starred/AdGuardHome

Fork 0

mirror of https://github.com/AdguardTeam/AdGuardHome.git synced 2026-03-04 00:01:12 -05:00

Check what are our options for woking without root on Linux #1350

New issue

Closed

opened 2026-03-04 01:14:34 -05:00 by deekerman · 2 comments

deekerman commented

2026-03-04 01:14:34 -05:00

Owner

Originally created by @ameshkov on GitHub (Mar 3, 2020).

Originally assigned to: @szolin on GitHub.

Maybe, we can make it this way (we should test it):

Make Linux user/group configurable
Run with root, run set CAP_NET_BIND_SERVICE for our binary
Downgrade to the specified group

If CAP_NET_BIND_SERVICE is persisted, we'll need to extend this task and explain what additional console actions we'll add.

This comment can be useful:
https://github.com/AdguardTeam/AdGuardHome/issues/1193#issuecomment-576862627

Originally created by @ameshkov on GitHub (Mar 3, 2020). Originally assigned to: @szolin on GitHub. Maybe, we can make it this way (we should test it): 1. Make Linux user/group configurable 2. Run with root, run set CAP_NET_BIND_SERVICE for our binary 3. Downgrade to the specified group If CAP_NET_BIND_SERVICE is persisted, we'll need to extend this task and explain what additional console actions we'll add. This comment can be useful: https://github.com/AdguardTeam/AdGuardHome/issues/1193#issuecomment-576862627

deekerman

2026-03-04 01:14:34 -05:00

closed this issue
added the
enhancement

question

P3: Medium
labels

deekerman commented

2026-03-04 01:14:39 -05:00

Author

Owner

@szolin commented on GitHub (Mar 3, 2020):

Unfortunately, there's no way we can maintain CAP_NET_BIND_SERVICE flag set on a binary file after it's replaced. We also can't replace the files owned by root user after we do setuid().
So auto-upgrade isn't possible.

After we do setuid(), we won't be able to restart DNS module or enable DOH module at runtime, unless we have CAP_NET_BIND_SERVICE flag set by root user.

In general, what is possible:

root user sets CAP_NET_BIND_SERVICE on our binary file.
runs AGH (under root) with user=aghome/group=aghome configuration settings
AGH calls setuid() and now it no longer runs under root, but it still can restart DNS module because of CAP_NET_BIND_SERVICE.
Auto-upgrade won't work.

Pros:

AGH runs automatically under a regular user

Cons:

Auto-upgrade doesn't work
Requires to manually set CAP_NET_BIND_SERVICE after each manual upgrade

@szolin commented on GitHub (Mar 3, 2020): Unfortunately, there's no way we can maintain CAP_NET_BIND_SERVICE flag set on a binary file after it's replaced. We also can't replace the files owned by root user after we do setuid(). So auto-upgrade isn't possible. After we do setuid(), we won't be able to restart DNS module or enable DOH module at runtime, unless we have CAP_NET_BIND_SERVICE flag set by root user. In general, what is possible: 1. root user sets CAP_NET_BIND_SERVICE on our binary file. 2. runs AGH (under root) with `user=aghome/group=aghome` configuration settings 3. AGH calls setuid() and now it no longer runs under root, but it still can restart DNS module because of CAP_NET_BIND_SERVICE. 4. Auto-upgrade won't work. Pros: * AGH runs automatically under a regular user Cons: * Auto-upgrade doesn't work * Requires to manually set CAP_NET_BIND_SERVICE after each manual upgrade

deekerman commented

2026-03-04 01:14:39 -05:00

Author

Owner

@ameshkov commented on GitHub (Mar 6, 2020):

Well, losing auto-upgrade is really painful.

Let's proceed with a simpler approach:

Fix #1193
Add more information to the documentation about how to run AGH without root, and how to upgrade it manually in this case

@ameshkov commented on GitHub (Mar 6, 2020): Well, losing auto-upgrade is really painful. Let's proceed with a simpler approach: 1. Fix #1193 2. Add more information to the documentation about how to run AGH without root, and how to upgrade it manually in this case

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/AdGuardHome#1350

No description provided.

Rows
Columns