Hi -- I have been a long-term peruser of this forum, even though I haven't really posted anything.
I have been running MM2 for a few years now on my RPi3B+ (and more recently also on RPI4B, and there are 2 issues with the installation that I have been trying to clean up. I actually think that @abcd567's (further excellent) install scripts don't address this, so maybe this could be a potential improvement.
It started with me noticing a file in my root called /distances.json, owned by root:root. After some sleuthing, I found out that this is a file updated hourly by MM2. Writing to my root directory, and actually having "untrusted" non-open-source programs run as root, are both security no-no's for me.
Here's what I did to improve this:
1. Updates to /usr/share/mm2/mm2.sh
These updates make sure that mm2 is executed from /run/modesmixer2, so any files it writes to its home directory are dropped there. The red code is what you should insert:
#!/bin/sh
CONFIG=""
while read -r line; do CONFIG="${CONFIG} $line"; done < /usr/share/mm2/mm2.conf
if [ ! -d "/run/modesmixer2" ]
then
mkdir /run/modesmixer2
fi
cd /run/modesmixer2
/usr/share/mm2/modesmixer2 ${CONFIG}
2. Create a user and group for mm2 to run in
This actually has 2 parts. During the installation (in @abcd567's installation script), we should also do the following:
# create a user 'mm2:mm2' for mm2 to run as:
sudo useradd -U -r -s /bin/false mm2
Then, also add this to the [Services] section of the systemd service file (/lib/systemd/system/mm2.service). Again, the actual additions are in red:
[Services]
User=mm2
Group=mm2
That's all that needs changed when you do your initial installation
Now, if you want to make this change to your existing setup (after you already installed MM2), you can do this:
a. Edit the files manually
Make the changes shown above using sudo nano /usr/share/mm2/mm2.sh and /lib/systemd/system/mm2.service. Exit the editor with ctrl-x y <enter>.
b. Type this on the command line:
sudo useradd -U -r -s /bin/false mm2
sudo chown -R mm2:mm2 /run/modesmixer2
sudo systemctl daemon-reload
sudo systemctl restart mm2
Now, your MM2 instance should have restarted and is running as user mm2 and writes to /run/modesmixer2/distance.json rather than to the root directory. This is a lot cleaner and more in line with linux security recommendations.
Last -- a quick note -- relevant ONLY if you are running the mm2 website on a reserved port, like --web 8787.
By default, "regular" users aren't allowed to bind to some of the lower TCP port numbers. So if you changed your mm2.conf file to bind the web page to (for example) port 80 rather than the default port 8787, you will see an error. You can fix this by creating an exception for mm2 by giving this command on the command line:
sudo setcap CAP_NET_BIND_SERVICE=+eip /usr/share/mm2/modesmixer2.
Total Members: 5894
.bmp)
.bmp)
.bmp)
.bmp)
.bmp)
Topic: ModeSDeco2 and ModeSMixer2 - console programs for RTLSDR and transcoding (Read 362642 times)