So finally stumbled across the DOWN-ROOT plugin, which I thought would help me out...Quick overview, we use network namespaces to segment different adapters/openvpn configurations, and I use the up/down scripts to handle the creation/deletion of them. Since we have multiple openvpn configurations and some of them share the same namespace I have implemented a lock file to help keep them from clobbering each other when stop/start/restart. The lock file is located in /var/run/openvpn/openvpn.lock and the owner is nobody (I have the user/group as nobody in the openvpn configs).
The startup works fine, the lock file is usable, and I can see that the script is run as "root".
On shutdown I see that I'm having issues with the lock file, keep getting permission denied. I put an "id" once in the script so I can see what the user it's running as. It's showing the script running as "nobody" and not "root".
I'm mostly just confused on this difference in the down script...Is there any good reason why it wouldn't mimic the behavior of the up script in regards to user execution? Also, is the DOWN-ROOT plugin possibly suspect?
We're running CentOS 7.2x64 and installing OpenVPN through default repos...It's currently at version 2.3.11. Not sure what else is needed...I can't show the script contents at the moment (Will need to modify it to hide company config info) but I did setup a test VM that has an up/down script that is literally:
#!/bin/bash
TID=$(id)
echo $TID
When the service starts I see:
Fri Jun 24 14:43:34 2016 us=449013 OpenVPN 2.3.11 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on May 10 2016
Fri Jun 24 14:43:34 2016 us=449023 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.06
Fri Jun 24 14:43:34 2016 us=480415 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Fri Jun 24 14:43:34 2016 us=480487 PLUGIN_INIT: POST /usr/lib64/openvpn/plugins/openvpn-plugin-down-root.so '[/usr/lib64/openvpn/plugins/openvpn-plugin-down-root.so] [/etc/openvpn/script-config.sh]' intercepted=PLUGIN_UP|PLUGIN_DOWN
Fri Jun 24 14:43:34 2016 us=485026 Diffie-Hellman initialized with 2048 bit key
Fri Jun 24 14:43:34 2016 us=485042 WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate
Fri Jun 24 14:43:34 2016 us=485390 TLS-Auth MTU parms [ L:1570 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Fri Jun 24 14:43:34 2016 us=485416 Socket Buffers: R=[212992->212992] S=[212992->212992]
Fri Jun 24 14:43:34 2016 us=485704 TUN/TAP device tun0 opened
Fri Jun 24 14:43:34 2016 us=485728 TUN/TAP TX queue length set to 100
Fri Jun 24 14:43:34 2016 us=536124 PLUGIN_CALL: POST /usr/lib64/openvpn/plugins/openvpn-plugin-down-root.so/PLUGIN_UP status=0
Fri Jun 24 14:43:34 2016 us=536218 script-config.sh tun0 1500 1570 172.16.30.1 255.255.255.0 init
uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:openvpn_t:s0
Fri Jun 24 14:43:34 2016 us=548494 Data Channel MTU parms [ L:1570 D:1300 EF:70 EB:143 ET:0 EL:3 AF:3/1 ]
Fri Jun 24 14:43:34 2016 us=548843 GID set to nobody
Fri Jun 24 14:43:34 2016 us=548860 UID set to nobody
Fri Jun 24 14:43:34 2016 us=548874 UDPv4 link local (bound): [AF_INET]10.0.2.15:1194
Fri Jun 24 14:43:34 2016 us=548881 UDPv4 link remote: [undef]
Fri Jun 24 14:43:34 2016 us=548899 MULTI: multi_init called, r=256 v=256
Fri Jun 24 14:43:34 2016 us=548934 IFCONFIG POOL: base=10.199.30.101 size=50, ipv6=0
Fri Jun 24 14:43:34 2016 us=548963 Initialization Sequence Completed
And when the service stops I see:
Fri Jun 24 14:40:25 2016 us=251438 PLUGIN_CALL: POST /usr/lib64/openvpn/plugins/openvpn-plugin-down-root.so/PLUGIN_DOWN status=0
Fri Jun 24 14:40:25 2016 us=251482 script-config.sh tun0 1500 1570 172.16.30.1 255.255.255.0 init
uid=99(nobody) gid=99(nobody) groups=99(nobody) context=system_u:system_r:openvpn_t:s0
Fri Jun 24 14:40:25 2016 us=253731 PLUGIN_CLOSE: /usr/lib64/openvpn/plugins/openvpn-plugin-down-root.so
Fri Jun 24 14:40:25 2016 us=253820 SIGTERM[hard,] received, process exiting
