Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make possible to run without root; socket creation. #802

Closed
zander opened this issue Jul 6, 2021 · 1 comment
Closed

Make possible to run without root; socket creation. #802

zander opened this issue Jul 6, 2021 · 1 comment

Comments

@zander
Copy link
Contributor

zander commented Jul 6, 2021

The default location of the admin socket is /var/run/yggdrasil.sock.

There are two problems with that;

  1. it is created and deleted once per session instead of once and then reused.
  2. the /var/run dir is only writable by root.

Those two together means that on the topic of the socket, you need to run yggdrasil as root. And that is unfortunate for server software. Security wise there is a wish to avoid running things as root.

The easiest solution is to create a yggdrasil subdir in /var/run which avoids the permissions issue. Not sure how that works together with #449.
The alternative solution is to not delete the socket file upon exit, as that avoids the requirement to be root to do so. Edit; this means the app can drop root privs the moment the socket is created, or use a separate method to create it.

zander added a commit to zander/yggdrasil-go that referenced this issue Jul 24, 2021
The `AdminListen` option and `yggdrasilctl` now default to
`unix:///var/run/yggdrasil/yggdrasil.sock` on Linux

This allows yggdrasil to be run as its own user.

Closes yggdrasil-network#802
zander added a commit to zander/yggdrasil-go that referenced this issue Jan 9, 2022
The `AdminListen` option and `yggdrasilctl` now default to
`unix:///var/run/yggdrasil/yggdrasil.sock` on Linux

This allows yggdrasil to be run as its own user.

Closes yggdrasil-network#802
@neilalexander
Copy link
Member

This is being looked at in #927.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants