[mythtv-users] does the backend need root privileges?

[Keith Pyle]

On 01/06/13 06:00, Richard Shaw wrote:
> On Sat, Jan 5, 2013 at 7:36 PM, Malte Gell<malte.gell at gmail.com>  wrote:
>> >using MythTV 0.26, does the backend needs to run as root user or can a
>> >normal user start the backend too?
> It doesn't*have*  to but it does make some things easier. As long as
> the user it runs as is part of the audio and video groups (or the
> equivalent on your distro) for access to some devices and the storage
> location doesn't require root privileges, you can run the BE as a
> non-root user.
>
> Richard
mythbackend doesn't need to run as root.  It just needs to have the 
permissions to write and read its files, and to access the video and 
audio devices.  It is generally a system administration "best practice" 
to run any service with the least level of privilege that it needs to do 
its tasks.  In this way, you minimize the potential for any problem with 
the service (bug, misconfiguration, exploit) to do damage to the rest of 
your system.  (If you're really of the paranoid system administration 
school, put the service in a Linux container too.)

It's fairly easy to create a "mythtv" user (e.g., the "useradd" command) 
with the appropriate audio and video groups, and run mythbackend as that 
user.  Here are the relevant lines from /etc/init.d/mythbackend on a 
Gentoo distribution (your distro likely has somewhat different syntax):

         ebegin "Starting MythTV Backend"
         start-stop-daemon --start --quiet --user mythtv \
                 --exec /usr/bin/mythbackend \
                 --make-pidfile --pidfile /var/run/mythbackend.pid \
                 --background -- --verbose ${MYTH_VERBOSE} \
                 --logfile /var/log/mythtv/mythbackend.log
         rc=$?
         eend $rc

Keith
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.mythtv.org/pipermail/mythtv-users/attachments/20130106/8532d662/attachment.html>