Hi, all:
I recall there being something about running daemons as user "nobody." Is that still a policy? Cursory search in the wiki revealed nothing, but searching for "user nobody" is near-futile. :)
Don't we normally create daemon-specific users?
Cheers,
On Wed, 2007-09-05 at 12:37 -0400, Konstantin Ryabitsev wrote:
I recall there being something about running daemons as user "nobody." Is that still a policy? Cursory search in the wiki revealed nothing, but searching for "user nobody" is near-futile. :)
Don't we normally create daemon-specific users?
On my system, nobody isn't running any daemon process, :). *snicker*
Seriously, though, it seems that most Fedora packages have daemons running with their own uid (apache, tomcat5, rpc, rpcuser, dovecot, asterisk, smmsp, xfs, avahi, toranon, 68 ... 68?!? oh wait .. that's hald, named and of course, the desktop user for various desktop daemons). I've so many processes living in my system. I've grown so close to them, they're almost like family, ;).
Whether it's in a policy, i don't know. Actually, there doesn't seem to be a lot of policies showing on the wiki. It's probably on the TODO list. I was just asking about policies myself in a thread on Modularization. --
Richi
Hi Konstantin Ryabitsev!
On Wed, Sep 05, 2007 at 12:37:16PM -0400, Konstantin Ryabitsev wrote next:
I recall there being something about running daemons as user "nobody." Is that still a policy? Cursory search in the wiki revealed nothing, but searching for "user nobody" is near-futile. :) Don't we normally create daemon-specific users?
If you create only one user to many services you pick up big security hole. For example, you have installed httpd and mysql under nobody account. If the cracker crashed httpd he also got access to mysql. That's why we need to create separate user per unique service.