Drop privileges if started as root

[glaslos]

If Glutton is started as root, we should drop privileges to the nobody user.

[rombiee]

Hi Lukas, I wrote this small snippet to drop the privileges -

    uid := syscall.Getuid()
	if uid == 0 {
		// process is running as root
		logger.Info("[glutton ] The server is running as root. Dropping privilages to nobody...")
		// drop the group privilages to nobody user
		if err := syscall.Setgid(65534); err != nil {
			logger.Fatal("Could not set group privilages. ", err)
		} else {
			logger.Info("[glutton ] Group privilages dropped.")
		}
		// drop the user privilages
		if err := syscall.Setuid(65534); err != nil {
			logger.Fatal("Could not set user privilages. ", err)
		} else {
			logger.Info("[glutton ] User privilages dropped.")
		}
	}

But unfortunately, the implementation of Getuid is not at all reliable for a multithreaded code. I compiled the code and tested it in my environment with it always failing with operation not supported.

Refs -
http://stackoverflow.com/questions/41248866/golang-dropping-privileges-v1-7
There is a ticket in the golang codebase too -
golang/go#1435

[glaslos]

Well, tell me, why do we have to run Glutton as root?

[rombiee]

@glaslos I don't know if I'm right or not but what I thought was we don't have to run glutton server as root. I'm sorry if I'm wrong about it.

[glaslos]

Try to figure out why we need to run as root...

[rombiee]

I need root privileges to bind to port numbers under 1024.

[glaslos]

Where do we need root privileges?

[rombiee]

When we are initializing the ssh proxy, specifically, when we are trying to bind the docker proxy to the ssh port. And that means I cannot drop the privileges in the beginning. I'll have to drop it after binding the port. Also that log.Fatal call was catastrophic in that case. Am I right?

[glaslos]

Forget about docker. Think about how we get the packages in the first place.

[glaslos]

@HashCode55 are you still looking into this?

[t3chn0m4g3]

Have you figured how to run w/o root privileges?

Even when manually adding capabilities to server via setcap I am not able to run server w/o root privileges.

[glaslos]

This should be possible once the listeners for traffic are setup in glutton.Start()

[namay26]

I need root privileges to simulate a machine and lure attackers, as most attack attempts will interact with port numbers < 1024. Additionally, root privileges are required to bind to these ports and capture network packets.
Once the IP tables are set up and Glutton has bound to the required ports, we should drop privileges to the 'nobody' user. All subsequent threads will inherit these dropped privileges. After that, the listeners can be started with the reduced privileges.
Is this the correct approach? @glaslos

Since golang/go#1435 has been closed, setuid and getuid can now be relied upon.

[namay26]

I have created a PR #180 for the same ^

[glaslos]

We explored opportunities but since we need privileges to drop the iptables rules on shutdown, there is no solution that fully drops privileges from the process (or it's forks). We will close this issue for now as won't fix.