{"action":"created","issue":{"url":"https://api.github.com/repos/openbmc/openbmc/issues/3383","repository_url":"https://api.github.com/repos/openbmc/openbmc","labels_url":"https://api.github.com/repos/openbmc/openbmc/issues/3383/labels{/name}","comments_url":"https://api.github.com/repos/openbmc/openbmc/issues/3383/comments","events_url":"https://api.github.com/repos/openbmc/openbmc/issues/3383/events","html_url":"https://github.com/openbmc/openbmc/issues/3383","id":361900155,"node_id":"MDU6SXNzdWUzNjE5MDAxNTU=","number":3383,"title":"daemons should not run as root","user":{"login":"joseph-reynolds","id":31445374,"node_id":"MDQ6VXNlcjMxNDQ1Mzc0","avatar_url":"https://avatars3.githubusercontent.com/u/31445374?v=4","gravatar_id":"","url":"https://api.github.com/users/joseph-reynolds","html_url":"https://github.com/joseph-reynolds","followers_url":"https://api.github.com/users/joseph-reynolds/followers","following_url":"https://api.github.com/users/joseph-reynolds/following{/other_user}","gists_url":"https://api.github.com/users/joseph-reynolds/gists{/gist_id}","starred_url":"https://api.github.com/users/joseph-reynolds/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joseph-reynolds/subscriptions","organizations_url":"https://api.github.com/users/joseph-reynolds/orgs","repos_url":"https://api.github.com/users/joseph-reynolds/repos","events_url":"https://api.github.com/users/joseph-reynolds/events{/privacy}","received_events_url":"https://api.github.com/users/joseph-reynolds/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-19T19:46:15Z","updated_at":"2018-10-02T14:03:48Z","closed_at":null,"author_association":"NONE","body":"This is a meta-issue is to change existing daemons to run as a non-root user.\r\n\r\nThe security issue: \r\n - OpenBMC has many daemon processes running with high privilege levels, typically as the root user.\r\n - When a daemon running as root is compromised, the attacker will have root access to the BMC.  (See https://en.wikipedia.org/wiki/Privilege_escalation.)\r\n - The mitigation is to run the daemon as a non-root user who has the least amount of privilege it needs (see https://en.wikipedia.org/wiki/Principle_of_least_privilege).  Privilege is typically capabilities (http://man7.org/linux/man-pages/man7/capabilities.7.html) and file permissions.\r\n - Then when the daemon is compromised, it gives the attacker less power.\r\n\r\nhttps://unix.stackexchange.com/questions/206779/is-it-a-good-practice-to-run-a-daemon-under-a-non-root-user-account\r\n\r\nTODO: Create an issue (in the correct repo) for each OpenBMC daemon running as root.  Each daemon will need to determine what privileges it needs.  We'll probably have to create at least one additional user (which might be used for multiple daemons) and change systemd config files."},"comment":{"url":"https://api.github.com/repos/openbmc/openbmc/issues/comments/426285968","html_url":"https://github.com/openbmc/openbmc/issues/3383#issuecomment-426285968","issue_url":"https://api.github.com/repos/openbmc/openbmc/issues/3383","id":426285968,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNjI4NTk2OA==","user":{"login":"edtanous","id":599897,"node_id":"MDQ6VXNlcjU5OTg5Nw==","avatar_url":"https://avatars0.githubusercontent.com/u/599897?v=4","gravatar_id":"","url":"https://api.github.com/users/edtanous","html_url":"https://github.com/edtanous","followers_url":"https://api.github.com/users/edtanous/followers","following_url":"https://api.github.com/users/edtanous/following{/other_user}","gists_url":"https://api.github.com/users/edtanous/gists{/gist_id}","starred_url":"https://api.github.com/users/edtanous/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edtanous/subscriptions","organizations_url":"https://api.github.com/users/edtanous/orgs","repos_url":"https://api.github.com/users/edtanous/repos","events_url":"https://api.github.com/users/edtanous/events{/privacy}","received_events_url":"https://api.github.com/users/edtanous/received_events","type":"User","site_admin":false},"created_at":"2018-10-02T14:03:47Z","updated_at":"2018-10-02T14:03:47Z","author_association":"CONTRIBUTOR","body":"At a system level, we need to solve the dbus permissions issue for to close this issue.\r\n\r\nbmcweb at one point did run as its own user (and that user still exists on the system) but upon moving from boost-dbus to the sdbusplus interfaces, there was an issue with accessing resources on the system dbus interface when running as non-root.  We had someone debug it for close to 2 weeks before giving up and just running the webserver as root.\r\n\r\nThese permission issues would need to be resolved before any sdbusplus service could be moved to a non-root user."}}
{"actor":{"display_login":"edtanous"}}