running speech-dispatcher as non-root using setuid on XO and accompanying security issues

[Michael Stone]

On Thu, Jul 17, 2008 at 05:21:57PM +0530, Hemant Goyal wrote:

>The corresponding strace outputs are :
>open("/var/log//speechd.log", O_WRONLY|O_CREAT|O_APPEND, 0666) = -1 EACCES (Permission denied)
>open("/var/log//espeak.log", O_WRONLY|O_CREAT|O_TRUNC, 0600) = -1 EACCES (Permission denied)

Your software is attempting to create-or-truncate its pid-file and
log-files and is failing. If you make these files world-writable (or at
least speechd writable) by, e.g., 

   touch /var/run/speech-dispatcher.pid
   chmod a+w /var/run/speech-dispatcher.pid 

   ... (repeat for speechd.log and espeak.log)

What happens when you redo your tests?

Michael

P.S. - In the long run, speechd should probably learn to run under its
own uid(s). Then the appropriate uids can own the appropriate log files.