API daemon should run under non root user

[mkudlej]

I think that Tendrl API daemon should run under non root user because API communicates only with clients and ETCD via HTTP API.

[brainfunked]

@TimothyAsir here's what needs to be done in the spec file:

%global name tendrl-api
%global app_group %{name}
%global app_user %{name}
%global install_dir %{_datadir}/%{name}
%global config_dir %{_sysconfdir}/tendrl
%global config_file %{config_dir}/etcd.yml

%pre
getent group %{app_group} > /dev/null || \
  groupadd -r %{app_group}
getent passwd %{app_user} > /dev/null || \
  useradd -r -d %{install_dir} -M -g %{app_group} \
    -s /sbin/nologin %{app_user}

%files
%config %attr(0640, root, %{app_group}) %{config_file}

You'll also need to update the systemd service file to start the process as the tendrl-api user and group.

No other changes should be required anywhere else.

[anivargi]

@TimothyAsir what is the updated on this?

[r0h4n]

@TimothyAsirJeyasing Are you done with this issue?

[TimothyAsirJeyasing]

@r0h4n Sure, The patch already exists at https://github.com/Tendrl/api/pull/188. I will send to master branch