3

Assume a script runs on boot as root. From this script I want to start tcpsvd -E 0 515 lpd. I want tcpsvd to run as an unprivileged user. But it requires root privileges to bind to the port 515. How can I achieve this?

Further I have to use busybox tcpsvd:

tcpsvd
tcpsvd [-hEv] [-c N] [-C N[:MSG]] [-b N] [-u USER] [-l NAME] IP PORT PROG

Create TCP socket, bind to IP:PORT and listen for incoming connection.
Run PROG for each connection.

    IP              IP to listen on. '0' = all
    PORT            Port to listen on
    PROG [ARGS]     Program to run
    -l NAME         Local hostname (else looks up local hostname in DNS)
    -u USER[:GRP]   Change to user/group after bind
    -c N            Handle up to N connections simultaneously
    -b N            Allow a backlog of approximately N TCP SYNs
    -C N[:MSG]      Allow only up to N connections from the same IP
                    New connections from this IP address are closed
                    immediately. MSG is written to the peer before close
    -h              Look up peer's hostname
    -E              Do not set up environment variables
    -v              Verbose
  • 4
    It says right there: "-u USER[:GRP] Change to user/group after bind". What more did you need? – cjm Sep 26 '13 at 19:31
  • Thats fine thank you. I hoped to find a way to do it in a more generic way with su,sudo,etc. – ManuelSchneid3r Sep 27 '13 at 11:39
  • Now I am at the point where I get into trouble. $BUSY/busybox tcpsvd -u manuel:manuel -E 0 515 $BUSY/busybox lpd /var/spool zenity --error --text "$DATAFILE" returns nothing. $DATAFILE is set by lpd. lpd is run as manuel but the environment is root. How do I change this behaviour? – ManuelSchneid3r Sep 27 '13 at 12:24
  • 1
    The shell expands $DATAFILE when you type that command, not when lpd executes zenity. You need to put the zenity command into a shell script, and have lpd call that script. Then $DATADIR will be expanded at the right time. – cjm Sep 27 '13 at 14:17
4

You need to have the program bind to the port while running as root, and then switch to your unprivileged user. tcpsvd offers the -u option for doing this:

 -u user[:group]
          drop permissions.  Switch user ID to user’s UID, and group ID to
          user’s primary GID after creating and binding to the socket.  If
          user  is  followed  by a colon and a group name, the group ID is
          switched to the GID of group instead.  All supplementary  groups
          are removed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.