Drop privileges after start

[killcity]

Will Fabio eventually get support to use setuid (to change to a non-root user once it's up and running)? I'd rather not have to run another proxy in front of it to alleviate security concerns if at all possible. Is the current model putting that burden on something other than Fabio?

Cheers

[magiconair]

Good point. I have to think about that.

[magiconair]

If I look at golang/go#1435 then there might be a way as long as I don't need to chroot. Open socket, re-exec and pass FD to child process might work. This will become interesting for dynamic listeners :)

[magiconair]

@killcity consider this a first attempt of tackling this. The code is based on the idea from @bgilmore in https://play.golang.org/p/dXBizm4xl3. The only thing I've added is the forwarding of stdout and stderr to make logging work.

I find the code still quite ugly and the whole listener setup could use a makeover but it should work. Would be great if you could test it.

[magiconair]

I've tested this only on OSX so far with sudo ./fabio -user nobody which spawns the root process which then sets up the listeners and passes them on to the child process. The child process will then use the FDs to create the actual proxies. The root parent has a root: prefix in the logs and the child logs the user it runs as. As said in the comment the command line arg will most likely change.

[killcity]

You are too quick :) I will give this a go in the morning (here in the US northeast). Thank so much for working this in. Super awesome!

[magiconair]

Some tests are failing. I'll fix that tomorrow.

[killcity]

Wasn't sure if this was one of the failing tests? TBH, I haven't compiled much in Go.

--> linux/amd64 error: exit status 2
Stderr: # _/root/gopath/fabio-drop-privs
./main.go:50: cfg.Username undefined (type *config.Config has no field or method Username)
./main.go:100: cfg.Username undefined (type *config.Config has no field or method Username)
./main.go:102: cfg.Username undefined (type *config.Config has no field or method Username)
./main.go:145: cfg.Username undefined (type *config.Config has no field or method Username)
./main.go:147: cfg.Username undefined (type *config.Config has no field or method Username)

...

[magiconair]

Yes. I've rebased the code and fixed the failing test. One effect is that the cmd line parameter is now -proxy.user instead of just -user since that picked up the $USER environment variable. Code is still ugly and needs work. Name of cmd like arg will most likely still change. Handle with care :)

[killcity]

Thanks. Going to beat her up a bit! :)

fabio 5850 0.8 0.0 583664 20184 ? Ssl 11:44 0:00 ./fabio-1.3.5-branch_195 -cfg /etc/fabio/fabio.properties

[killcity]

Update: No issues. Been running with this since Dec 1.

[magiconair]

@killcity awesome. I'll spend some time on incorporating this into the master branch then.