zeya team mailing list archive

[Phil Sung <philbert@xxxxxxxxx>]

On Sat, Dec 26, 2009 at 10:51, Amit Saha <lists.amitsaha@xxxxxxxxx> wrote:
> It works fine for me.

Thanks! I added zeya.conf to my repo in the add-upstart-script branch.

I tested it on Ubuntu Lucid. Running the server on system startup
seems to work fine, but I had to remove the "task" stanza before I was
able to start it manually with "sudo start zeya" (with "task", "start
zeya" would never return control). I'm not very familiar with Upstart
so let me know if this causes some other problem.

> Probably should work for other Upstart based distros too. What are the
> possible security implications of running it at boot time, ie. as root ?

I'm not sure. Naturally, if the server has some vulnerability, then
the problem might be exacerbated if the server was running as root.
However, for the default (dir) backend, the server in general needs
write permissions on the directory being served, so it can write the
metadata cache (zeya.db). Therefore I don't think it's feasible to run
as a completely unprivileged user. Not sure if there is a better way
to do this.

Some other things I realized:
* When running as a service the server probably ought to log output to a file.
* It might be good if one could specify reading another user's
libraries for the rhythmbox/amarok backends, e.g. via a --user flag.
After all, most people probably don't have anything interesting in
root's rhythmbox db.

Cheers,
Phil