diff --git a/src/applications/daemon/management/PhabricatorDaemonManagementWorkflow.php b/src/applications/daemon/management/PhabricatorDaemonManagementWorkflow.php --- a/src/applications/daemon/management/PhabricatorDaemonManagementWorkflow.php +++ b/src/applications/daemon/management/PhabricatorDaemonManagementWorkflow.php @@ -3,6 +3,8 @@ abstract class PhabricatorDaemonManagementWorkflow extends PhabricatorManagementWorkflow { + private $runDaemonsAsUser = null; + protected final function loadAvailableDaemonClasses() { $loader = new PhutilSymbolLoader(); return $loader @@ -173,6 +175,13 @@ implode(' ', $flags), implode(' ', $argv)); + if ($this->runDaemonsAsUser) { + $command = csprintf( + 'su %C -c "%C"', + $this->runDaemonsAsUser, + $command); + } + $phabricator_root = dirname(phutil_get_library_root('phabricator')); $daemon_script_dir = $phabricator_root.'/scripts/daemon/'; @@ -265,6 +274,26 @@ pht('Freed %s task lease(s).', new PhutilNumber($count))); } + // Check if the script is started as the correct user + $phd_user = PhabricatorEnv::getEnvConfig('phd.user'); + $current_user = posix_getpwuid(posix_geteuid()); + $current_user = $current_user['name']; + if ($current_user == 'root') { + if ($phd_user) { + $this->runDaemonsAsUser = $phd_user; + $console->writeOut(pht('Starting daemons as %s', $phd_user)."\n"); + } else { + $console->writeErr(pht( + 'Running daemons as root is not recommended. "'. + 'Please configure phd.user')."\n"); + } + } else if ($phd_user && $phd_user != $current_user) { + $console->writeErr(pht( + 'Daemons are configured to run as %s. '. + 'Cannot start as user %s', $phd_user, $current_user)."\n"); + exit(1); + } + $daemons = array( array('PhabricatorRepositoryPullLocalDaemon', array()), array('PhabricatorGarbageCollectorDaemon', array()),