Skip to content
This repository has been archived by the owner on Nov 24, 2022. It is now read-only.

Implement solution dropping root requirement #3

Open
eripa opened this issue Jan 15, 2017 · 2 comments
Open

Implement solution dropping root requirement #3

eripa opened this issue Jan 15, 2017 · 2 comments
Milestone

Comments

@eripa
Copy link
Owner

eripa commented Jan 15, 2017

Currently the tool requires root to run (on Linux and macOS, not FreeBSD & SmartOS) because zpool which it wraps requires root.

It's generally not recommended to run network services as root. Two ideas that I've been thinking about:

  • Use a helper process that periodically dumps parsable data to a file (similar to my nagios-zfs-go tool)
  • or implement a two-process solution that separates privileges via a RPC or socket
  • or implement some fancy drop privilege solution
@eripa eripa added this to the v0.2.0 milestone Jan 15, 2017
@phaus
Copy link

phaus commented Jan 15, 2017

you can use sudoers to allow a certain cmd as a non-root user.
see http://www.atrixnet.com/allow-an-unprivileged-user-to-run-a-certain-command-with-sudo/

@eripa
Copy link
Owner Author

eripa commented Jan 16, 2017

@phaus Thanks for the suggestion. However my concern is not how to start the service as root (for which the sudo solution works fine!), it's rather that I do not want to have the service running 24/7 with root privileges. Network services should ideally be owned and run by an unprivileged user.

Normally a process that requires root for some reason starts out with root, does its' thing (such as binding a port), then drops the root privileges and continues executing with some arbitrary user, such as www-data in the case of nginx or apache.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants