KiwiIRC runs as root

[ccoenen]

I don't believe it is a good idea to have this thing run as root user, it is defined here:

kiwiirc_packager/scripts/init/webircgateway

Line 14 in 9918b5b

user="root"

but never actually used anywhere. It would probably need to be referenced here:

kiwiirc_packager/scripts/init/webircgateway

Line 45 in 9918b5b

$cmd 1>> "$std_log" 2>&1 &

Other choices would be: www-data or httpd which are usually available on systems with http servers like apache or nginx; irc which is usually present on servers that run an ircd.

[ccoenen]

I changed the line to be
sudo -u $user $cmd 1>> "$std_log" 2>&1 &

but I have no idea if this is portable to different distributions.

[ccoenen]

(it should also be noted that you need to have root access to create ports < 1000, I am using this with "regular" webserver in front of it)

[prawnsalad]

you need to have root access to create ports < 1000

*1024

A lot of people do have this running on port 80/443 by default which either root is needed or some distros support setcap to allow non-root users to listen on ports < 1024. Also to remember that not all distros have sudo installed.

I'm not entirely sure what the best way of handling all these cases are short of creating a package for each and every distro out there.

[ccoenen]

there appear to be only shitty options to solve this.

• proxy to high port number is not trivial to set up
• iptables rerouting to high port number is not trivial to set up
• authbind appears to be debian/ubuntu only
• setcap CAP_NET_BIND_SERVICE would apparently allow any node process to open ports (not just the specific kiwiirc process) (apparently considered harmful, see next post, thanks for speaking up :-) )

Feel free to close this, but I still think this should be documented somewhere.

[mestaritonttu]

Systemd has a solution for the port binding, see for example here: https://github.com/mholt/caddy/blob/master/dist/init/linux-systemd/caddy.service#L43

Using setcap is considered harmful.

[prawnsalad]

@mestaritonttu any more info on why setcap is harmful?

[mestaritonttu]

Only this, like we discussed on IRC: caddyserver/caddy#528 (comment)