Which .services should not run as root?

Utini · 2018-12-16 11:08:07

Hello everyone,
I am currently setting up my new Arch setup and one thing I never paid much attention to was the user/groups with which the .service / processes are running.
For example the ntp wiki page states that ntp should be run as ntp:ntp but the .service will run as root when enabled anyway.

So I am curious, which .service shouldn't run as root?

Examples that I am thinking of:
ntp
dnscrypt-proxy
mpd

ua4000 · 2018-12-16 11:16:57

Did you already looked into

/usr/lib/systemd/system/ntpd.service

and in the other units ? I think this will answer your question.
Also you could read https://wiki.archlinux.org/index.php/Systemd/User - which mentions mpd as example.

Last edited by ua4000 (2018-12-16 11:17:31)

Utini · 2018-12-16 16:30:06

Thanks but my question was not on "how to run it as user" but instead "what should be run as user".

Scimmia · 2018-12-16 16:47:08

Only things that have to be.

Trilby · 2018-12-16 17:13:27

I think there may be a confusion between which user a service's process runs as and which user enables the service. For example, ntpd.service does run as user 'ntp'. But to start or enable the service, you run systemctl as root. The ntp process also technically starts with root privileges, but quickly drops them switching to ntp. This starting as root and dropping privileges after initializing some resources is common to many services. Web servers, for example, generally need to start as root to bind low numbered ports (e.g. 80 for http) but then imediately after binding the port, they drop root privilege and run as a low-privilege user (sometimes even in their own chroot).

So what are you really trying to understand? How to write system daemons, how to write service files to start those daemons, or how to use systemctl to enable those service files?

Last edited by Trilby (2018-12-16 17:16:31)

Utini · 2018-12-17 19:14:06

Oh I didn't know that services will drop privileges.

I was just worried that I had several .services run as "root" and wondered if there is a general recommendation on what to force to be started as a different user.

Trilby · 2018-12-17 19:58:41

Utini wrote:

I was just worried that I had several .services run as "root"

A vast majority of services are intended to be started by systemd which does start them as root (or at least root access is needed to enable them, the service file can also specify a User= which drops privileges even earlier). The only exception are those that can be run under a systemd --user session. The potential to run these services as a user is clearly indicated in their respective wiki pages. So if not specified otherwise, when the wiki advises to start/enable a service, it means to do so as root.

Last edited by Trilby (2018-12-17 19:59:23)

loqs · 2018-12-17 21:23:53

Note: ntpd should be started as non-root (default in the Arch Linux package) before attempting to jail it in a chroot, since chroots are relatively useless at securing processes running as root.

I think you may have been confused by this line from Network_Time_Protocol_daemon. It does mention default in the Arch Linux package is to be started as none root.
If you changed the service to start as ntp:ntp rather than root it would not be able to adjust the clock or bind to port 123.
After ntpd has accessed the clock and opened its network sockets it will change its user and group to ntp due to the the -u option which the supplied usr/lib/systemd/system/ntpd.service uses.

Last edited by loqs (2018-12-17 21:25:27)

eschwartz · 2018-12-18 02:21:31

loqs wrote:

If you changed the service to start as ntp:ntp rather than root it would not be able to adjust the clock or bind to port 123.

The port could be granted via a systemd.socket(5) file, and CAP_SYS_TIME can be used to grant permissions to modify the hardware clock. Does ntp already use capabilities(7) to grant itself CAP_SYS_TIME before it drops its privileges down to the "ntp" user? If so, then I suspect one could already configure the service to start as non-root.

loqs · 2018-12-18 04:34:58

Yes ntpd uses CAP_SYS_TIME and is aware to preserve it across setuid.

https://github.com/ntp-project/ntp/blob … tpd.c#L623

	uid = getuid();
	if (uid && !HAVE_OPT( SAVECONFIGQUIT )) {
		msyslog_term = TRUE;
		msyslog(LOG_ERR,
			"must be run as root, not uid %ld", (long)uid);
		exit(1);
	}

Then there is https://serverfault.com/questions/47563 … -0123?rq=1 it needs to bind to a routeable interface or it will not talk to remote servers.

Last edited by loqs (2018-12-18 04:35:45)

ua4000 · 2018-12-18 10:54:36

Trilby wrote:

The only exception are those that can be run under a systemd --user session. The potential to run these services as a user is clearly indicated in their respective wiki pages.

which is the case for mpd,
and this is why I mentioned this in my first post here :-)

Awebb · 2018-12-18 11:28:26

Utini wrote:

Oh I didn't know that services will drop privileges.

Looking at /usr/lib/systemd/system/ntpd.service could have saved you the ??? :-)

eschwartz · 2018-12-18 16:13:24

loqs wrote:

Yes ntpd uses CAP_SYS_TIME and is aware to preserve it across setuid.
https://github.com/ntp-project/ntp/blob … tpd.c#L623
	uid = getuid();
	if (uid && !HAVE_OPT( SAVECONFIGQUIT )) {
		msyslog_term = TRUE;
		msyslog(LOG_ERR,
			"must be run as root, not uid %ld", (long)uid);
		exit(1);
	}

Interesting. I guess someone motivated to do so, could submit a feature request to upstream, requesting that it also check if it already has CAP_SYS_TIME && a bound port, and if so, skip the root check.

Utini · 2018-12-18 21:10:01

Awebb wrote:

Utini wrote:
Oh I didn't know that services will drop privileges.
Looking at /usr/lib/systemd/system/ntpd.service could have saved you the ??? :-)

You are right, how ever, I believed I had started the .service and ntpd was still run as root.
I now enabled the service again and checked.. after a reboot its run by ntp:ntp.. so everything is fine.

But then again, the main question wasn't just about ntp but in general:
Are there any .services that should explicity run as non-root but currently do not do it by default?

loqs · 2018-12-18 21:16:55

Utini wrote:

Are there any .services that should explicity run as non-root but currently do not do it by default?

You are asking whether any one reading this thread considers that the package maintainer or upstream has produced a service that is incorrectly running a service as root?

Trilby · 2018-12-18 21:21:01

loqs wrote:

You are asking whether any one reading this thread considers that the package maintainer or upstream has produced a service that is incorrectly running a service as root?

For which the answer depends on your philosophical view of truth. Certainly there are no examples that we are aware of, or we would have opened bug reports on said examples to have them fixed; so the answer would be 'No'. On the flipside, bugs do exist, and I personally find it extrodinarily unlikely that there could not be a single problematic case out there somewhere; so the answer would be 'Yes'.

Arch Linux

#1 2018-12-16 11:08:07

Which .services should not run as root?

#2 2018-12-16 11:16:57

Re: Which .services should not run as root?

#3 2018-12-16 16:30:06

Re: Which .services should not run as root?

#4 2018-12-16 16:47:08

Re: Which .services should not run as root?

#5 2018-12-16 17:13:27

Re: Which .services should not run as root?

#6 2018-12-17 19:14:06

Re: Which .services should not run as root?

#7 2018-12-17 19:58:41

Re: Which .services should not run as root?

#8 2018-12-17 21:23:53

Re: Which .services should not run as root?

#9 2018-12-18 02:21:31

Re: Which .services should not run as root?

#10 2018-12-18 04:34:58

Re: Which .services should not run as root?

#11 2018-12-18 10:54:36

Re: Which .services should not run as root?

#12 2018-12-18 11:28:26

Re: Which .services should not run as root?

#13 2018-12-18 16:13:24

Re: Which .services should not run as root?

#14 2018-12-18 21:10:01

Re: Which .services should not run as root?

#15 2018-12-18 21:16:55

Re: Which .services should not run as root?

#16 2018-12-18 21:21:01

Re: Which .services should not run as root?

Board footer