How to avoid socket activation for root?

darwish.07@xxxxxxxxx (Ahmed S. Darwish) · Sat, 28 Jan 2017 16:24:52 +0200

On Sat, Jan 28, 2017 at 04:00:31PM +0200, Ahmed S. Darwish wrote:
> Hi :-)
> 
> On Sat, Jan 28, 2017 at 01:58:32PM +0200, Tanu Kaskinen wrote:
> > Hi all,
> > 
> > In the "PA 10 : paplay can't connect !" thread I noticed worrying
> > netstat output:
> > 
> > [video at sixcore ~]$ netstat -l -x -p | grep pulse
> > (Not all processes could be identified, non-owned process info
> > Â  will not be shown, you would have to be root to see it all.)
> > unixÂ  2Â Â Â Â Â  [ ACC ]Â Â Â Â  STREAMÂ Â Â Â  LISTENINGÂ Â Â Â  51237Â    7388/pulseaudioÂ Â Â Â Â  /tmp/.esd-501/socket
> > unixÂ  2Â Â Â Â Â  [ ACC ]Â Â Â Â  STREAMÂ Â Â Â  LISTENINGÂ Â Â Â  26773Â Â Â  -Â            Â Â Â Â Â Â Â  /run/user/0/pulse/native
> > unixÂ  2Â Â Â Â Â  [ ACC ]Â Â Â Â  STREAMÂ Â Â Â  LISTENINGÂ Â Â Â  40938Â Â Â  7362/systemdÂ         /run/user/501/pulse/native
> >
> > It looks like systemd manages also root login sessions, and it creates
> > the pulseaudio socket for root. Presumably pulseaudio would get started
> > if some application tried to access the socket. When using the
> > traditional autospawning mechanism, we don't start pulseaudio for root,
> > and that's how it should be also in the systemd socket activation case.
> > 
> > Does anyone have ideas about how we could prevent systemd from creating
> > the socket for root by default?
> >
> 
> Confirmed here too, as long as a root login shell is there; e.g.
> by something like "machinectl shell".
> 
> Unless we want a restricting directive directly inside systemd,
> below trick seems to work here:
> 
>   # /etc/systemd/user/pulseaudio.socket.d/override.conf
>   [Socket]
>   ExecStartPre=/bin/sh -c '/usr/bin/test $(/usr/bin/whoami) != "root"'
> 
> Any better solution?
>

Below also works, and is much better than the above:

    # /etc/systemd/user/pulseaudio.socket.d/override.conf
    [Unit]
    ConditionCapability=!CAP_SYS_ADMIN

regards,