Embed Notice

@feld Atleast on Linux an option going forward is systemd.socket, which can do TCP socket listening for a service and pass it when starting it. That eliminates the need for requiring root, systemd is root and opens the socket, the service does not open it onyl handle it.

On BSD/Alpine there'd be the option of inetd with priv dropping so systemd isn't required.

Apple MacOS.

Still, it seems atleast the part that is being RCE'd is not running as root and can only write to /tmp as non-root, so it's "FINE" (load bearing quotes).