You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is it necessary for this to run setuid? Could it run as a less privileged user and log to the systemd journal instead?
I've started the process of packing this app as a "snap" for easier installation on a number of distros, but the use of setuid trips up one of the security features of the format.
The text was updated successfully, but these errors were encountered:
The reason for setuid is, as stated by techsolo in #10, is necessary to avoid tampering.
If it runs on user prermissions, it can be killed or be tampered with the files. If that is OK, then you can directly use script.
Another option that might work is to setuid to a different user than root. I did not test it, but it can be tried without changes to the tool as it only depends on your installation.
Concerning systemd, I do not want to load the tool with further dependencies as it is now very lightweight.
Still I am open to such use cases. The tool currently runs with two processes, one handles the terminal stuff and gets the data to be logged whereas the second process writes them to the files.
That second process could also be something else which does e.g. compression, encryption, signing, forwarding to some logging systems, etc. I am open to pull requests for a feature which pipes the data to be logged to an external tool instead of writing to a file.
Is it necessary for this to run setuid? Could it run as a less privileged user and log to the
systemd
journal instead?I've started the process of packing this app as a "snap" for easier installation on a number of distros, but the use of
setuid
trips up one of the security features of the format.The text was updated successfully, but these errors were encountered: