Support for running daemons under `sudo` about modd HOT 2 OPEN

Hi Timo. Thanks for the careful exposition of this problem. I must say, my knee-jerk reaction is "don't do that" - instead you could use capabilities on Linux to allow binding to a privileged port, or have a persistent privileged program that binds to the port and proxies traffic to a non-privileged program that is managed by modd, or even use iptables/pf to forward a port to a local unprivileged port. I'll assume that you've thought of all of these possibilities, and for whatever reason, they don't work for you.

As your proposal hints, I feel modd should remain agnostic about privilege and instead to let the user specify a custom restart command. I'd accept a patch that implements this, as long as we can get the syntax right and behaviour right. I'd call the restart command restart, since it might presumably do something entirely unrelated to signals to restart a daemon. We could then say that if a restart command is defined in a block, it is used to restart all daemons, unless they have an explicit +signal modifier. It's an error to define more than one restart command per block, but I think that's a manageable limitation.

from modd.

@cortesi Thanks for the reply! I'm working on an eBPF program, and my initial attempts at getting my tool to run with a minimal capability set were unsuccessful, so I just switched to running with sudo to get up and running. Your response made me look into it again, and I've finally figured out the problem. (https://stackoverflow.com/questions/40837181/how-to-raise-ulimit-hard-limit-for-real-time-priority-programmatically-with-setu) My LUKS-encrypted homedir mount has nosuid set, turns out that flag prohibits processes assuming capabilities set using file system attributes as well.

Still, I think a custom restart handler would be nice to have, your proposal sounds on point! restart sounds good, including the limitations you mentioned. I guess the user can always define multiple blocks with a similar watch pattern if they need multiple daemons with custom restart handlers.

from modd.