Setup User Permissions

This page describes how to setup the appropriate permissions so that it allows Gatekeeper to turn to a constrained user after the boot. Specifically, we run Gatekeeper as root and change it to a user specified in Lua configuration.

This is important due to two main reasons: (1) depending on which user we are using to run Gatekeeper/Grantor, we may need to change owner and access mode of the log file just created; (2) a limited user after the boot scopes how much bad stuff can be done if Gatekeeper/Grantor servers can ever be remotely compromised.

Table of Contents Lessons we learned Configuration User Log files access mode Socket file access mode

Lessons we learned

According to the discussion on Running DPDK as non-root in DPDK mailing list, we know that DPDK only needs the physical address to set up a memory map. So after proper mapping, DPDK is just using virtual addresses.

Configuration

User

One can specify the user that will run Gatekeeper after it boots in lua/net.lua by changing the user variable. If this parameter is left undefined (i.e. nil), Gatekeeper will run as the user it is called, which is typically the root user.

Log files access mode

One can specify the access mode that Gatekeeper should set on log files after it boots via command line parameter: --log-file-mode <val>. The default mode is S_IRUSR | S_IWUSR, i.e., read and write by owner.

Socket file access mode

The permissions of the UNIX socket file created by the Dynamic Configuration block can be specified by the variable mode in lua/dyn_cfg.lua.