Univention Bugzilla – Bug 51240
UDM REST API server runs as root
Last modified: 2020-05-07 08:50:11 CEST
Running network facing services needlessly as user "root" is a CWE-272 violation of the "Principle of least privilege". # ps u $(pgrep -f univention.admin.rest.server) USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 18165 0.0 1.1 281824 11704 ? Ss Mai06 0:00 /usr/bin/python2.7 -m univention.admin.rest.server Nevertheless the service should not run as user "root" but use a dedicated local user account. (I remember a discussion during the development about this, but don't remember the details, why it was not done in the end)