cloudflare / cloudflare/cloudflared
Reduce cloudflared service priveleges on linux💡
- Dominant language
- Go
- Stars
- 15.6k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the feature you'd like**
I think having the linux services (at least for cloudflared) to run at reduced privileges, rather than root.
At a minimum I think The following params should be added to the service though adding others from the service file example would be preferable
Environment="TUNNEL_TOKEN=" - Move the Tunnel token out of the command line which keeps it out of `ps`
DynamicUser=true - Has systemd create a user on service start
I have the below running in production successfully on many RHEL 8 and 9 machines
https://github.com/flpydsk/cloudflared-configs/blob/master/cloudflared.service
The goal of this is to reduce the attack surface and unnecessary priveleges
**Describe alternatives you've considered**
I already use my own services, I am of the opinion that having all the services run in this way is a good idea
**Additional context**
Add any other context or screenshots about the feature request here.
Contributor guide
Assessment
This issue has not been assessed yet.