<html>
<body>
<div style="font-family: Verdana, Arial, Helvetica, Sans-Serif;">
<table bgcolor="#f9f3c9" width="100%" cellpadding="8" style="border: 1px #c9c399 solid;">
<tr>
<td>
This is an automatically generated e-mail. To reply, visit:
<a href="https://reviewboard.asterisk.org/r/3062/">https://reviewboard.asterisk.org/r/3062/</a>
</td>
</tr>
</table>
<br />
<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
<p style="margin-top: 0;">On January 1st, 2014, 1:41 a.m. UTC, <b>Matt Jordan</b> wrote:</p>
<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
<table width="100%" border="0" bgcolor="white" style="border: 1px solid #C0C0C0; border-collapse: collapse; margin: 2px padding: 2px;">
<thead>
<tr>
<th colspan="4" bgcolor="#F0F0F0" style="border-bottom: 1px solid #C0C0C0; font-size: 9pt; padding: 4px 8px; text-align: left;">
<a href="https://reviewboard.asterisk.org/r/3062/diff/2/?file=49947#file49947line12" style="color: black; font-weight: bold; text-decoration: underline;">/trunk/contrib/asterisk.service</a>
<span style="font-weight: normal;">
(Diff revision 2)
</span>
</th>
</tr>
</thead>
<tbody>
<tr>
<th bgcolor="#b1ebb0" style="border-right: 1px solid #C0C0C0;" align="right"><font size="2"></font></th>
<td bgcolor="#c5ffc4" width="50%"><pre style="font-size: 8pt; line-height: 140%; margin: 0; "></pre></td>
<th bgcolor="#b1ebb0" style="border-left: 1px solid #C0C0C0; border-right: 1px solid #C0C0C0;" align="right"><font size="2">12</font></th>
<td bgcolor="#c5ffc4" width="50%"><pre style="font-size: 8pt; line-height: 140%; margin: 0; ">ExecStart=/usr/sbin/asterisk -f -U asterisk</pre></td>
</tr>
</tbody>
</table>
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Looking at how safe_asterisk spawns Asterisk, I'm not sure specifying an explicit run user is appropriate here. There's no guarantee that there's a user named "Asterisk" on the system.</pre>
</blockquote>
<p>On January 1st, 2014, 9:49 a.m. UTC, <b>Tzafrir Cohen</b> wrote:</p>
<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Two answers here:
1. I guess that the stock systemd answer would be: "run asterisk as the user asterisk. That way, the username and/or group name could be overiden in /etc/systemd/system/asterisk.service".
I remember we have some good reasons to let Asterisk drop privileges on its own. But let's try to reconsider them?
2. So, maybe we should have asterisk_wrapper (any better name?) that will
* Test for the requirements (perhaps as a subcommand for a Pre script?)
* Set up system-dependent setting
* Start asterisk a single time.
* Handle failures.
I also considered this previously because safe_asterisk makes it very simple to override the asterisk binary to a local live_ast copy by dropping a single file in /etc/asterisk/startup.d (with a single line that may, or may not, be remmed-out).</pre>
</blockquote>
<p>On January 1st, 2014, 10:23 a.m. UTC, <b>Tzafrir Cohen</b> wrote:</p>
<blockquote style="margin-left: 1em; border-left: 2px solid #d0d0d0; padding-left: 10px;">
<pre style="white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">I looked into running Asterisk as non-root. But I can't find a way to get systemd to generate /var/run/asterisk as a writable directory to the service. It can be done by a Pre script. But the Pre script has to be configured with the username. So I think that a single wrapper script is the best option.</pre>
</blockquote>
</blockquote>
<pre style="margin-left: 1em; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">As others pointed out, this can be handled by tmpfiles.
BTW: safe_asterisk still creates the AST_RUN_DIR, which is, by now, pointless.
So, what other things asterisk needs root for?
* Setting a high scheduling priority
* prctl(PR_SET_KEEPCAPS, 1</pre>
<br />
<p>- Tzafrir</p>
<br />
<p>On December 24th, 2013, 4:49 p.m. UTC, Tzafrir Cohen wrote:</p>
<table bgcolor="#fefadf" width="100%" cellspacing="0" cellpadding="8" style="background-image: url('https://reviewboard.asterisk.org/static/rb/images/review_request_box_top_bg.ab6f3b1072c9.png'); background-position: left top; background-repeat: repeat-x; border: 1px black solid;">
<tr>
<td>
<div>Review request for Asterisk Developers.</div>
<div>By Tzafrir Cohen.</div>
<p style="color: grey;"><i>Updated Dec. 24, 2013, 4:49 p.m.</i></p>
<div style="margin-top: 1.5em;">
<b style="color: #575012; font-size: 10pt;">Repository: </b>
Asterisk
</div>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Description </h1>
<table width="100%" bgcolor="#ffffff" cellspacing="0" cellpadding="10" style="border: 1px solid #b8b5a0">
<tr>
<td>
<pre style="margin: 0; padding: 0; white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap; word-wrap: break-word;">Installs a systemd service file for Asterisk.
Systeemd is the new "one daemon to rule them all" for Linux: http://www.freedesktop.org/wiki/Software/systemd/
On systems without systemd this should be just a harmless (though maybe annoying) text file.
This is aimed at replacing safe_asterisk with a more reliable main loop. It almost does that. Is still fails to handle failures, as it seems that systemd's ExecPostStop command does not get the exist status of the stopped command.</pre>
</td>
</tr>
</table>
<h1 style="color: #575012; font-size: 10pt; margin-top: 1.5em;">Diffs</b> </h1>
<ul style="margin-left: 3em; padding-left: 0;">
<li>/trunk/contrib/asterisk.service <span style="color: grey">(PRE-CREATION)</span></li>
<li>/trunk/Makefile <span style="color: grey">(404563)</span></li>
</ul>
<p><a href="https://reviewboard.asterisk.org/r/3062/diff/" style="margin-left: 3em;">View Diff</a></p>
</td>
</tr>
</table>
</div>
</body>
</html>