Skip to content
Snippets Groups Projects
Commit 16197257 authored by Jameson Rollins's avatar Jameson Rollins
Browse files

allow awgtpman to run as unprivileged user

The awgtpman process is run as root only because it wants to bind to a
privileged port.  This is not necessary as capabilities exist to allow
running it as a unprivileged user:

* remove an unnecessary check in the awgtpman binary on the superuser
  status of the user

* set CAP_NET_BIND_SERVICE in the systemd service to allow it to bind
  to privileged port

This should allow the service to run as a non-privileged user, which we
set here to be advligorts.

closes #93
parent 0502a4b7
No related branches found
No related tags found
1 merge request!81allow awgtpman to run as unprivileged user
......@@ -175,12 +175,7 @@ CDS_HARDWARE cdsPciModules;
initReflectiveMemory();
#endif
if (run_awg) {
if (geteuid() != 0) {
printf ("Must be a superuser to run awgtpman\n");
return 1;
} else {
nice(-20);
}
nice(-20);
}
/*
if ($::site =~ /^M/) {
......
......@@ -5,5 +5,7 @@ Wants=rts-module@%i.service
PartOf=rts@%i.target
[Service]
User=advligorts
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
ExecStart=/usr/bin/rts_awgtpman_exec %i
Restart=always
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment