Re: Getting a daemon off uid root

[Gergely Nagy <algernon@boszorka.mad.hu>]

> - open devices (in my case tty?, ttyUSB?)

You do not necessarily need root for that, provided that something
else set the permissions up. Otherwise, you might open it as root and
drop privileges.

> - open syslog (and/or logfile)

This certainly does not need root privileges. At least, logging to
syslog. If you want a logfile, you can include a directory in your
package owned by the unprivileged user (you probably need to add that
user in your preinst then) under /var/log, and log there.

> - write pidfile

Write it as root, chown it to the unprivileged user, drop privileges.

> In particular, I don't know how to write my pidfile under /var/run without being
> root.
> If there isn't any way, is there documentation/good example on how to shed the
> root privilege after starting? Is a simple setresuid/gid to
> nobody/nogroup enough?

I'd use setuid (and setgid too, just to be sure), since that is more
portable. <plug>Look at src/daemon.c::_daemon_drop_privs in the thy
sources</plug>