4 ms·
It’s one thing to launch a daemon with restricted privileges, but they often need to do privileged things at startup and then drop privileges them on their own
by BobbyTables2 3y ago
It’s one thing to launch a daemon with restricted privileges, but they often need to do privileged things at startup and then drop privileges them on their own. How would systemd help with that??
- theamk 3y agoA lot of times you cat offload stuff to systemd. For example, a server might need privileged operations to open low port and set up logging. But with systemd, you use socket activation, so low port is opened for you, and logging is centralized, you just write to stdout. If this is not enough, you can have "ExecStartPre" command in unconfined mode. Great if you need to fix up permissions for example. And if that does not work either, you can do privilege dropping twice. For example, systemd isolates filesystem, sets capabilities and NoNewPrivileges bit, but still runs daemon with root access. Daemon does whatever init it needs to do, and then drop the remaining privileges.