Implement solution dropping root requirement
eripa opened this issue · comments
Currently the tool requires root to run (on Linux and macOS, not FreeBSD & SmartOS) because zpool which it wraps requires root.
It's generally not recommended to run network services as root. Two ideas that I've been thinking about:
- Use a helper process that periodically dumps parsable data to a file (similar to my nagios-zfs-go tool)
- or implement a two-process solution that separates privileges via a RPC or socket
- or implement some fancy drop privilege solution
you can use sudoers to allow a certain cmd as a non-root user.
see http://www.atrixnet.com/allow-an-unprivileged-user-to-run-a-certain-command-with-sudo/
@phaus Thanks for the suggestion. However my concern is not how to start the service as root (for which the sudo solution works fine!), it's rather that I do not want to have the service running 24/7 with root privileges. Network services should ideally be owned and run by an unprivileged user.
Normally a process that requires root for some reason starts out with root, does its' thing (such as binding a port), then drops the root privileges and continues executing with some arbitrary user, such as www-data in the case of nginx or apache.