Support dropping root privileges (or re-include droproot module). #675

New Issue

Closed

opened 2026-10-05 04:37:49 +02:00 by adam · 5 comments

adam commented 2026-10-05 04:37:49 +02:00

Owner

Copy link

Copy source

Currently, it's not possible to bind ZNC to a privileged port without running it as root. This is a problem if a user cannot use unprivileged ports, such as when firewall rules block inbound access to unprivileged ports.

There are currently some workarounds, but they're non-trivial for a layperson to implement and are difficult to maintain, including:

1. Compiling the droproot module for the user's version of ZNC.
   • Possibly a maintenance nightmare since symbols seem to change between minor versions (eg 1.6 -> 1.7)
2. Using iptables to route traffic to an unprivileged port.
   • Ugly and fragile if user wants to change the port or add new ones.
3. Using setcap on ZNC to give it port binding privileges.
   • Fragile, as it needs to be re-set every time the ZNC binary gets updated.

Is it possible to either add setuid support into ZNC?
If not, is it possible to re-add droproot to the list of modules that come with ZNC as it compiles and runs properly on 1.6.2 without modification.

Currently, it's not possible to bind ZNC to a privileged port without running it as root. This is a problem if a user cannot use unprivileged ports, such as when firewall rules block inbound access to unprivileged ports. There are currently some workarounds, but they're non-trivial for a layperson to implement and are difficult to maintain, including: 1. Compiling the [droproot module](https://github.com/znc/znc/blob/fc8e789b081b74c6ae2b460bb056dac7019f3dce/modules/extra/droproot.cpp) for the user's version of ZNC. - Possibly a maintenance nightmare since symbols seem to change between minor versions (eg 1.6 -> 1.7) 2. Using iptables to route traffic to an unprivileged port. - Ugly and fragile if user wants to change the port or add new ones. 3. Using setcap on ZNC to give it port binding privileges. - Fragile, as it needs to be re-set every time the ZNC binary gets updated. Is it possible to either add setuid support into ZNC? If not, is it possible to re-add droproot to the list of modules that come with ZNC as it compiles and runs properly on 1.6.2 without modification. <!-- github-sync-id:125902448 -->

adam closed this issue 2026-10-05 04:37:49 +02:00

adam commented 2026-10-05 04:37:50 +02:00

Author

Owner

Copy link

Copy source

You do know that rehashing doesn't work in this setting?
Also, there is no supported way of setting up such a setup. (The "do not edit"-hint in the config)
Oh and droproot silently does nothing when it is loaded at runtime which will likely confuse users.

The droproot module can not really work without problems. There is never a point where we won't be needing root privileges anymore. So this is still a fragile solution.

Edit: Oh, I just noticed that using the droproot module has all the same downside of option 2 "Using iptables" and adds more.

You do know that rehashing doesn't work in this setting? Also, there is no supported way of setting up such a setup. (The "do not edit"-hint in the config) Oh and `droproot` silently does nothing when it is loaded at runtime which will likely confuse users. The `droproot` module can not really work without problems. There is never a point where we won't be needing root privileges anymore. So this is still a fragile solution. Edit: Oh, I just noticed that using the `droproot` module has all the same downside of option 2 "Using iptables" and adds more. <!-- github-comment-id:170482898 -->

adam commented 2026-10-05 04:37:50 +02:00

Author

Owner

Copy link

Copy source

Not even rehashing, that one is broken anyway.
Saving config won't work. So when you join a channel, then restart ZNC, you
will need to join the channel again, even Chansaver module won't help.
Settings edited via webadmin will stay only until restart too. The same
goes for e.g. list of entries in Watch module.

iptables is much less fragile solution.

2016-01-11 9:26 GMT+00:00 Uli Schlachter notifications@github.com:

You do know that rehashing doesn't work in this setting?
Also, there is no supported way of setting up such a setup. (The "do not
edit"-hint in the config)
Oh and droproot silently does nothing when it is loaded at runtime which
will likely confuse users.

The droproot module can not really work without problems. There is never
a point where we won't be needing root privileges anymore. So this is still
a fragile solution.

—
Reply to this email directly or view it on GitHub
https://github.com/znc/znc/issues/1233#issuecomment-170482898.

Not even rehashing, that one is broken anyway. Saving config won't work. So when you join a channel, then restart ZNC, you will need to join the channel again, even Chansaver module won't help. Settings edited via webadmin will stay only until restart too. The same goes for e.g. list of entries in Watch module. iptables is much less fragile solution. 2016-01-11 9:26 GMT+00:00 Uli Schlachter notifications@github.com: > You do know that rehashing doesn't work in this setting? > Also, there is no supported way of setting up such a setup. (The "do not > edit"-hint in the config) > Oh and droproot silently does nothing when it is loaded at runtime which > will likely confuse users. > > The droproot module can not really work without problems. There is never > a point where we won't be needing root privileges anymore. So this is still > a fragile solution. > > — > Reply to this email directly or view it on GitHub > https://github.com/znc/znc/issues/1233#issuecomment-170482898. <!-- github-comment-id:170490015 -->

adam commented 2026-10-05 04:37:51 +02:00

Author

Owner

Copy link

Copy source

You do know that rehashing doesn't work in this setting?

You're right, looks like it breaks on rebind. I'm not an expert on ZNC, hence why I asked.

Also, there is no supported way of setting up such a setup. (The "do not edit"-hint in the config)

Agreed. Though I'm curious why editing the config outside of ZNC (even if it's not running) is frowned upon.

Oh and droproot silently does nothing when it is loaded at runtime which will likely confuse users.

Didn't realize that was the case, but adding some sort of error message should be fairly easy if that was the only issue with droproot.

The droproot module can not really work without problems. There is never a point where we won't be needing root privileges anymore. So this is still a fragile solution.

Good to know about all the caveats of droproot (and dropping privileges in ZNC). It's one of the reasons why I wanted to bring it up the first place.

Saving config won't work. So when you join a channel, then restart ZNC, you
will need to join the channel again, even Chansaver module won't help.
Settings edited via webadmin will stay only until restart too. The same
goes for e.g. list of entries in Watch module.

Saving configs works fine as far as I can tell. The configs can be owned by the unprivileged user. Though as you guys mentioned previously, adding or changing ports to another port in the privileged range is broken.

So it looks like there's a lot of issues using droproot and it isn't a real possibility to implement setuid. At least not without a rewrite to allow a parent process to maintain root. I'll close this out then since it looks like there's no real desire for this to be supported.

> You do know that rehashing doesn't work in this setting? You're right, looks like it breaks on rebind. I'm not an expert on ZNC, hence why I asked. > Also, there is no supported way of setting up such a setup. (The "do not edit"-hint in the config) Agreed. Though I'm curious why editing the config outside of ZNC (even if it's not running) is frowned upon. > Oh and droproot silently does nothing when it is loaded at runtime which will likely confuse users. Didn't realize that was the case, but adding some sort of error message should be fairly easy if that was the only issue with `droproot`. > The droproot module can not really work without problems. There is never a point where we won't be needing root privileges anymore. So this is still a fragile solution. Good to know about all the caveats of `droproot` (and dropping privileges in ZNC). It's one of the reasons why I wanted to bring it up the first place. > Saving config won't work. So when you join a channel, then restart ZNC, you > will need to join the channel again, even Chansaver module won't help. > Settings edited via webadmin will stay only until restart too. The same > goes for e.g. list of entries in Watch module. Saving configs works fine as far as I can tell. The configs can be owned by the unprivileged user. Though as you guys mentioned previously, adding or changing ports to another port in the privileged range is broken. So it looks like there's a lot of issues using `droproot` and it isn't a real possibility to implement `setuid`. At least not without a rewrite to allow a parent process to maintain root. I'll close this out then since it looks like there's no real desire for this to be supported. <!-- github-comment-id:170507203 -->

adam commented 2026-10-05 04:37:52 +02:00

Author

Owner

Copy link

Copy source

Editing the config outside of ZNC is ok, when it's not running.

2016-01-11 10:50 GMT+00:00 optix2000 notifications@github.com:

You do know that rehashing doesn't work in this setting?

You're right, looks like it breaks on rebind. I'm not an expert on ZNC,
hence why I asked.

Also, there is no supported way of setting up such a setup. (The "do not
edit"-hint in the config)

Agreed. Though I'm curious why editing the config outside of ZNC (even if
it's not running) is frowned upon.

Oh and droproot silently does nothing when it is loaded at runtime which
will likely confuse users.

Didn't realize that was the case, but adding some sort of error message
should be fairly easy if that was the only issue with droproot.

The droproot module can not really work without problems. There is never a
point where we won't be needing root privileges anymore. So this is still a
fragile solution.

Good to know about all the caveats of droproot (and dropping privileges in
ZNC). It's of the reasons why I wanted to bring it up the first place.

Saving config won't work. So when you join a channel, then restart ZNC, you
will need to join the channel again, even Chansaver module won't help.
Settings edited via webadmin will stay only until restart too. The same
goes for e.g. list of entries in Watch module.

Saving configs works fine as far as I can tell. The configs can be owned
by the unprivileged user. Though as you guys mentioned previously, adding
or changing ports to another port in the privileged range is broken.

So it looks like there's a lot of issues using droproot and it isn't a
real possibility to implement setuid. At least not without a rewrite to
allow a parent process to maintain root. I'll close this out then since it
looks like there's no real desire for this to be supported.

—
Reply to this email directly or view it on GitHub
https://github.com/znc/znc/issues/1233#issuecomment-170507203.

Editing the config outside of ZNC is ok, when it's not running. 2016-01-11 10:50 GMT+00:00 optix2000 notifications@github.com: > You do know that rehashing doesn't work in this setting? > > You're right, looks like it breaks on rebind. I'm not an expert on ZNC, > hence why I asked. > > Also, there is no supported way of setting up such a setup. (The "do not > edit"-hint in the config) > > Agreed. Though I'm curious why editing the config outside of ZNC (even if > it's not running) is frowned upon. > > Oh and droproot silently does nothing when it is loaded at runtime which > will likely confuse users. > > Didn't realize that was the case, but adding some sort of error message > should be fairly easy if that was the only issue with droproot. > > The droproot module can not really work without problems. There is never a > point where we won't be needing root privileges anymore. So this is still a > fragile solution. > > Good to know about all the caveats of droproot (and dropping privileges in > ZNC). It's of the reasons why I wanted to bring it up the first place. > > Saving config won't work. So when you join a channel, then restart ZNC, you > will need to join the channel again, even Chansaver module won't help. > Settings edited via webadmin will stay only until restart too. The same > goes for e.g. list of entries in Watch module. > > Saving configs works fine as far as I can tell. The configs can be owned > by the unprivileged user. Though as you guys mentioned previously, adding > or changing ports to another port in the privileged range is broken. > > So it looks like there's a lot of issues using droproot and it isn't a > real possibility to implement setuid. At least not without a rewrite to > allow a parent process to maintain root. I'll close this out then since it > looks like there's no real desire for this to be supported. > > — > Reply to this email directly or view it on GitHub > https://github.com/znc/znc/issues/1233#issuecomment-170507203. <!-- github-comment-id:170509696 -->

adam commented 2026-10-05 04:37:52 +02:00

Author

Owner

Copy link

Copy source

Hi all,

Saw this a little late, but wanted to chime in as there is desire for this feature (at least by the two of us then).

I began the implementation of this and got the base functionality working with ZNC, but my changeset does not support an alternative API that the underlying library needs to maintain. My pull request on that library (and discussion between myself and the maintainer) is here: https://github.com/jimloco/Csocket/pull/59. If there's interest, I'll clean up and publish my (very rough) ZNC branch accompanying it. I'll try to take another look at all of this code this week/weekend.

DarthGandalf does raise a good point I had not considered re saving configs etc, but perhaps those could be saved and read additionally as the reduced privilege user.

Hi all, Saw this a little late, but wanted to chime in as there is desire for this feature (at least by the two of us then). I began the implementation of this and got the base functionality working with ZNC, but my changeset does not support an alternative API that the underlying library needs to maintain. My pull request on that library (and discussion between myself and the maintainer) is here: https://github.com/jimloco/Csocket/pull/59. If there's interest, I'll clean up and publish my (very rough) ZNC branch accompanying it. I'll try to take another look at all of this code this week/weekend. DarthGandalf does raise a good point I had not considered re saving configs etc, but perhaps those could be saved and read additionally as the reduced privilege user. <!-- github-comment-id:171040946 -->

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

1.10.x

1.9.x

1.8.x

1.7.x

1.6.x

znc-1.10.3

znc-1.10.2

znc-1.10.2-rc1

znc-1.10.1

znc-1.10.1-rc1

znc-1.10.0

znc-1.10.0-rc1

znc-1.9.1

znc-1.9.0

znc-1.9.0-rc1

znc-1.8.2

znc-1.8.2-rc1

znc-1.8.1

znc-1.8.1-rc1

znc-1.8.0

znc-1.7.5

znc-1.7.5-rc1

znc-1.7.4

znc-1.7.4-rc1

znc-1.7.3

znc-1.7.3-rc1

znc-1.7.2

znc-1.7.2-rc1

znc-1.7.1

znc-1.7.1-rc1

znc-1.7.0

znc-1.6.6

znc-1.6.6-rc1

znc-1.6.5

znc-1.6.5-rc1

znc-1.6.4

znc-1.6.4-rc3

znc-1.6.4-rc2

znc-1.6.4-rc1

znc-1.6.3

znc-1.6.3-rc2

znc-1.6.3-rc1

znc-1.6.2

znc-1.6.2-rc1

znc-1.6.1

znc-1.6.1-rc1

znc-1.6.0

znc-1.4

znc-1.2

znc-1.0

znc-0.206

znc-0.204

znc-0.202

znc-0.200

znc-0.098

znc-0.096

znc-0.094

znc-0.092

znc-0.090

znc-0.080

znc-0.078

znc-0.076

znc-0.074

znc-0.072

znc-0.070

znc-0.068

znc-0.066

znc-0.064

znc-0.062

znc-0.060

znc-0.058

znc-0.056

znc-0.054

znc-0.054-rc3

znc-0.054-rc2

znc-0.054-rc1

znc-0.023

znc-0.025

znc-0.027

znc-0.028

znc-0.029

znc-0.030

znc-0.033

znc-0.034

znc-0.035

znc-0.036

znc-0.037

znc-0.038

znc-0.039

znc-0.040

znc-0.041

znc-0.043

znc-0.044

znc-0.045

znc-0.047

znc-0.050

znc-0.052

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

adam (Adam Wojcieszonek)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#675