{"action":"closed","issue":{"url":"https://api.github.com/repos/gluster/glusterd2/issues/134","repository_url":"https://api.github.com/repos/gluster/glusterd2","labels_url":"https://api.github.com/repos/gluster/glusterd2/issues/134/labels{/name}","comments_url":"https://api.github.com/repos/gluster/glusterd2/issues/134/comments","events_url":"https://api.github.com/repos/gluster/glusterd2/issues/134/events","html_url":"https://github.com/gluster/glusterd2/issues/134","id":178607369,"node_id":"MDU6SXNzdWUxNzg2MDczNjk=","number":134,"title":"Non-root GD2?","user":{"login":"kshlm","id":362086,"node_id":"MDQ6VXNlcjM2MjA4Ng==","avatar_url":"https://avatars2.githubusercontent.com/u/362086?v=4","gravatar_id":"","url":"https://api.github.com/users/kshlm","html_url":"https://github.com/kshlm","followers_url":"https://api.github.com/users/kshlm/followers","following_url":"https://api.github.com/users/kshlm/following{/other_user}","gists_url":"https://api.github.com/users/kshlm/gists{/gist_id}","starred_url":"https://api.github.com/users/kshlm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kshlm/subscriptions","organizations_url":"https://api.github.com/users/kshlm/orgs","repos_url":"https://api.github.com/users/kshlm/repos","events_url":"https://api.github.com/users/kshlm/events{/privacy}","received_events_url":"https://api.github.com/users/kshlm/received_events","type":"User","site_admin":false},"labels":[{"id":763212690,"node_id":"MDU6TGFiZWw3NjMyMTI2OTA=","url":"https://api.github.com/repos/gluster/glusterd2/labels/priority:%20low","name":"priority: low","color":"d5fca1","default":false},{"id":131833779,"node_id":"MDU6TGFiZWwxMzE4MzM3Nzk=","url":"https://api.github.com/repos/gluster/glusterd2/labels/question","name":"question","color":"cc317c","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-09-22T13:17:38Z","updated_at":"2018-11-28T05:38:50Z","closed_at":"2018-11-28T05:38:50Z","author_association":"MEMBER","body":"And even non-root GlusterFS as whole.\nI'm wondering if we can do this.\n\nRight now, since we arent' starting any daemons yet, I run GD2 as a normal user, with CAP_SYS_ADMIN privileges. But once GD2 starts to start bricks, it will need to run as root.\n\nIf GD2 were a standalone app, it could continue to run happily with just CAP_SYS_ADMIN.\n\nBut bricks need to run as root right now. So i'm wondering if we could use user namespaces, to make brick process believe they are root and work around this.\n\nThis would close of a huge attack area against GD2 and GlusterFS.\n\nThe drawback right now is that both CAP_SYS_ADMIN and user namespaces are a  Linux only concept.\n"}}
{"actor":{"display_login":"aravindavk"}}