Those are really good points that I missed and probably should've just kept it all contained to doas permissions. The patch can be dropped since it seems root user is more favorable; and if a pf reaction plugin is developed it would require root access anyways.
I'd also beware of big reaction databases. On one of my systems the reaction database had grown to about 500MB which would require very big daemon timeouts (60s wasn't enough, 120s is too long), would use a very high amount of CPU usage for hours and slowly process pfctl commands (which goes back to relying on a plugin for performance, which then requires root...). On Mon, 17 Aug 2026 18:14:51 +0200 Landry Breuil <[email protected]> wrote: > Le Mon, Aug 17, 2026 at 05:35:39PM +0200, [email protected] a écrit : > > Le Thu, Jul 23, 2026 at 06:27:37PM +0200, Lydia Sobot a écrit : > > > On July 1, 2026 12:18:27 GMT+02:00, [email protected] wrote: > > > >Made my Rust port into a patch that adds the dedicated reaction user. > > > > > > > >The rc.d uglyness is now gone, but requires a patch to the Rust code > > > >to set the correct permissions on the socket. Would prefer to have > > > >this patch in upstream first if commited. > > > > > > > >The pkg/MESSAGE is updated to notify of the daemon user changes and > > > >point to the very crucial pkg/README for setup. > > > > > > > >files/authlog.jsonnet has some new regexes to match that were taken > > > >from the reaction documentation. > > > > > > > >Added Lydia as maintainer since I have no objection. > > > Looks pretty good to me actually, could this get merged? The patch will > > > be in the next release but no ETA on when so I say we go for this for now > > > > i've left this mail unread (as "to reply someday") for too long, but the > > README bits about giving access to authlog bother me. changing group > > ownership or perms on authlog won't fly on the long term, as newsyslog > > will reset those at its next run, so in that case /etc/newsyslog.conf > > also needs tweaking. putting the _reaction user in wheel group is > > awkward too. > > looking more and after feedback from others, changing perms will trip > security(8) mails, so that's a no-go. you have the option to duplicate > auth.info in syslog.conf to another file, but meh. > > another option would be to have the default config run doas tail -f > /var/log/authlog, and adjust the doas.conf lines in README, but at that > point.. *shrug*. > > or reaction has always been meant to run as root, and we should live with > that ?
