Unit: running unit with unprivileged user

[Izorkin]

I'm trying to run unit without root privileges.
Systemd config:

[Unit]
After=network.target
Description=Unit App Server

[Service]
Environment="LOCALE_ARCHIVE=/nix/store/rdzldh4fiisgjy2hfvs1bf48gprbqlkh-glibc-locales-2.27/lib/locale/locale-archive"
Environment="PATH=/nix/store/w5vxylzj1r3ib1icpgab8hbb4g344jvz-curl-7.64.0-bin/bin:/nix/store/fvv5pvb1j7hvq7p6xk6frh4xi5hfll5s-coreutils-8.30/bin:/nix/store/28bfwxb9wgvbmzqq036f6f02437raiam-findutils-4.6.0/bin:/nix/store/l3vy5ys8xjlj87mm121c9spqa8a91vyr-gnugrep-3.3/bin:/nix/store/vp1x224dd666w9di3y861hr47vih2rrh-gnused-4.7/bin:/nix/store/8sj7f49hq62bgn66qkhjdiq5k1knk7pi-systemd-239.20190219/bin:/nix/store/w5vxylzj1r3ib1icpgab8hbb4g344jvz-curl-7.64.0-bin/sbin:/nix/store/fvv5pvb1j7hvq7p6xk6frh4xi5hfll5s-coreutils-8.30/sbin:/nix/store/28bfwxb9wgvbmzqq036f6f02437raiam-findutils-4.6.0/sbin:/nix/store/l3vy5ys8xjlj87mm121c9spqa8a91vyr-gnugrep-3.3/sbin:/nix/store/vp1x224dd666w9di3y861hr47vih2rrh-gnused-4.7/sbin:/nix/store/8sj7f49hq62bgn66qkhjdiq5k1knk7pi-systemd-239.20190219/sbin"
Environment="TZDIR=/nix/store/ghng32mh8bfdaigdx3yl1szg5c6znlv2-tzdata-2018g/share/zoneinfo"

AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID
ExecStart=/nix/store/pj9r70xm5any81pm91j1lqas3ffa7jz9-unit-1.8.0/bin/unitd --control 'unix:/run/unit/control.unit.sock' --pid '/run/unit/unit.pid' \
                         --log '/var/log/unit/unit.log' --state '/var/spool/unit' --no-daemon \
                         --user unit --group unit

ExecStartPost=/nix/store/h6bhqx9w1yjivr2y97apz2ss1fphzzbm-unit-script-unit-post-start
ExecStartPre=/nix/store/35myg2bpq3sf8rgwcb0gp056r8z9lk4q-unit-script-unit-pre-start
Group=unit
User=unit

Unit config:

{
  "listeners": {
    "*:8300": {
      "application": "example-php-72"
    }
  },
  "applications": {
    "example-php-72": {
      "type": "php 7.2",
      "processes": 4,
      "user": "wwwrun",
      "group": "wwwrun",
      "root": "/var/www/public_html",
      "index": "index.php",
      "options": {
        "admin": {
          "max_execution_time": "30",
          "max_input_time": "30",
          "display_errors": "on",
          "display_startup_errors": "on",
        }
      }
    }
  }
}

As result, unit service, as well as child process "example-php-72" runs as user "unit".
How can I run child process as user "wwwrun"? The necessary rights are granted with capabilities.

[VBart]

Currently Unit daemon explicitly checks the root privileges and doesn't know about capabilities.
As a temporary workaround you can remove this check:
```diff -r 7435036ed31e src/nxt_process.c
--- a/src/nxt_process.c Wed Mar 06 15:26:45 2019 +0300
+++ b/src/nxt_process.c Thu Mar 07 17:06:53 2019 +0300
@@ -136,7 +136,7 @@ nxt_process_start(nxt_task_t *task, nxt_

 nxt_random_init(&thread->random);

• if (init->user_cred != NULL && getuid() == 0) {

• if (init->user_cred != NULL) {
  /* Super-user. */

   ret = nxt_user_cred_set(task, init->user_cred);
  

  ```

[Izorkin]

With this patch error apply configuration:

2019/03/07 21:46:43.857 [debug] 4149#4149 pthread_mutex_lock(7366EBC54078) enter
2019/03/07 21:46:43.857 [debug] 4149#4149 process 4149 added
2019/03/07 21:46:43.857 [debug] 4149#4149 pthread_mutex_unlock(7366EBC54078) exit
2019/03/07 21:46:43.857 [info] 4149#4149 "example-php-72" application started
2019/03/07 21:46:43.857 [debug] 4149#4149 setproctitle: "unit: "example-php-72" application"
2019/03/07 21:46:43.857 [debug] 4149#4149 user cred set: "wwwrun" uid:54 base gid:54
2019/03/07 21:46:43.857 [alert] 4149#4149 setgroups(-339475256) failed (22: Invalid argument)
2019/03/07 21:46:43.858 [debug] 4141#4141 epoll_wait(3): 1
2019/03/07 21:46:43.858 [debug] 4141#4141 epoll: fd:4 ev:0001 d:7366EBC376A8 rd:0 wr:0
2019/03/07 21:46:43.858 [debug] 4141#4141 timer expire minimum: 176622316:90222318
2019/03/07 21:46:43.858 [debug] 4141#4141 work queue: fast
2019/03/07 21:46:43.858 [debug] 4141#4141 signalfd handler
2019/03/07 21:46:43.858 [debug] 4141#4141 read signalfd(4): 128
2019/03/07 21:46:43.858 [debug] 4141#4141 signalfd(4) signo:17
2019/03/07 21:46:43.858 [debug] 4141#4141 sigchld handler signo:17 (SIGCHLD)
2019/03/07 21:46:43.858 [debug] 4141#4141 waitpid(): 4149
2019/03/07 21:46:43.858 [notice] 4141#4141 process 4149 exited with code 1
2019/03/07 21:46:43.858 [debug] 4141#4141 pthread_mutex_lock(7366EBC54078) enter
2019/03/07 21:46:43.858 [debug] 4141#4141 pthread_mutex_unlock(7366EBC54078) exit
2019/03/07 21:46:43.858 [debug] 4141#4141 port 7366EBC781C0 4149:0 close, type 4
2019/03/07 21:46:43.858 [debug] 4141#4141 close(11)
2019/03/07 21:46:43.858 [debug] 4141#4141 port 7366EBC781C0 4149:0 release, type 4
2019/03/07 21:46:43.858 [debug] 4141#4141 pthread_mutex_lock(7366EBC54078) enter
2019/03/07 21:46:43.858 [debug] 4141#4141 process 4149 removed
2019/03/07 21:46:43.858 [debug] 4141#4141 pthread_mutex_unlock(7366EBC54078) exit

[mar0x]

Please apply also this patch:

diff --git a/src/nxt_process.c b/src/nxt_process.c
--- a/src/nxt_process.c
+++ b/src/nxt_process.c
@@ -434,9 +434,9 @@ nxt_user_cred_get(nxt_task_t *task, nxt_
         uc->base_gid = grp->gr_gid;
     }

-    if (getuid() == 0) {
+//    if (getuid() == 0) {
         return nxt_user_groups_get(task, uc);
-    }
+//    }

     return NXT_OK;
 }

[Izorkin]

Thanks, worked! :)