On Mon, Jul 15, 2019 at 12:01:59AM +0200, Stefan Sperling wrote: > Is there any reason to start git-daemon through rc.d(8) in --inetd mode? No; I was stupidly short-sighted when looking through git-daemon(1) with regard to its options and `--user' in particular.
> I don't understand which difference you mean. > Could you please try to explain your point better? The daemon itself won't reset the environment, so starting it as root with `-u _gitdaemon' will preserve stuff like HOME whereas setting `$daemon_user' will cause it to be started with a properly set environment. > Are you referring to the environment being different when started > as a non-root user? I would trust rc.d(8) to do the right thing > with the environment. Yes; having said the above, I do agree here. Just wanted to point out that these two approaches are not the same. > Break in what way? Thought of the inetd thing, please disregard. > Please consider that any setup that runs this thing as root is a hazard. > Can you name any potential consequences which the proposed change might > introduce which are actually worse than running git-daemon as root? Running the daemon on privileged ports as only root may do so, which would work with `--user _gitdaemon' but not `daemon_user=_gitdaemon', but that not a bright idea anyway. Also, git-daemon(1) has `--group' as well: dropping to a group other than the user's primary one will only work then started as root. However, I doubt that people are running such setups. > Even if there were people how wanted to run git-daemon as root on purpose > I wouldn't see any reason for us to support them in doing so. Providing a safe default is good and since my initial doubts were based on my own stupidity alone (--inetd in rc.d does not make sense), OK kn.
