3

Assume a script runs on boot as root. From this script I want to start tcpsvd -E 0 515 lpd. I want tcpsvd to run as an unprivileged user. But it requires root privileges to bind to the port 515. How can I achieve this?

Further I have to use busybox tcpsvd:

tcpsvd tcpsvd [-hEv] [-c N] [-C N[:MSG]] [-b N] [-u USER] [-l NAME] IP PORT PROG Create TCP socket, bind to IP:PORT and listen for incoming connection. Run PROG for each connection. IP IP to listen on. '0' = all PORT Port to listen on PROG [ARGS] Program to run -l NAME Local hostname (else looks up local hostname in DNS) -u USER[:GRP] Change to user/group after bind -c N Handle up to N connections simultaneously -b N Allow a backlog of approximately N TCP SYNs -C N[:MSG] Allow only up to N connections from the same IP New connections from this IP address are closed immediately. MSG is written to the peer before close -h Look up peer's hostname -E Do not set up environment variables -v Verbose
Improve this question
4
  • 4
    It says right there: "-u USER[:GRP] Change to user/group after bind". What more did you need? Commented Sep 26, 2013 at 19:31
  • Thats fine thank you. I hoped to find a way to do it in a more generic way with su,sudo,etc. Commented Sep 27, 2013 at 11:39
  • Now I am at the point where I get into trouble. $BUSY/busybox tcpsvd -u manuel:manuel -E 0 515 $BUSY/busybox lpd /var/spool zenity --error --text "$DATAFILE" returns nothing. $DATAFILE is set by lpd. lpd is run as manuel but the environment is root. How do I change this behaviour? Commented Sep 27, 2013 at 12:24
  • 1
    The shell expands $DATAFILE when you type that command, not when lpd executes zenity. You need to put the zenity command into a shell script, and have lpd call that script. Then $DATADIR will be expanded at the right time. Commented Sep 27, 2013 at 14:17

1 Answer 1

Reset to default
4

You need to have the program bind to the port while running as root, and then switch to your unprivileged user. tcpsvd offers the -u option for doing this:

 -u user[:group] drop permissions. Switch user ID to user’s UID, and group ID to user’s primary GID after creating and binding to the socket. If user is followed by a colon and a group name, the group ID is switched to the GID of group instead. All supplementary groups are removed.
Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.