search

sshmanko / acestream-armv7

AceStream engine for ARM devices
47 stars 14 forks source link

Drop permissions after chroot for security? #6

Closed trananhtuan closed 5 years ago

trananhtuan commented 5 years ago

Having acestream running as root might not be safe. Please consider dropping permissions after chroot.

chown -R acestream:acestream /opt/acestream/androidfs

Inside acestream.start: chroot --userspec=acestream:acestream $ACEADDON/$ACECHROOT /system/bin/busybox sh -c "/system/bin/acestream.sh" > $ACEADDON/acestream.log 2>&1

Running /opt/acestream/acestream.start manually works but systemctl start acestream doesn't work. This is the content of /opt/acestream/acestream.log systemctl start acestream after :

Traceback (most recent call last): File "/home/shimoda/python-for-android/python-build/python_arm/python-ext/python/site.py", line 539, in <module> File "/home/shimoda/python-for-android/python-build/python_arm/python-ext/python/site.py", line 521, in main File "/home/shimoda/python-for-android/python-build/python_arm/python-ext/python/site.py", line 266, in addusersitepackages File "/home/shimoda/python-for-android/python-build/python_arm/python-ext/python/site.py", line 241, in getusersitepackages File "/home/shimoda/python-for-android/python-build/python_arm/python-ext/python/site.py", line 231, in getuserbase File "/home/shimoda/python-for-android/python-build/python_arm/python-ext/python/sysconfig.py", line 525, in get_config_var File "/home/shimoda/python-for-android/python-build/python_arm/python-ext/python/sysconfig.py", line 482, in get_config_vars File "/home/shimoda/python-for-android/python-build/python_arm/python-ext/python/sysconfig.py", line 192, in _getuserbase File "/home/shimoda/python-for-android/python-build/python_arm/python-ext/python/sysconfig.py", line 178, in joinuser File "/home/shimoda/python-for-android/python-build/python_arm/python-ext/python/posixpath.py", line 262, in expanduser KeyError: 'getpwuid(): uid not found: 992'

trananhtuan commented 5 years ago

This is probably due to user acestream (992) is not known to the chroot android but why does it work when running manually?

trananhtuan commented 5 years ago

It seems I got it working by mapping Linux host userID with Android one.

Execute following commands as root:

usermod -u 100001 acestream
groupmod -g 100001 acestream
chown -R acestream:acestream /opt/acestream/androidfs
systemctl restart acestream

That's it!