Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a daemon sitting in my root directory that currently is being run as root. However, since this program can read the file system, this is clearly a security problem. How can I run it as nobody so that I can resolve this problem?

Doing "su - nobody -c /root/myscript" doesn't work, returning a permission denied error. The only ways I can seem to get around this are:

  1. Chmod -R 777 /root, which I don't want to do on my root dir and also messes up ssh.
  2. Move the script to /opt or /var and then do (1)

Of course, there may be an easy solution that I'm missing. I can chown it to nobody but that doesn't fix the problem either. Any ideas?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

You don't want to do (1) -- Leave root's home directory alone. (2) is your best option - Create a new directory owned by the user the daemon will run as & have it do any disk I/O it needs to do in that directory.

Semi-related, please don't run things as "nobody" -- there's an old joke that nobody is usually the most privileged user on a *NIX system because all the daemons run as "nobody".

If you're really concerned about security you don't want to fall into that trap. It's worth taking the extra minute to create a dedicated user for your daemons with appropriate restrictions :-)

share|improve this answer
    
+1 creating for creating a task-specific service account. –  Zoredache Feb 7 '10 at 3:24
    
Hi voretaq7 and @Zoredache, can you provide a link or explain on the proper way of create a dedicated user for the daemon with appropriate restrictions? Thank you. –  Haozhun Mar 9 '12 at 16:28
    
@Gene "The same way you would create any user account on your system" is the best answer I can give you - Refer to the documentation for your system (or ask a question on unix.stackexchange.com, remembering to specify your OS) –  voretaq7 Mar 9 '12 at 16:48
add comment

Well - the script currently resides in /root. Assuming that your target user is not root, then of course you'll get a permissions error when that user tries to read/execute the script.

What is your opposition to moving the script to a different directory? If you do that, then set the file ownership/mode correctly, you should have no issues.

share|improve this answer
    
I don't have any serious opposition to it, but I just was wondering if there was an easy way to leave it in /root (that is, I originally thought I could just give the file to 'nobody' and call it a day). –  Chris Bunch Feb 7 '10 at 2:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.