ECE 440 · Week 8

Modern Computer: Full Stack

One service on the board, one client on the lab network, one saved transcript.

Week 8 of 10 · Solitude

ECE 440 · Week 8 · In class

One service on the board, one client on the lab network, one saved transcript.

The service runs under its own unit file as an unprivileged user: a product's service does not run as root.
The service listens.
The client runs on a lab PC, not on the board.
Save the client's transcript, and the process listing that shows the service's user.

ECE 440 · Week 8 · In class

One service on the board, one client on the lab network, one saved transcript. (continued)

A second run stays in your notes and off the graded page.

ECE 440 · Week 8 · In class

The port number is the number the instructor writes on the board at the start of this lecture.

Copy it, and write the client command you will type on the lab PC.
Those two are the homework.
These notes do not print a port number.

ECE 440 · Week 8 · Lecture

Why a product's service is not root

A bug in a root process can change anything on the board; a bug in a service user's process cannot.
A network service reads input from strangers: give it the least it needs.
Its own user also makes the process listing say who is running it.
Ports below 1024 need extra privilege, which is one more reason to pick the port with care.

ECE 440 · Week 8 · Lecture

A user with no login

sudo useradd --system --no-create-home \
	--shell /usr/sbin/nologin svc-project
id svc-project

--system takes a UID from the system range and skips ageing rules.
nologin means nobody can open a shell as this user.
On last week's read-only root, run this while root is remounted writable.

ECE 440 · Week 8 · Lecture

Its own unit file

[Unit]
Description=Project network service
After=network-online.target
Wants=network-online.target

[Service]
User=svc-project
Group=svc-project
ExecStart=/usr/local/bin/project-service --port PORT
Restart=on-failure
NoNewPrivileges=yes

[Install]
WantedBy=multi-user.target

Saved as /etc/systemd/system/project.service.

ECE 440 · Week 8 · Lecture

Start it and show who runs it

sudo systemctl daemon-reload
sudo systemctl enable --now project.service
systemctl status project.service
ps -o user,pid,cmd -C project-service
sudo ss -ltnp

ps shows the user column the hand-in needs.
ss -ltnp shows the listening address and port, and which process holds it.

ECE 440 · Week 8 · Lecture

When the client cannot connect

Symptom on the lab PC	Look at
Connection refused	Is it listening, on which address?
Hangs, then times out	Right board address? A firewall?
Connects, then closes	`journalctl -u project.service`
Service keeps restarting	Permissions of the files it opens

ECE 440 · Week 8 · Lab

Lab

Run one service on the board, under its own unit file and as an unprivileged user, that a client on the lab network talks to.
Save the client's transcript, and the process listing that shows the service's user. Second pass: run the client a second time and keep that transcript in your notes, not in the graded page.

ECE 440 · Week 8 · Lab

Lab (continued)

Assemble the lab hand-in: The transcript of a lab-network client talking to the board's service, and the unit file and process listing that show the service runs as an unprivileged user.

ECE 440 · Week 8 · Lab

Hand in

The transcript of a lab-network client talking to the board's service, and the unit file and process listing that show the service runs as an unprivileged user.

ECE 440 · Week 8 · Homework

Homework

Write the port number the lecture gives for the service, and the client command you will type on the lab PC.

ECE 440 · Week 8 · Homework

Turn in

The port number and the client command.

ECE 440 · Week 8 · Read

Read

On the lab site: Module 12, A whole system, does not grade a client transcript from the lab network. This week does.

ECE 440 · Week 8 · Next

Week 9

The checkpoint shows one path on the project image: the power-pull path or the bad-update path.