Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

setuid necessary? #9

Open
markstos opened this issue Aug 20, 2018 · 1 comment
Open

setuid necessary? #9

markstos opened this issue Aug 20, 2018 · 1 comment
Labels

Comments

@markstos
Copy link
Contributor

Is it necessary for this to run setuid? Could it run as a less privileged user and log to the systemd journal instead?

I've started the process of packing this app as a "snap" for easier installation on a number of distros, but the use of setuid trips up one of the security features of the format.

@kbucheli
Copy link

The reason for setuid is, as stated by techsolo in #10, is necessary to avoid tampering.
If it runs on user prermissions, it can be killed or be tampered with the files. If that is OK, then you can directly use script.
Another option that might work is to setuid to a different user than root. I did not test it, but it can be tried without changes to the tool as it only depends on your installation.
Concerning systemd, I do not want to load the tool with further dependencies as it is now very lightweight.
Still I am open to such use cases. The tool currently runs with two processes, one handles the terminal stuff and gets the data to be logged whereas the second process writes them to the files.
That second process could also be something else which does e.g. compression, encryption, signing, forwarding to some logging systems, etc. I am open to pull requests for a feature which pipes the data to be logged to an external tool instead of writing to a file.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

2 participants