* Unprivileged Shutdown?
@ 2022-05-28 3:44 Dallin Dahl
2022-05-28 8:43 ` Laurent Bercot
0 siblings, 1 reply; 2+ messages in thread
From: Dallin Dahl @ 2022-05-28 3:44 UTC (permalink / raw)
To: supervision
I have been using simple privilege escalation to poweroff the machine,
but looking through the source code for s6-linux-init-shutdownd and
friends, it appears the only constraint on interacting with the daemon
is the permissions on run-image/service/s6-linux-init-shutdownd/fifo.
The default appears to be:
600 root root
I've changed it on my system to be:
620 root power
and added my user to the power group.
This seems like the cleanest way to implement unprivileged
poweroff/reboot, but I'm concerned that it's not possible by default.
Is there a better way, or is it just meant to be done manually?
Thanks!
--Dallin
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Unprivileged Shutdown?
2022-05-28 3:44 Unprivileged Shutdown? Dallin Dahl
@ 2022-05-28 8:43 ` Laurent Bercot
0 siblings, 0 replies; 2+ messages in thread
From: Laurent Bercot @ 2022-05-28 8:43 UTC (permalink / raw)
To: supervision
>I have been using simple privilege escalation to poweroff the machine,
>but looking through the source code for s6-linux-init-shutdownd and
>friends, it appears the only constraint on interacting with the daemon
>is the permissions on run-image/service/s6-linux-init-shutdownd/fifo.
>
>The default appears to be:
>600 root root
>I've changed it on my system to be:
>620 root power
>and added my user to the power group.
>
>This seems like the cleanest way to implement unprivileged
>poweroff/reboot, but I'm concerned that it's not possible by default.
>Is there a better way, or is it just meant to be done manually?
No, you are correct that it is the right mechanism.
Allowing unprivileged shutdown is a dangerous operation and should
only be done is very specific circumstances (i.e. when a normal user
has complete seat and console access), so it's not the default and the
mechanism is fairly hidden.
If there's demand, I can probably write a s6-linux-init-shutdown-perms
program in a future version that would let you specify the user/group
allowed to shutdown, rather than having you manually tinker with the
fifo.
--
Laurent
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-05-28 8:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-28 3:44 Unprivileged Shutdown? Dallin Dahl
2022-05-28 8:43 ` Laurent Bercot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).