search

opensciencegrid / xrootd-monitoring-shoveler

XRootD monitoring flow packet shoveler
Apache License 2.0
2 stars 7 forks source link

Run as unprivileged user (and create that user via packages) #47

Closed olifre closed 7 months ago

olifre commented 7 months ago

This creates a user and group xrootd-monitoring-shoveler and runs the service as that user. Furthermore, it adds a dependency of the service on network-online.target to prevent it from coming up before the network is online.

While not strictly necessary, it's likely better to merge this after https://github.com/opensciencegrid/xrootd-monitoring-shoveler/pull/34 to ensure it does not break anything, since that PR tests the packaging and execution. I tried that in my fork (to ensure I don't break things :wink: ), and it worked well in my tests.

djw8605 commented 7 months ago

This looks good, have you tested on both debian and RPM?

olifre commented 7 months ago

This looks good, have you tested on both debian and RPM?

Thanks!

I have not tested on a physical system, but https://github.com/opensciencegrid/xrootd-monitoring-shoveler/pull/34 installs the packages directly on various distros (RockyLinux 8 and 9, Debian stable, testing and unstable). Since it uses the packages built with goreleaser and runs them in a matching OS container, I think that's (almost) as good as testing on a real system (I tested in a fork applying #34 first and then #47 ).

If you prefer an actual test on a physical node, I can also do that latest next week.