By default the port will run as root and is therefore able to write a pid file in /var/run. However, when setting setuid in the config file as recommended, this is not possible. It seems the pid file is not written by stunnel before dropping privileges. I'm not sure what the best fix for this would be, but it'd be great if I could run stunnel as non-root.
Created attachment 222319 [details] patch for security/stunnel Define the default PID file and make substitutions. Create a one-level directory where PID files can be written.
Not that it matters, but the following command will give you the port of the stunnel that root started. sockstat -l | grep \^root\ \*stunnel
Created attachment 227394 [details] patch for security/stunnel It was regenerated in git.
Yeah, looks a bit weird: port installation creates the stunnel user and group, but they're not used by default, and adding the configuration to run stunnel under them results in this permission error. I've fixed it on my end by creating a subfolder in /var/run and changing the path in the rc.d script (just like in the proposed patch). Would be great if this gets fixed on the port side too. Preferably, it should also not run as root by default.
Committed + implemented dropping privs by default.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=7b6aed9ac322d8a3820d8f0615eb623bb815f7ee commit 7b6aed9ac322d8a3820d8f0615eb623bb815f7ee Author: Ryan Steinmetz <zi@FreeBSD.org> AuthorDate: 2022-07-11 13:41:15 +0000 Commit: Ryan Steinmetz <zi@FreeBSD.org> CommitDate: 2022-07-11 13:41:15 +0000 security/stunnel: Drop privs by default, update PID file location - Document changes in UPDATING PR: 249151 Reported by: Tatsuki Makino <tatsuki_makino@hotmail.com> UPDATING | 13 +++++++++++++ security/stunnel/Makefile | 9 +++++++-- security/stunnel/files/daemon.conf.in (new) | 3 +++ security/stunnel/files/pid.conf (gone) | 1 - security/stunnel/files/stunnel.in | 18 ++++++++++++++++-- security/stunnel/pkg-plist | 2 +- 6 files changed, 40 insertions(+), 6 deletions(-)