-
Notifications
You must be signed in to change notification settings - Fork 464
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[example][systemd] use DynamicUser=yes
#186
Conversation
This patch fixes a warning generated by some new version of systemd. Use "User=nobody" seems to be considered unsafe. So maybe we need to fix it in our example files. ● ratholec@hitmc.service - Rathole Client Service Loaded: loaded (/etc/systemd/system/ratholec@.service; enabled; vendor preset: enabled) Active: active (running) since Sat 2022-09-03 23:38:43 CST; 1h 27min ago Main PID: 507903 (rathole) Tasks: 14 (limit: 76731) Memory: 6.9M CPU: 39.908s CGroup: /system.slice/system-ratholec.slice/ratholec@hitmc.service └─507903 /usr/local/bin/rathole -c /etc/rathole/hitmc.toml Sep 03 23:38:43 <hostname> systemd[1]: Started Rathole Client Service. ... Sep 03 23:39:25 <hostname> systemd[1]: /etc/systemd/system/ratholec@.service:7: Special user nobody configured, this is not safe! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969329 Link: trojan-gfw/trojan#612 Link: https://www.vvave.net/archives/fix-the-systemd-error-special-user-nobody-configured-this-is-not-safe.html
Thanks! |
IMHO, nither |
Did you mean |
Systemd user services are not designed to solve this problem, and they don't. Actually, only root user can switch UID. |
In-Reply-To @keuin
"they don't"? If you create a user named I think you are throwing away user-service too easily. Could you elaborate or provide further information about this?
You must have the root permission if you want to change system-wide services, (e.g. /etc/systemd/system). Is there any difference in comparison to user-services?
Permission wx is not mandatory. I could not image that you need to execute any configuration file. |
Yes, they don't. If your user is I understand how to make it work as a user systemd service. But, please focus on what we are actually discussing. By setting nobody or a temporary UID, what we are trying to achieve is making the process unprivileged. But this example configuration hasn't fully achieved its goal. I think I've make this clear enough in our previous discussion. To re-state my suggestion: as an example config, at least a note should be provided. This should be clearified and we can't just put (By talking |
Agreed |
Stumble across this issue today and I agree A typical use case is storing configurations and tokens under Yet with |
@boenshao It will be highly appreciated. Maybe we should provide an example using root and point out the security concerns with possible solutions(using separated users, etc.). |
This patch fixes a warning generated by some new version of systemd. Use
"User=nobody" seems to be considered unsafe. So maybe we need to fix it
in our example files.
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969329
Link: trojan-gfw/trojan#612
Link: https://www.vvave.net/archives/fix-the-systemd-error-special-user-nobody-configured-this-is-not-safe.html
CC: @rapiz1