Hi everyone,Our Kea (ISC's DHCP server) package is moving to a non-root setup to run services for improved security. This implies a manual intervention for users upgrading from an existing installation.
See the news draft below (pad available at https://md.archlinux.org/1TykcWc0TPaz3MAuwfm9Fw).
---Starting with `kea 1:3.0.3-2`, all kea services now run as a dedicated non-privileged `kea` user (instead of `root`) for improved security.
This change requires a manual intervention for users upgrading from `kea` <= `1:3.0.3-1` to >= `1:3.0.3-2`, in order to update the permissions and ownership of the kea files and directories accordingly.
After upgrading, run the following commands to update permissions and ownership of kea files and directories, then restart the affected services (if they are running):
```bashchmod 755 /etc/kea/{,radius} /usr/include/kea/{,asiodns,asiolink,cc,config,config_backend,cryptolink,d2srv,database,dhcp,dhcp_ddns,dhcpsrv,dhcpsrv/parsers,dns,eval,exceptions,hooks,http,log,log/interprocess,mysql,pgsql,process,process/cfgrpt,stats,tcp,util,util/encode,util/io} /usr/lib/kea/{,hooks} /usr/lib/python3.14/site-packages/kea/{,__pycache__/} /usr/share/kea/{,api,meson-info,scripts,scripts/mysql,scripts/pgsql}
chmod 644 /etc/kea/*.conf /etc/kea/radius/*
chown kea: /var/lib/kea/* /var/log/kea/* /run/lock/kea/logger_lockfile
systemctl try-restart kea-ctrl-agent.service kea-dhcp{4,6,-ddns}.service
```
If necessary, you can run `pacman -Qkk kea` to find any other permission
deviations and adjust as needed.
--- -- Regards, Robin Candau / Antiz
OpenPGP_0xFDC3040B92ACA748.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
