I'm just making some changes to the way we run Zope following a recent security advisory. In the advisory it says:

“Make sure that the Zope/Plone service is running with with minimum privileges. Ideally, the Zope and ZEO services should be able to write only to log and data directories.”

Currently we have a dedicated linux user that runs buildout, starts and stops the server and which runs the Zope service. We're using supervisord to manage the two Zope instances we run in parallel (relstorage backend).

Our current zope user needs write permission on more than just the log and data directory so that it can run buildout so I opted to create an additional linux user, zoperun, to actually run the zope service. zoperun is in the same group as zope and only has write permissions on the var directory. This is all working fine except one thing: I'd like the original zope user to be able to start and stop the zope instances using supervisorctl.

I can't get this working. For example, when I try to run bin/supervisorctl status I get

error: , [Errno 13] Permission denied: file: line: 1

I think this is because the supervisor socket doesn't have group read and write permissions

srw------- 1 zoperun zopeour 0 Sep 30 09:00 supervisor.sock

I've set umask = 002 in the supervisord configuration but this has no affect on this superctl socket.

Is there any way I can achieve what I'd like?

  • Please edit your post and append supervisord.conf configuration file. – quanta Sep 30 '11 at 8:34

Take a look at unix-http-server section. Change your configuration file as belows:

file=/tmp/supervisor.sock   ; (the path to the socket file)
chmod=0770                  ; sockef file mode (default 0700)
chown=zope:zoperun          ; socket file uid:gid owner
;username=user              ; (default is no username (open server))
;password=123               ; (default is no password (open server))

This make the socket file can be read, write by users in zoperun group:

ll /tmp/supervisor.sock 
srwxrwx--- 1 zope zoperun 0 Sep 30 16:54 /tmp/supervisor.sock

Finally, add all users you want to allow start/stop Zope instance into zoperun group and testing with normal user, you will see something like this:

$ supervisorctl status
foo                              STARTING   
  • I haven't done quite this but your answer included the clue I needed. I have a zope group the zope and zoperun are in so I set chmod=0660 in the [unix_http_server] section and that did the trick – scarba05 Sep 30 '11 at 10:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.