(ITS#8703) slapd should create its PID file before dropping privileges

[michael@orlitzky.com]

Full_Name: Michael Orlitzky
Version: 2.4.45
OS: Gentoo
URL: 
Submission from: (NULL) (98.218.46.55)


The slapd daemon should create its PID file before dropping privileges. This
represents a minor security issue; additional factors are needed to make it
exploitable.

Why?

The purpose of the PID file is to hold the PID of the running daemon,
so that later it can be stopped, restarted, or otherwise signalled
(many daemons reload their configurations in response to a SIGHUP).
To fulfill that purpose, the contents of the PID file need to be
trustworthy. If the PID file is writable by a non-root user, then he
can replace its contents with the PID of a root process. Afterwards,
any attempt to signal the PID contained in the PID file will instead
signal a root process chosen by the non-root user (a vulnerability).

This is commonly exploitable by init scripts that are run as root and
which blindly trust the contents of their PID files. If one daemon
flushes its cache in response to SIGUSR2 and another daemon drops all
connections in response to SIGUSR2, it is not hard to imagine a
denial-of-service by the user of the first daemon against the second.