Date: Wed, 6 Feb 2008 21:58:18 +0000 From: RW <fbsd06@mlists.homeunix.com> To: freebsd-questions@freebsd.org Subject: Re: /usr/local/etc/rc.d/ scripts and non-root user Message-ID: <20080206215818.2bf7aa0e@gumby.homeunix.com.> In-Reply-To: <47A9E9DE.2060503@dial.pipex.com> References: <94136a2c0802060751o7952c2f8w639139271c946e98@mail.gmail.com> <47A9E373.80300@dial.pipex.com> <94136a2c0802060849o1dfb3f6ek67d7d41db5d99102@mail.gmail.com> <47A9E9DE.2060503@dial.pipex.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 06 Feb 2008 17:09:50 +0000
Alex Zbyslaw <xfb52@dial.pipex.com> wrote:
> I personally much prefer scripts in rc.d because it's much easier to
> migrate than crontabs, and if I never use a crontab I always know
> where to look.
>
> It looks to me like you shouldn't be starting the demon as user api -
> startups scripts should always be started as root. If the demon or
> whatever is supposed to run as api not root, then perhaps your script
> should say e.g.
>
> su api -c the-path-to-the-demon-or-whatever
>
> root can su to whoever without a password, and api can su to api
> without a password, and everyone else gets prompted.
It's actually built into /etc/rc.subr, the subversion server script is
a simple example of starting a daemon with a different user:
$ grep -v "^#" /usr/local/etc/rc.d/svnserve
. "/etc/rc.subr"
svnserve_enable=${svnserve_enable:-"NO"}
svnserve_flags=${svnserve_flags:-"-d --listen-port=3690"}
svnserve_data=${svnserve_data:-"/usr/local/repositories"}
svnserve_user=${svnserve_user:-"svn"}
svnserve_group=${svnserve_group:-"svn"}
name=svnserve
rcvar=`set_rcvar`
load_rc_config $name
command=/usr/local/bin/svnserve
command_args="-r ${svnserve_data}"
run_rc_command "$1"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080206215818.2bf7aa0e>