[GH-ISSUE #3417] [Feature Request] Please allow the daemon to setuid to a particular user

gitea-mirror commented

2026-05-05 13:45:37 -06:00

Owner

Copy link

Originally created by @yurivict on GitHub (Apr 19, 2023).
Original GitHub issue: https://github.com/fatedier/frp/issues/3417

Describe the feature request

The daemon needs to read certificates as root, but then it is desirable to setuid to some unprivileged user.

Describe alternatives you've considered

No response

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @yurivict on GitHub (Apr 19, 2023). Original GitHub issue: https://github.com/fatedier/frp/issues/3417 ### Describe the feature request The daemon needs to read certificates as root, but then it is desirable to setuid to some unprivileged user. ### Describe alternatives you've considered _No response_ ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [ ] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror

2026-05-05 13:45:37 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 13:45:40 -06:00

Author

Owner

Copy link

@galdor commented on GitHub (Apr 19, 2023):

Being able to drop privileges to a specific user and group would be really nice; this way frp can read files such as TLS key files as root then drop to a non-privileged user for security.

You can easily do that by:

Fetching user and group info with user.Lookup and user.LookupGroup.
Calling syscall.Setgid and syscall.Setuid (in this order).

@galdor commented on GitHub (Apr 19, 2023): Being able to drop privileges to a specific user and group would be really nice; this way frp can read files such as TLS key files as root then drop to a non-privileged user for security. You can easily do that by: - Fetching user and group info with `user.Lookup` and `user.LookupGroup`. - Calling `syscall.Setgid` and `syscall.Setuid` (in this order).

gitea-mirror commented

2026-05-05 13:45:41 -06:00

Author

Owner

Copy link

@fatedier commented on GitHub (Apr 20, 2023):

I am not inclined to introduce such complexity, as it is not a universal solution.

@fatedier commented on GitHub (Apr 20, 2023): I am not inclined to introduce such complexity, as it is not a universal solution.

gitea-mirror commented

2026-05-05 13:45:41 -06:00

Author

Owner

Copy link

@yurivict commented on GitHub (Apr 20, 2023):

Why is it not a universal solution?

A lot of network servers use such strategy to improve security.

@yurivict commented on GitHub (Apr 20, 2023): Why is it not a universal solution? A lot of network servers use such strategy to improve security.

gitea-mirror commented

2026-05-05 13:45:42 -06:00

Author

Owner

Copy link

@galdor commented on GitHub (Apr 20, 2023):

This is standard procedure for many security-aware daemons. And it is not that complex, you can do it in a couple lines of code!

@galdor commented on GitHub (Apr 20, 2023): This is standard procedure for many security-aware daemons. And it is not that complex, you can do it in a couple lines of code!

gitea-mirror commented

2026-05-05 13:45:43 -06:00

Author

Owner

Copy link

@fatedier commented on GitHub (Apr 20, 2023):

Doing it this way is very inelegant. A better approach would be a unified solution that is independent of the application.

If we need to support certificate renewal in the future, do we need to switch users regularly?

@fatedier commented on GitHub (Apr 20, 2023): Doing it this way is very inelegant. A better approach would be a unified solution that is independent of the application. If we need to support certificate renewal in the future, do we need to switch users regularly?

gitea-mirror commented

2026-05-05 13:45:43 -06:00

Author

Owner

Copy link

@galdor commented on GitHub (Apr 20, 2023):

If you want to support dynamic certificate renewal, you are in trouble. What NGINX does is to maintain both a master process running as root and one or more worker processes running as a non-privileged user. This would be a large and complex change though.

But Frp does not support certificate renewal, and restarting the daemon every couple months on certificate rotation is a non issue.

I understand if you believe this feature could be a problem in the future.

If anyone reading this issue needs to run Frp as a non-root user with TLS, I've wrote an article where I explain how to use NGINX as TLS interface to Frp.

@galdor commented on GitHub (Apr 20, 2023): If you want to support dynamic certificate renewal, you are in trouble. What NGINX does is to maintain both a master process running as root and one or more worker processes running as a non-privileged user. This would be a large and complex change though. But Frp does not support certificate renewal, and restarting the daemon every couple months on certificate rotation is a non issue. I understand if you believe this feature could be a problem in the future. If anyone reading this issue needs to run Frp as a non-root user with TLS, I've wrote an [article](https://www.n16f.net/blog/replacing-ngrok-with-frp/) where I explain how to use NGINX as TLS interface to Frp.

gitea-mirror commented

2026-05-05 13:45:44 -06:00

Author

Owner

Copy link

@github-actions[bot] commented on GitHub (May 21, 2023):

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (May 21, 2023): Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

No Branch/Tag specified