Re: non-root doing "svc -o /service/root-owned-service"

Can't comment on the security aspects of your solution, but there are plenty of alternatives:
- Add www-data to sudoers config and allow only the `/usr/local/bin/svc -o /service/important-process` command)
- Use the flag-file solution and employ a filesystem monitoring tool like `entr` to only trigger running the process once the file has changed
- Rewrite important-process to be a service that can be called via API?!

-Andreas

On 2019-03-30 16:16, Otavio Exel wrote:
> Hello,
> 
> my question is related to daemontools but not to multilog.
> let me know if I should ask this somewhere else.
> 
> I have to start an important-process from inside a cgi script spawned by Apache.
> to avoid running important-process in the possibly-dirty environment of Apache I usually:
> - in the cgi scipt: create a flag file somewhere
> - wait for a minute-by-minute cron job to notice it and start important-process
> ...and I hate this solution!!!
> 
> so I am trying to run important-process under svscan / supervise:
> - /service/important-process would be "normally down"
> - the cgi script would issue a mere svc -o /service/important-process
> 
> now in order to allow www-data to control the service I did (what seemed to me) the bare minimum to give it write access to supervise/control
> like that:
> - chgrp www-data supervise
> - chmod g+x supervise
> - chgrp www-data supervise/control
> - chmod g+w supervise/control
> 
> and it did work!
> 
> now... beeing the lousy unix admin that I am, before going ahead I would like to ask you some questions:
> 
>  1. do you see any further security implications?
>     (apart from the fact that now www-data can control the service)
>  2. would you suggest a better/safer way to do that?
> 
> thank you!
> 
> -- 
> Otavio Exel /<\oo/>\ [email protected] <mailto:[email protected]>