Bug 15099 - radiusd.service expects non existing user and group on start
Summary: radiusd.service expects non existing user and group on start
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard: has_procedure advisory MGA4-32-OK MGA...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2015-01-21 11:00 CET by Stefan Puch
Modified: 2015-01-24 15:32 CET (History)
2 users (show)

See Also:
Source RPM: freeradius-2.2.0-5.1.mga4.src.rpm
CVE:
Status comment:


Attachments

Description Stefan Puch 2015-01-21 11:00:34 CET
Description of problem:
When trying to start radius service it will fail because it tries to use a non existing user and group with chown. systemctl will fail wih the following errer:

systemctl status radiusd.service
radiusd.service - FreeRADIUS high performance RADIUS server.
   Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled)
   Active: failed (Result: exit-code) since Di 2015-01-20 17:29:00 CET; 17h ago
  Process: 10773 ExecStartPre=/usr/sbin/radiusd -C (code=exited, status=1/FAILURE)
  Process: 10770 ExecStartPre=/bin/chown -R radiusd.radiusd /run/radiusd (code=exited, status=1/FAILURE)

Jan 20 17:29:00 testido chown[10770]: /bin/chown: invalid user: 'radiusd.radiusd'
Jan 20 17:29:00 testido systemd[1]: radiusd.service: control process exited, code=exited status=1
Jan 20 17:29:00 testido systemd[1]: Failed to start FreeRADIUS high performance RADIUS server..
Jan 20 17:29:00 testido systemd[1]: Unit radiusd.service entered failed state.


How reproducible:

Steps to Reproduce:
1. install freeradius-2.2.0-5.1.mga4.i586.rpm
2. configure needed config files
3. start daemon unsing systemctl start radiusd.service


Looking in the file /usr/lib/systemd/system/radiusd.service you can see that 
line 8 causes the error:
ExecStartPre=-/bin/chown -R radiusd.radiusd /run/radiusd

The user and group is normally not present in the system, there is a 'd' too much.
Mageia uses user and group radius (without the ending 'd') by default and that one is added to the system during installation of the freeradius RPM.

The code can be found in line 414 of freeradius.spec

%_pre_useradd radius %{_localstatedir}/log/radius/radacct /bin/false
 
----------------------------------------------------------------------------
I did not test it, but if my analyses are correct the Bug is as well present in
freeradius-2.2.3-5.mga5.i586.rpm which will be shipped with the next Release Mageia 5 (freeradius-2.2.3-5.mga5.src.rpm).

Do wee need a new ticket for the same problem or can someone fix that in cauldron, too?



Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2015-01-21 13:03:01 CET
Should be fixed now in Mageia 4 updates_testing and Cauldron.  Please test.  Thanks for the report.

Advisory:
----------------------------------------

The freeradius package did not correctly handle the directory where it stores
its PID file, which could prevent the service from starting.
----------------------------------------

Updated packages in core/updates_testing:
----------------------------------------
freeradius-2.2.0-5.2.mga4
freeradius-krb5-2.2.0-5.2.mga4
freeradius-ldap-2.2.0-5.2.mga4
freeradius-postgresql-2.2.0-5.2.mga4
freeradius-mysql-2.2.0-5.2.mga4
freeradius-unixODBC-2.2.0-5.2.mga4
freeradius-sqlite-2.2.0-5.2.mga4
freeradius-yubikey-2.2.0-5.2.mga4
libfreeradius1-2.2.0-5.2.mga4
libfreeradius-devel-2.2.0-5.2.mga4
freeradius-web-2.2.0-5.2.mga4

from freeradius-2.2.0-5.2.mga4.src.rpm

Assignee: bugsquad => qa-bugs

Comment 2 claire robinson 2015-01-21 14:32:19 CET
Oops. This was previously reported here but closed at mga2 EOL.
https://bugs.mageia.org/show_bug.cgi?id=8912
Comment 3 claire robinson 2015-01-21 14:39:23 CET
Some testing info here http://freeradius.org/doc/

Basically start the service, which should now start without modification, and follow https://bugs.mageia.org/show_bug.cgi?id=8726#c3

Whiteboard: (none) => has_procedure

Comment 4 Stefan Puch 2015-01-21 19:52:11 CET
Test results:

Upgraded to freeradius-2.2.0-5.2.mga4 and libfreeradius1-2.2.0-5.2.mga4.

As mentioned in https://bugs.mageia.org/show_bug.cgi?id=8912 commenting out of "${certdir}/bootstrap" is still necessary but that is IMHO a problem of user configuration (is that feature in radiusd needed or not)

------------------------------------------------------------------------------
Starting the service looks fine now:

[root@testido]# systemctl start radiusd.service
[root@testido]# systemctl status radiusd.service
radiusd.service - FreeRADIUS high performance RADIUS server.
   Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled)
   Active: active (running) since Mi 2015-01-21 19:20:14 CET; 3s ago
  Process: 2284 ExecStart=/usr/sbin/radiusd -d /etc/raddb (code=exited, status=0/SUCCESS)
  Process: 2283 ExecStartPre=/usr/sbin/radiusd -C (code=exited, status=0/SUCCESS)
 Main PID: 2288 (radiusd)
   CGroup: /system.slice/radiusd.service
           ââ2288 /usr/sbin/radiusd -d /etc/raddb

Jan 21 19:20:14 testido systemd[1]: PID file /run/radiusd/radiusd.pid not readable (yet?) after start.
Jan 21 19:20:14 testido systemd[1]: Started FreeRADIUS high performance RADIUS server..
[root@stestido]#
------------------------------------------------------------------------------
When stopping the service it enters for some reason failed state, but at the moment I cannot see any problems with that so far:

[root@testido]# systemctl stop radiusd.service
[root@testido]# systemctl status radiusd.service
radiusd.service - FreeRADIUS high performance RADIUS server.
   Loaded: loaded (/usr/lib/systemd/system/radiusd.service; enabled)
   Active: failed (Result: exit-code) since Mi 2015-01-21 19:22:30 CET; 3s ago
  Process: 2284 ExecStart=/usr/sbin/radiusd -d /etc/raddb (code=exited, status=0/SUCCESS)
  Process: 2283 ExecStartPre=/usr/sbin/radiusd -C (code=exited, status=0/SUCCESS)
 Main PID: 2288 (code=exited, status=1/FAILURE)

Jan 21 19:20:14 testido systemd[1]: PID file /run/radiusd/radiusd.pid not readable (yet?) after start.
Jan 21 19:20:14 testido systemd[1]: Started FreeRADIUS high performance RADIUS server..
Jan 21 19:22:30 testido systemd[1]: Stopping FreeRADIUS high performance RADIUS server....
Jan 21 19:22:30 testido systemd[1]: radiusd.service: main process exited, code=exited, status=1/FAILURE
Jan 21 19:22:30 testido systemd[1]: Stopped FreeRADIUS high performance RADIUS server..
Jan 21 19:22:30 testido systemd[1]: Unit radiusd.service entered failed state.
[root@testido]#
------------------------------------------------------------------------------
Starting the service again succeeds without problems.

Test following https://bugs.mageia.org/show_bug.cgi?id=8726#c3 works fine as well.

I cannot test the new version with Cauldron but I would guess that it should work equivalent.

Thanks for fixing!
Comment 5 David Walser 2015-01-22 00:05:45 CET
Thanks for the testing feedback Stefan!  I added it to the whiteboard.

Whiteboard: has_procedure => has_procedure MGA4-32-OK

Comment 6 olivier charles 2015-01-23 20:28:04 CET
Testing on Mageia4-64,real hardware, following procedure mentioned in Comment 3

From  freeradius-2.2.0-5.1.mga4.x86_64

To 

- freeradius-2.2.0-5.2.mga4.x86_64
- freeradius-krb5-2.2.0-5.2.mga4.x86_64
- freeradius-ldap-2.2.0-5.2.mga4.x86_64
- freeradius-mysql-2.2.0-5.2.mga4.x86_64
- freeradius-postgresql-2.2.0-5.2.mga4.x86_64
- freeradius-sqlite-2.2.0-5.2.mga4.x86_64
- freeradius-unixODBC-2.2.0-5.2.mga4.x86_64
- freeradius-web-2.2.0-5.2.mga4.x86_64
- freeradius-yubikey-2.2.0-5.2.mga4.x86_64
- lib64freeradius1-2.2.0-5.2.mga4.x86_64

Once commenting out 
make_cert_command = "${certdir}/bootstrap"
in /etc/raddb/eap.conf

could start, stop radiusd.service
and test according to procedure

OK on Mageia4x64

CC: (none) => olchal
Whiteboard: has_procedure MGA4-32-OK => has_procedure MGA4-32-OK MGA4-64-OK

Comment 7 claire robinson 2015-01-23 22:36:50 CET
Validating. Advisory uploaded.

Please push to 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA4-32-OK MGA4-64-OK => has_procedure advisory MGA4-32-OK MGA4-64-OK
CC: (none) => sysadmin-bugs

Comment 8 Mageia Robot 2015-01-24 15:32:38 CET
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGAA-2015-0007.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.