Figure out if it's possible to run chrooted or unpriviledged

[jfgrissom]

Saw this over at reddit and thought it was worth nailing down.

https://www.reddit.com/r/codius/comments/8t2h17/simple_script_to_install_codius/

[N3TC4T]

Thanks man , I havn't test it againts an non root user but I think at least users should have ability to run commands as root ( sudo) to the services and install required packages

also the current user should be replace with root in moneyd, codius services

https://github.com/xrp-community/codius-install/blob/master/codius-install.sh#L437

https://github.com/xrp-community/codius-install/blob/master/codius-install.sh#L481

[jfgrissom]

I'm thinking it makes sense to create a user for the service.

Also, I'm not dictating here. I'm just throwing out what I think could be useful. Anyone is free to shoot this full of holes.

I believe the same way nginx often runs as nginx or apache runs as apache. The services could run like this.

This is a bit verbose but to be very specific I'll lay it out like this:

hyperd should run as hyperd with a group called codius. nginx should run as nginx (or www) with a group called codius. codiusd should runs as codiusd with a group called codius. moneyd-xrp should run as moneyd with a group called codius.

All of these users should be unprivileged (no sudoer/root privs - maybe even chrooted with systemd-nspawn or something) anything that needs to interoperate between the services could use the group access (currently I think they only communicate through listening ports so I doubt this will be needed).

[sharafian]

We should definitely use whatever requires the least privileges, but it's worth noting that codiusd needs access to add network devices and I believe hyperd also needs root access for certain tasks. The safest thing is to have a machine completely dedicated to codius so that if someone breaks into the machine they wouldn't disrupt anything except the codius host

[jfgrissom]

@sharafian - I think the primary issue was related to the individual services all being run as root.

I am imagining it will just take some iterating and policy configurations to lock these down.

@N3TC4T - I'm willing to help out with this effort when I've gotten my own Codius project nailed down. (I think, in a few weeks I could contribute some time to this).