Thanks Antoine.
Actually I am reworking an old dynamic motd login script of mine that, at
login, shows me basic data of that machine (e.g. uptime, ram, disk, etc)
including RUNNING daemons.
This is a sample (decolored) output:
Welcome back: tony!
Active Login: x.x.x.x Fri Nov 06 17:00:47 still logged in
Uptime: 0d 13h 05m
CPU Load: 0.00 last minute, 0.00 last 5min, 0.00 last 15min
Memory Load: 91M used, 1025M cache, 5147M free (total 7908M, swap
0M/447M)
Network: IP(s): 10.1.0.197 10.2.0.197 GW: 10.1.0.1
sd0a disk: 13.8G (50%) used, 13.8G free
RUNNING SERVICES: cron dhcpleased ftpd isc_named messagebus mountd nfsd
nginx portmap
postfix resolvd sensorsd slaacd sndiod sshd syslogd tftpd
__________________________________________________
/ ------------------Online Users------------------ \
\ tony ttyp0 Nov 6 17:00 (x.x.x.x) /
--------------------------------------------------
\ ,__,
\ (oo)____
(__) )\
||--|| *
For an internet-exposed VM by ssh, I am not giving the basic user any doas
right (one can only su to root), but at the same time I'd like to see
what's running in that particular moment (which of course might be
disaligned with what is enabled).
Point is that "rcctl check <service>" needs no root rights, but I'd have to
run it n-times for all the services in /etc/rc.d/ which is damn slow. What
I cannot understand is why any user can see if one service is running but
is prevented to see the list of all services running in that moment. It
would be like either for security a normal user cannot query any service or
can query all of them.
So core question is: would this "rcctl ls started" be some security hole if
enabled for normal users (but, still they can do rcctl check!) or can the
policy change and be uniformed to the one of "rcctl check"? That would be
really useful for many plain users, seeing immediately what is running
without any doas or su need.
Thanks again
Paolo
On Fri, Nov 6, 2026 at 5:10 PM Antoine Jacoutot <[email protected]>
wrote:
> On Fri, Nov 06, 2026 at 02:59:20PM +0100, Paolo Aglialoro wrote:
> > Hello,
> >
> > just a question. What is the design logic behind this:
> >
> > rcctl ls on ----> normal user can execute this command
> > rcctl ls started ----> only root can execute this command
> >
> > shouldn't also the "started" services be visible to normal user? (I'd
> prefer this one)
> > or shouldn't also "on" be denied to normal user?
> > is this coping with some remote risk or just happens to be like this?
>
> The design logic is:
>
> rcctl ls on:
> check the service is activated in the config
> i.e. mostly read rc.conf{.local}, no superuser rights needed
>
> rcctl ls started:
> will run "/etc/rc.d/foo check" => some rc.d scripts needs root permission
> to do
> that.
>
> --
> Antoine
>
