From 2addc662c2d3d29f6a6cd1fa6ef224b67fce21b8 Mon Sep 17 00:00:00 2001
From: "Frank Ch. Eigler" <fche@elastic.org>
Date: Wed, 27 Jan 2010 22:10:56 -0500
Subject: [PATCH] PR11197: prevent startup of stap-server as root

* stap-serverd: Block startup if whoami=root, unless magic
  environment variable is set.
* testsuite/lib/systemtap.exp: Set magic environment variable to
  override protection.
---
 stap-serverd                | 13 ++++++++++++-
 testsuite/lib/systemtap.exp |  2 +-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/stap-serverd b/stap-serverd
index 4d8a10ceb..fc186233f 100755
--- a/stap-serverd
+++ b/stap-serverd
@@ -2,7 +2,7 @@
 
 # Compile server manager for systemtap
 #
-# Copyright (C) 2008, 2009 Red Hat Inc.
+# Copyright (C) 2008-2010 Red Hat Inc.
 #
 # This file is part of systemtap, and is free software.  You can
 # redistribute it and/or modify it under the terms of the GNU General
@@ -19,6 +19,17 @@ trap 'terminate' SIGTERM SIGINT
 # Initialize the environment
 . ${PKGLIBEXECDIR}stap-env
 
+# PR11197: security prophylactics
+if [ -z "$STAP_PR11197_OVERRIDE" ]; then
+    # 1) reject use as root, except via a special environment variable
+    if [ `id -u` -eq 0 ]; then
+        echo "For security reasons, invocation of stap-server as root is not supported." 1>&2
+        exit 1
+    fi 
+    # 2) ... etc ...
+fi
+
+
 #-----------------------------------------------------------------------------
 # Helper functions.
 #-----------------------------------------------------------------------------
diff --git a/testsuite/lib/systemtap.exp b/testsuite/lib/systemtap.exp
index e0e01bcc2..031700813 100644
--- a/testsuite/lib/systemtap.exp
+++ b/testsuite/lib/systemtap.exp
@@ -153,7 +153,7 @@ proc setup_server {} {
     exec chmod 666 $logfile
 
     # Try to find or start the server.
-    set server_pid [exec stap-start-server --log=$logfile]
+    set server_pid [exec env STAP_PR11197_OVERRIDE=1 stap-start-server --log=$logfile]
     if { "$server_pid" == "" } then {
 	print "Cannot start a systemtap server"
 	set server_pid 0
-- 
2.43.5