Thanks for the explanation Michael. I was wondering if it was possible or feasible to make the user a configuration option in the rc.* file for the service. I guess that would be difficult if the rpm lays out the ownership of the data files. If I really want to go this route I might just jettison the rc scripts for such services and roll (reuse) my own start and stop scripts with my own configuration settings that place the data elsewhere.
Martin > -----Original Message----- > From: Michael van Elst [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, February 19, 2003 2:12 AM > To: [EMAIL PROTECTED] > Subject: Re: rc does not return failed exit status? > > > On Tue, Feb 18, 2003, Andrews, Martin wrote: ... > > Also, just noticed that openpkg runs postgres as the user > openpkg-r. Do > > (most) all services run as openpkg-r? Is there an option to > set a unique > > user for each service somehow? Otherwise I worry that I > will be leaking > > privileges by using this shared account. > > We have four privilege levels associated with four user ids: > > s_usr essentially root > m_usr owner of the installation (like 'bin') > r_usr services that do not require root may run as r_usr > if they access non-public files or write files themselves. > n_usr non-privileged user that must not own any files > (like 'nobody') > services that do not need their own files should run > as n_usr. > > Of course this does not discriminate between multiple services > within a single OpenPKG installation. However, it is a simple > and thus easily maintainable scheme which therefor adds to the > security of the installation. > > If you want to assign different users to each service you can > create multiple OpenPKG hierarchies, each with its own set of > privileged users (except s_usr which is of course the same). > This way not only the uid running services will be separated > but also the uid owning most files. You also avoid security > relevant dependencies because you can reduce a hierarchy to > the minimum set of packages required for a single service. > And finally such a separation makes it trivial to separate > services on individual machines. > > > Greetings, > -- > Michael van Elst > [EMAIL PROTECTED] > ______________________________________________________________________ > The OpenPKG Project www.openpkg.org > User Communication List [EMAIL PROTECTED] > ______________________________________________________________________ The OpenPKG Project www.openpkg.org User Communication List [EMAIL PROTECTED]
