Re: capi20 permissions

On Fri, Mar 09, 2012 at 05:39:06PM +0100, Lars Immisch wrote:
> Hi,
> 
> Tobias Powalowski asked me it is a bug that capi related tools can seemingly only be started as root.
> 
> I have the same (cosmetic) problem, here is my current analysis.
> 
> The short answer is: no, it's not a bug, it's an installation/packaging issue. The capi tools can be run as any user or group.
> 
> mISDNcapid needs access to a shared POSIX semaphore and shared memory in /dev/shm/. It will open the sempahore/shared mem with RW access to the user/group it is running as. Also, it needs to be able to write to /var/run/mISDNcapid.
> 
> When these conditions are met, the capi user processes can be run under the same user or group.
> 

mISDNcapid need access to sockets and some other files so it should be run
under a defined group - I use group "dialout" here (via SGID bit).
All users which allowed to use ISDN services need to be member in this group.
Also the /var/run/mISDNcapid/socket and the /dev/shm*CAPI*
need to have RW access for this group, because every application using CAPI
will open these files.
mISDNcapid also need access to /dev/mISDNtimer.
You can configure the name of the group when building mISDNuser stuff, see
./configure --help


If you have better suggestions how to handle privileges here, you are
welcome.

Karsten