1

I am trying to run an application (code-server) as a sudo user. This application is basically allowing me to run Visual Studio Code online. I created the service file as below: (vsc.service)

[Unit]
Description=Running Visual Studio Code Online

[Service]
User=dev001
Group=dev001
WorkingDirectory=/home/dev001/projects
Type=simple
ExecStart=/usr/bin/sudo /usr/bin/vsc.sh

[Install]
WantedBy=multi-user.target

As you can see that the service file has the user and group information.

here is the script I want to run as service (/usr/bin/vsc.sh)

cd /home/dev001/projects
code-server -p 80 --allow-http --password somepassword

It runs fine but the problem is that the user who is running the process is still kept as root, but working as dev001. here is the screenshot of the terminal access via the running service:

vscode terminal window screenshot

Please help me if you have any solution to the problem.

Edit 01:

I have taken the nginx help to do a port forward (reverse proxy) to resolve the issue, until code-server gets matured and have the daemonised support for running directly on port 80 or 443. The one benefit I got with this approach is that I am able to install the letsencrypt ssl. so no my environment is all running as I needed to be. There are other issues thought, but they are not related to this thread.

4
  • 1
    Could it be the ExecStart=/usr/bin/sudo /usr/bin/vsc.sh line? Does it run without /usr/bin/sudo? It sorta looks like it's dropping permissions only to elevate privileges again. May 3, 2019 at 21:09
  • The process has to be executed as user (dev001) but with sudo so that it can open port 80. Without sudo a user can't open the port 80 on the system (at least thats what I understand, I don't know how apache or tomcat or ngnix does that :) ). May 4, 2019 at 0:40
  • I see your problem. Either you need to change the port, or you'll have to do a more complicated workaround (for example: liquidat.wordpress.com/2018/01/04/…). SOME services have a configuration to drop privileges after opening the privileged port; I'm assuming code-server has not such option. May 6, 2019 at 21:29
  • You can run your process on a different port, that can be opened by a non-root user, and start a port forwarder service (like tcppm: 3proxy.ru/doc/man8/tcppm.8.html ) as root, which will bin to port 80 and forward this port to whatever port your service is running on
    – raj
    Sep 7, 2020 at 20:16

1 Answer 1

0

How is your screen shot relevant? You're showing the user and directory of your shell. I could misunderstand, but I think some confusion lies here.

The SystemD service you have should start when you boot the machine, as the dev001 user. You can find this using systemctl or ps aux | grep vsc.sh or similar. The key here is not to look at your shell, but the owner of the actual process.

sudo systemctl enable vsc.service
sudo systemctl start vsc.service
sudo ps aux | grep vsc

You should see that your service is being run by the user set in your vsc.service file.

4
  • I believe the shell part of the the vscode UI. And if the service was running as the user, how could it open a shell as root? May 3, 2019 at 21:11
  • Why do you want to open a shell as root? I thought you wanted a process to run, as dev001, and controlled via systemctl.
    – earthmeLon
    May 4, 2019 at 0:03
  • @RyanJ.Yoder yes the shell is part of the vscode and it clearly shows that whomi is root but the pwd for the ~/project folder belongs to dev001 and @earthmeLon here is the response from ps aux ``` root@PGDevEnv001:~/projects# sudo ps aux | grep vsc root 2221 0.0 0.0 67984 4164 ? Ss May03 0:00 /usr/bin/sudo /usr/bin/vsc.sh root 2222 0.0 0.0 4628 772 ? S May03 0:00 sh /usr/bin/vsc.sh root 8072 0.0 0.0 14728 1004 pts/0 S+ 00:07 0:00 grep --color=auto vsc root@PGDevEnv001:~/projects# ``` showing process running as root May 4, 2019 at 0:07
  • also one more thing to point out there that the prompt is showing # in place of $ so it is currently running in system administrator mode not in normal user mode. May 5, 2019 at 0:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.