Linux: Do we really need to run as root?

[BlackIkeEagle]

I was wondering if there is something in snclient that really needs root.

Context: before we started trying out snclient we were on other nrpe agents and we never run those as root. There is an additional issue with configuration for certain checks where we need to maintain a sudoers file for some things.

Our testing with snclient is also running as non-root so I was wondering are there internal checks in snclient (which I don't think we have tested already) which would really need root and could not be run as a regular user?

[sni]

most of the things should still work. The automatic updates probably won't work, but they are disabled by default anyway.

[BlackIkeEagle]

Run the agent as an unprivileged user

[sni]

thinking about it, this seems definitely like a good idea. The nobody user should be available on most systems.
You probably on need to change the systemd service?

More problematic is the transition to the new packages when then previous version run as root.
This needs some proper testing.

[BlackIkeEagle]

Yeah sorry for not continuing with this, currently I have some local changes to make use of a system user snclient for rpm and deb, but did not come to looking into the alpine stuff

[sni]

no worries, it's holiday season anyway 🎄
Thanks for looking into this.

[BlackIkeEagle]

Ok I think the MR is good for further discussion now. Also if this is something you would decide to not include it, which is just fine as well.

[BlackIkeEagle]

MR for systemd based packages, rpm and deb: #310

Marked it as draft since it only covers rpm and deb so it is still incomplete