Re: squid becoming root (again)

Hossam El-Ashkar wrote:
 
> Hello all,
> I posted this problem two days ago, and i got only a response from
> someone who has the same problem. He proposed a solution by using chown
> periodically... But the problem is getting very severe these days!!! I don't
> know why!! Can anybody help me !!!!

My recommendation is to not start Squid as root in the first place.
Starting squid as root is only needed if

a) It uses a low port <1024.
b) ICMP pinging is enabled

The ICMP pinging can be enabled to a non-root Squid process by making
the pinger suid root (and properly protected to deny execution by anyone
but the Squid user/group).

Simplest method to start a process as a non-root user from a root run
script is to

su squid -c /usr/local/squid/bin/squid -Y

(where squid is the user you want squid to run as, and -Y is any options
you want to pass to Squid)

I agree that if Squid creates files with root as owner then there is a
bug somewhere in Squid. Maybe someone will be able to track it down, but
it probably won't be me as I never run Squid as root.

--
Henrik Nordstrom
Spare time Squid hacker