Bug 1227226 - traefik2: systemd service should likely run as non-root
Summary: traefik2: systemd service should likely run as non-root
Status: NEW
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Audits (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Alexandre Vicenzi
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-07-01 10:04 UTC by Matthias Gerstner
Modified: 2024-07-12 13:52 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Gerstner 2024-07-01 10:04:43 UTC 
The SUSE security monitors systemd service additions to openSUSE Tumbleweed,
and we noticed the following addition last week:

> RPM: traefik2-2.11.5-1.1.x86_64.rpm on x86_64
> Package: traefik2
> Service path: /usr/lib/systemd/system/traefik.service
> Runs as: root:root
> Extra capabilities: AmbientCapabilities=CAP_NET_BIND_SERVICE
> Exec lines:
>     ExecStart=/usr/bin/traefik --configFile=/etc/traefik/traefik.toml

It is confusing that this service runs as root but also requests
CAP_NET_BIND_SERVICE, which makes no sense, when it already runs as root.
Looking at the upstream contrib/ systemd service file it seems that the daemon
is supposed to run as non-root, which would be much preferred.

Please try to adjust the systemd service unit to let this daemon runs as a
dedicated user. Thanks!
Comment 1 Alexandre Vicenzi 2024-07-12 09:17:13 UTC 
This behavior is present in traefik and traefik2 packages. Do you want to create a new issue or fix both packages in this?
Comment 2 Matthias Gerstner 2024-07-12 13:35:28 UTC 
If both packages are affected equally by this, then please address both.

I am currently treating this as a hardening effort, so I wouldn't need an
extra bug for the second package, except you would like to have one.
Comment 3 Alexandre Vicenzi 2024-07-12 13:52:21 UTC 
(In reply to Matthias Gerstner from comment #2)
> If both packages are affected equally by this, then please address both.
> 
> I am currently treating this as a hardening effort, so I wouldn't need an
> extra bug for the second package, except you would like to have one.

Not needed, I can address both at the same time, there's little difference between systemd unit files.