Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Starting OpenRC based init script as unprivileged user
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Portage & Programming
View previous topic :: View next topic  
Author Message
majoron
Apprentice
Apprentice


Joined: 12 Oct 2005
Posts: 243
Location: Frankfurt

PostPosted: Wed Mar 16, 2016 11:51 am    Post subject: Starting OpenRC based init script as unprivileged user Reply with quote

Dear all,
I'm having troubles to find a way to start an OpenRC service as a normal user.
I have written a simple init script to run a service that does not require root privileges. However when I try to start the service as non-root, I get:
Code:
 $ ./bin/myservice.openrc start
 * myservice.openrc: superuser access required

Of course running it as root works. Other commands ("status") are not affected; they go through.

I have also checked that the check for permissions does not happen at the script level, no. The init script does not even get read. It is "openrc" what stops the execution when it gets the "start" command, before playing with the script, AFAICT.

Does anyone know how to disable this "root privilege" enforcement? I would say there must be an easy way to do that...

Thanks in advance.


PS BTW, sorry if this is not the correct place to post this question. Let me know in case I should post in a different forum...

PS: Edit: typo
_________________
Computers are like air conditioners, they stop working properly if you open Windows
Back to top
View user's profile Send private message
eccerr0r
Watchman
Watchman


Joined: 01 Jul 2004
Posts: 10012
Location: almost Mile High in the USA

PostPosted: Wed Mar 16, 2016 12:55 pm    Post subject: Reply with quote

I would assume the logging and tracking of this service is why openrc wants root. Do you need the logging/tracking or can you live without it and simply not use openrc?

Otherwise you should simply just use "sudo" or something to run these scripts...
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?
Back to top
View user's profile Send private message
lexflex
Guru
Guru


Joined: 05 Mar 2006
Posts: 363
Location: the Netherlands

PostPosted: Wed Mar 16, 2016 12:55 pm    Post subject: Re: Starting OpenRC based init script as unprivileged user Reply with quote

Hi,

It depends on what you are trying to achieve:
The usual way (as far as I know) is that the service is started by root.
You can still run the services as another user. You can indicate this in the init file using the -u option:

Code:
start-stop-daemon --start --quiet --exec /usr/bin/<FILE TO EXECUTE>  -u USER


( however, this will still require root acces to start the service using openrc, but it will run as USER)

Alex.
Back to top
View user's profile Send private message
schorsch_76
Guru
Guru


Joined: 19 Jun 2012
Posts: 452

PostPosted: Wed Mar 16, 2016 1:49 pm    Post subject: Reply with quote

I have managed such an issue with sudo

in /etc/sudoers i added my script "/etc/init.d/something" and allowed it to espesially one user. ;) The "problem" is that openrc keeps track of the running Services. This update in ist tree needs root privileges. It is a seperate issue than the rights, that your service process needs ;)
_________________
// valid again: I forgot about the git access. Now 1.2GB big. Start: 2015-06-25
git daily portage tree
Web: https://github.com/schorsch1976/portage
git clone https://github.com/schorsch1976/portage
Back to top
View user's profile Send private message
majoron
Apprentice
Apprentice


Joined: 12 Oct 2005
Posts: 243
Location: Frankfurt

PostPosted: Thu Mar 17, 2016 2:33 pm    Post subject: Reply with quote

Thank you for the answers. I think some more info is needed...
I'm developing a service in a TDD fashion. There is a daemon doing its job, and at the end of the day the daemon should run as root in production. But I wanted to write some functional tests to check things from the user perspective, including the control of the daemon process through an OpenRC script. For the tests I would like to run as non-root.

So, I guess I need to play sudo to do the tests. Right?

Any other suggestions or comments would be welcome.
_________________
Computers are like air conditioners, they stop working properly if you open Windows
Back to top
View user's profile Send private message
Ant P.
Watchman
Watchman


Joined: 18 Apr 2009
Posts: 6920

PostPosted: Fri Mar 18, 2016 2:57 am    Post subject: Reply with quote

sudo would be easiest - if you really have to run it under OpenRC. You could also run a process supervision tool as a regular user which might be easier (not to mention more portable).
Back to top
View user's profile Send private message
majoron
Apprentice
Apprentice


Joined: 12 Oct 2005
Posts: 243
Location: Frankfurt

PostPosted: Fri Mar 18, 2016 2:21 pm    Post subject: Reply with quote

Ant P. wrote:
You could also run a process supervision tool as a regular user which might be easier (not to mention more portable).

Can you elaborate on this, please?

TIA
_________________
Computers are like air conditioners, they stop working properly if you open Windows
Back to top
View user's profile Send private message
steveL
Watchman
Watchman


Joined: 13 Sep 2006
Posts: 5153
Location: The Peanut Gallery

PostPosted: Fri Mar 18, 2016 3:39 pm    Post subject: Reply with quote

majoron wrote:
I'm developing a service in a TDD fashion. There is a daemon doing its job, and at the end of the day the daemon should run as root in production. But I wanted to write some functional tests to check things from the user perspective, including the control of the daemon process through an OpenRC script. For the tests I would like to run as non-root.

Hmm I was about to say: there is no such thing as "control of the daemon process through an OpenRC script", "from the user [non-root] perspective", but I have a vague memory that's incorrect. (ISTR some discussion in the commit history.)

UberLord would be able to provide some perspective.
Quote:
So, I guess I need to play sudo to do the tests. Right?

To start up, for now, yes; but use the -u option to ssd, mentioned above by lexflex, to ensure your service at least does not run as root, and thus cannot mess up too much, during testing.
Back to top
View user's profile Send private message
Ant P.
Watchman
Watchman


Joined: 18 Apr 2009
Posts: 6920

PostPosted: Fri Mar 18, 2016 6:32 pm    Post subject: Reply with quote

majoron wrote:
Ant P. wrote:
You could also run a process supervision tool as a regular user which might be easier (not to mention more portable).

Can you elaborate on this, please?

TIA

Look at sys-process/daemontools{,-encore}, sys-process/runit, sys-apps/s6 or busybox - they all work more or less the same (and systemd/upstart happen to be clones of these).
Back to top
View user's profile Send private message
cord
Guru
Guru


Joined: 28 Apr 2007
Posts: 346

PostPosted: Thu Jul 14, 2016 4:19 pm    Post subject: Reply with quote

Hi Averyone, I don't want to start new topic because this one is match to my issue.
I need to restart my net.eth0 often enough (networking lags). I want to make applet at desktop panel for that (so I would restart eth0 by one mouse click).
I added to /etc/sudoers this line (using visudo; user = john):
Code:
john localhost = NOPASSWD: /etc/init.d/net.eth0 restart

but
Code:
john@localhost ~ $ sudo -l
User john may run the following commands on localhost:
    (root) NOPASSWD: /etc/init.d/net.eth0 restart
john@localhost ~ $ /etc/init.d/net.eth0 restart
 * net.eth0: superuser access required
john@localhost ~ $
Back to top
View user's profile Send private message
depontius
Advocate
Advocate


Joined: 05 May 2004
Posts: 3530

PostPosted: Thu Jul 14, 2016 4:33 pm    Post subject: Reply with quote

john@localhost ~ $ sudo /etc/init.d/net.eth0 restart
_________________
.sigs waste space and bandwidth
Back to top
View user's profile Send private message
eccerr0r
Watchman
Watchman


Joined: 01 Jul 2004
Posts: 10012
Location: almost Mile High in the USA

PostPosted: Thu Jul 14, 2016 4:34 pm    Post subject: Reply with quote

Probably should have started a new thread, it's different enough... But anyway, don't forget to add "sudo" before the init script...

$ sudo /etc/init.d/net.eth0 restart
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?
Back to top
View user's profile Send private message
cord
Guru
Guru


Joined: 28 Apr 2007
Posts: 346

PostPosted: Thu Jul 14, 2016 4:43 pm    Post subject: Reply with quote

Ooops! I hadn't noticed the Elephant. :)
Thanks. And sorry for different issue.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Portage & Programming All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum