search

opensciencegrid / xrootd-monitoring-shoveler

XRootD monitoring flow packet shoveler
Apache License 2.0
2 stars 7 forks source link

Run as unprivileged user (and create that user via packages) #47

Closed olifre closed 10 months ago

olifre commented 10 months ago

This creates a user and group xrootd-monitoring-shoveler and runs the service as that user. Furthermore, it adds a dependency of the service on network-online.target to prevent it from coming up before the network is online.

While not strictly necessary, it's likely better to merge this after https://github.com/opensciencegrid/xrootd-monitoring-shoveler/pull/34 to ensure it does not break anything, since that PR tests the packaging and execution. I tried that in my fork (to ensure I don't break things :wink: ), and it worked well in my tests.

djw8605 commented 10 months ago

This looks good, have you tested on both debian and RPM?

olifre commented 10 months ago

This looks good, have you tested on both debian and RPM?

Thanks!

I have not tested on a physical system, but https://github.com/opensciencegrid/xrootd-monitoring-shoveler/pull/34 installs the packages directly on various distros (RockyLinux 8 and 9, Debian stable, testing and unstable). Since it uses the packages built with goreleaser and runs them in a matching OS container, I think that's (almost) as good as testing on a real system (I tested in a fork applying #34 first and then #47 ).

If you prefer an actual test on a physical node, I can also do that latest next week.