[PR #461] [CLOSED] Use DynamicUser in whoogle.service #453 #885

New issue

Closed

opened 2026-02-25 20:37:00 +03:00 by kerem · 0 comments

kerem commented

2026-02-25 20:37:00 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/benbusby/whoogle-search/pull/461
Author: @astier
Created: 10/14/2021
Status: ❌ Closed

Base: main ← Head: dynamic-user

📝 Commits (1)

5ffe86a Use DynamicUser in whoogle.service #453

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 README.md (+1 -1)

📄 Description

Quote from https://www.freedesktop.org/software/systemd/man/systemd.exec.html

DynamicUser= takes a boolean parameter. If set, a UNIX user and group
pair is allocated dynamically when the unit is started, and released as
soon as it is stopped. The user and group will not be added to
/etc/passwd or /etc/group, but are managed transiently during runtime.

DynamicUser creates dynamically a new user whoogle with limited
priviliges which are handled by systemd every time whoogle.service is
started. I think this is more secure and easier rather than letting the
admin deal with the user and its priviliges under which whoogle should
run. Its certainly a big security improvement compared to the root-user
which was used to run whoogle not that long ago.

I changed my whoogle.service file accordingly and running ps u -U whoogle shows me that systemd automatically runs whoogle with the user
whoogle which systemd created automatically because I never created
the user myself.

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
whoogle     6299  0.0  0.7 363884 58808 ?        Ssl  20:14   0:01 /opt/whoogle-search/venv/bin/python3 -um app --host 0.0.0.0 --port 5000

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/benbusby/whoogle-search/pull/461 **Author:** [@astier](https://github.com/astier) **Created:** 10/14/2021 **Status:** ❌ Closed **Base:** `main` ← **Head:** `dynamic-user` --- ### 📝 Commits (1) - [`5ffe86a`](https://github.com/benbusby/whoogle-search/commit/5ffe86a63a60dbefbbbdc4a67c950374f452273a) Use DynamicUser in whoogle.service #453 ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+1 -1) </details> ### 📄 Description Quote from https://www.freedesktop.org/software/systemd/man/systemd.exec.html > DynamicUser= takes a boolean parameter. If set, a UNIX user and group pair is allocated dynamically when the unit is started, and released as soon as it is stopped. The user and group will not be added to /etc/passwd or /etc/group, but are managed transiently during runtime. `DynamicUser` creates dynamically a new user `whoogle` with limited priviliges which are handled by systemd every time whoogle.service is started. I think this is more secure and easier rather than letting the admin deal with the user and its priviliges under which whoogle should run. Its certainly a big security improvement compared to the root-user which was used to run whoogle not that long ago. I changed my `whoogle.service` file accordingly and running `ps u -U whoogle` shows me that systemd automatically runs whoogle with the user `whoogle` which systemd created automatically because I never created the user myself. ``` USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND whoogle 6299 0.0 0.7 363884 58808 ? Ssl 20:14 0:01 /opt/whoogle-search/venv/bin/python3 -um app --host 0.0.0.0 --port 5000 ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>