[SOLVED] How best to run Bacula's bat?

catkin · 03-02-2010, 12:44 PM

Hello :-)

What is best practice for running Bacula's bat (Bacula Administration Tool) on Linux? Specifically on Slackware 13.0 with Xfce.

/usr/bin/bat is installed as root:root 554; its config file (typically /etc/bacula/bat.conf) is installed as root:root 640. Presumably there are good reasons for these settings.

bat is a GUI tool so needs to run under X. Running X as root is considered insecure or dangerous.

One solution would be to put an ordinary user in group bacula (say) and give that group execute permission on /usr/bin/bat and read permission on /etc/bacula/bat.conf.

Netsearching for combinations of bacula, bat, X, root has not found anything helpful (bat without bacula finds too many pages about .bat files).

Best

Charles

tredegar · 03-02-2010, 12:58 PM

Quote:

bat is a GUI tool so needs to run under X. Running X as root is considered insecure or dangerous.

Many distros have package-manager GUIs that need to be run with root privileges. There do not seem to be any problems. The 'buntu's have synaptic (gnome) and adept (KDE) as well as the command-line apt-get, aptitude etc.

There is a difference between "Running X as root" and running an application as root, on X.

catkin · 03-02-2010, 01:12 PM

Quote:

Originally Posted by tredegar

There is a difference between "Running X as root" and running an application as root, on X.

Thanks for the clarification; I should have written "running bat as root, on X"

tredegar · 03-02-2010, 01:22 PM

OK, But does that change your Q?

Don't forget that every time you open a terminal in your GUI, and su or sudo to root, you are, technically "Running an X application as root".

So I am thinking that you should not worry about it.

I would not startx as root, or allow a GUI login as root, but that's a different matter altogether.

catkin · 03-02-2010, 01:40 PM

Quote:

Originally Posted by tredegar

Don't forget that every time you open a terminal in your GUI, and su or sudo to root, you are, technically "Running an X application as root".

Thanks and "point taken"

I tried it and it didn't work though:

Code:

c@CW8:~$ su root bat
Password:
/usr/bin/bat: /usr/bin/bat: cannot execute binary file
c@CW8:~$ ll /usr/bin/bat
-r-xr-xr-- 1 root bacula 13M Mar  1 19:01 /usr/bin/bat
c@CW8:~$ su - root bat
Password:
/usr/bin/bat: /usr/bin/bat: cannot execute binary file

Meanwhile, the solution using group bacula does work so I'm wondering if it has any disadvantages:

Code:

c@CW8:~$ ll /usr/bin/bat /etc/bacula/bat.conf
-rw-r----- 1 root bacula 143 Mar  1 19:01 /etc/bacula/bat.conf
-r-xr-xr-- 1 root bacula 13M Mar  1 19:01 /usr/bin/bat
c@CW8:~$ bat&
[1] 18070
[bat ran OK]

tredegar · 03-02-2010, 02:17 PM

I am not familiar with your distro or WM.

But I do not think you can

Code:

c@CW8:~$ su root bat

If your distro supports / encourages sudo then you can

Code:

sudo bat

or, is su is the supported means of becoming root, use:

Code:

su -
bat

Your solution with the group bacula, looks fine, but I do not think it is necessary.

catkin · 03-02-2010, 10:41 PM

Thanks tredegar

Regards su and sudo, my su root bat was never going to work. Experimenting shows only sudo does work:

Code:

c@CW8:~$ su root -c bat
Password:
No protocol specified
bat: cannot connect to X server :0.0
c@CW8:~$ su -
Password:
root@CW8:~# bat
bat: cannot connect to X server
root@CW8:~# logout
c@CW8:~$ sudo bat
Password:
[bat ran OK]

Quote:

Originally Posted by tredegar

Your solution with the group bacula, looks fine, but I do not think it is necessary.

That's exactly the sort of input I was hoping for