%{name},root) %dir %{_localstatedir}/cache/%{name}/ %verify(not user group mode) %attr(750,%{name},root) %dir %{_localstatedir}/log/%{name}/ ... /var/log/squid/access.log /var/log/squid/store.log /var/log/squid/cache.log { su squid squid compress dateext maxage 365 rotate 99 size=+4096k notifempty missingok create 640 squid squid sharedscripts postrotate /usr/bin/systemctl -q is-active squid.service && /usr/sbin/squid -k rotate endscript }