----- Original Message -----
> [This patch isn't finished yet, but I'm soliciting comments
> before I take it any further]
>
> PCP daemons on the Linux platform don't need to be run as the
> root user - we can and should reduce the potential for security
> issues by running these daemons as a "pcp" user.
Would love to see this done...
> That includes
> pmcd, pmlogger, pmie, pmproxy and PMDAs running as daemons.
pmproxy can (and does for us) already run as non-root, there
is startup script support already for running it as "nobody"
(thats how we run it, with no external pmcd access available).
> This patch still needs work in pmdaproc.sh and a few other
> areas (configure.in, non-Linux platforms, QA, etc), but it's
> functional on Fedora so far as a proof of concept.
One other issue that I know of is that the network ioctls for
extracting interface bandwidth - SIOCETHTOOL and co - require
root permissions (in pmdalinux).
cheers.
--
Nathan
|