Is it a good practice to run a daemon under a non-root user account

access-controldaemonSecurity

I've developed an application that uses NTP to change the network time, to sync two of my computers.
It runs as root, since only the latter is allowed to change the time and date on Linux(I guess).

Now, I want to run it as a user. But, I need to access the time.

  • Is it a good practice to run a daemon under a non-root user account?
  • Shall I give my application a capability such as CAP_SYS_TIME?
  • Does it not introduce a security vulnerability?
  • Is there a better way?

Best Answer

Is it a good practice to run a daemon under a non-root user account?

Yes, and this is common. For instance, Apache start as root and then forks new process as www-data (by default).
As said before, if your program is hacked (ex: code injection), the attacker will not gain a root access, but will be limited to the privileges you gave to this specific user.

Shall I give a "Capability" such as "CAP_SYS_TIME"?

It is a good idea since you avoid using setuid, and limit permissions to this very specific capability.

Shall I use another way to do so that would be considered "Good Practice"?

You can increase security, for instance:

  • Run the service as unprivileged user, with no shell.
  • Use chroot to lock the user in it's home directory.
Related Question