Open CampinCarl opened 4 years ago
Modify the if statement logic to allow users to override the behavior, perhaps with a command line flag like --allow-auto-update?
I am not a fan of adding new flags because most people simply wouldn't know about it.
Is there any way to detect this automatically?
That's fair, this is admittedly a bit of an edge case though I'd argue it's the best way to set it up on Linux without root (at least with systemd). Would you consider a configuration file directive instead or is that just as bad/worse?
As for how to detect it, I suspect you'd need to interact with systemd directly to check. I only know a little Go so here's how one could check from the shell.
systemctl status <AdGuardHome PID>
; orps -o unit <AdGuardHome PID>
systemctl show -p AmbientCapabilities <AdGuardHome Service File>
If the output from step 2 includes cap_net_bind_service
then it should be safe to upgrade AdGuard Home.
Well, we can run shell commands from Go, it's a perfectly viable solution.
We will need to implement a method that will call your commands one by one, something like util.HaveAmbientCapabilities()
and use it.
Something like this:
if runtime.GOOS != "linux" {
return false;
}
cmd := "systemctl status " + os.Getpid()
if cmd, e := exec.Run(cmd, nil, nil, exec.DevNull, exec.Pipe, exec.MergeWithStdout); e == nil {
b, _ := ioutil.ReadAll(cmd.Stdout)
output := string(b)
// parse, find config file
// read the config file, check the capabilities
}
Marked as "help wanted" for now that means that we're looking for anyone who can contribute this change to AGH. If it gets more upvotes and no one volunteers to implement it, we'll do it.
That makes sense; thanks for the insight. I'm a bit of a novice with Go but I'll play with it and see if I can't get something working.
Problem Description
The if statement linked below rightly describes the issue with setting
CAP_NET_BIND_SERVICE
on binary files in Linux but doesn't account for setting this option using systemd'sAmbientCapabilities
directive instead, which doesn't require setting the capability on the binary itself.https://github.com/AdguardTeam/AdGuardHome/blob/b4aa79151315035f0e839d9a710fe4051595acb5/home/control_update.go#L101-L111
Proposed Solution
Modify the if statement logic to allow users to override the behavior, perhaps with a command line flag like
--allow-auto-update
? When combined with the AmbientCapabilities systemd directive, this would allow users to auto upgrade the binary even when running AdGuardHome without root permissions.Systemd Service File Example
Alternatives Considered
Script the upgrade myself or fork the code, but a native solution would be much easier and a benefit for other Linux users. Thanks for the great application!
Additional Information