3

I recently created an init script, and decided to set lockfile to immutable to prevent external interference. The only downside I can think of is that if someone wanted to recursively delete /var/lock, they might have a problem. The init script removes the immutable flag before deleting the file when the process is stopped via the script.

Is this a bad idea? why don't I see it more often? Is it overkill? If someone managed to stop the process without the init script, the lock file will be removed the next time the script is invoked with any argument.

2

On my system, at least, /var/lock (or actually /run/lock, the former is a symlink to the latter) has the sticky bit set. That means that only the owner of the lockfile or directory can delete it, not anyone with write on the directory (the same way /tmp works). On other distros, the directory only writable by a few users (so random users can't mess with it at all).

So the only users who can mess with (delete) your daemon's lockfile are:

  1. root (as of course root can do anything)
  2. the user you're creating the lockfile as (sounds like root again, but could also be a dedicated user for your daemon if you weren't trying to chattr it)
  3. the owner of the lock directory, root on my system

Or if its set up the other way, you can add in "members of the lock (or whichever) group", which is generally only users for system daemons.

The users who can read/write your lockfile are controlled by permissions on the lockfile like normal—and writing is hopefully limited to root and your daemon's user.

If root is causing "external interference" you have far bigger problems than him/her rm'ing a lockfile. So you shouldn't do this—it doesn't add any protection, and may cause surprises for the sysadmin when trying to fix some problem.

The immutable flag is something that is normally only applied by the sysadmin.

2
  • Not on my CentOS 6.x system(s). /tmp has sticky bit, but not /var/run and I have no /run on my systems. Apr 16 '15 at 12:53
  • @GreggLeventhal don't have a CentOS 6 system, have an older version—on that one /var/lock is only writable by user root or group lock, so no one can mess with it, even without the sticky bit. I'll note that other method in the answer.
    – derobert
    Apr 16 '15 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.