mirror/borg
1
0
Fork 0
mirror of https://github.com/borgbackup/borg.git synced 2025-03-09 13:53:09 +00:00
Code Issues Releases Wiki Activity

Apply suggestions from code review

Browse source 
Co-authored-by: NetSysFire <59517351+NetSysFire@users.noreply.github.com>
This commit is contained in:
Stephan Herbers 2024-02-21 13:00:27 +01:00 • committed by GitHub
parent 599514a247
commit 9abacabf51
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
docs/deployment/non-root-user.rst
View file

@ -6,18 +6,18 @@
Backing up using a non-root user Backing up using a non-root user
================================ ================================
This section shows how to run borg as a non-root user and still be able to This section describes how to run borg as a non-root user and still be able to
backup every file on the system. backup every file on the system.
Normally borg is run as the root user to bypass all filesystem permission and Normally borg is run as the root user to bypass all filesystem permissions and
be able to read all files. But in theory this also allows borg to modify or be able to read all files. But in theory this also allows borg to modify or
delete files on you system, incase of a bug for example. delete files on your system, in case of a bug for example.
To remove this possible we can run borg as a non-root user and give it readonly To eliminate this possibility, we can run borg as a non-root user and give it read-only
permissions to all files on the system. permissions to all files on the system.
Using linux capabilities inside a systemd service Using Linux capabilities inside a systemd service
================================================= =================================================
One way to do so, is to use linux `capabilities One way to do so, is to use linux `capabilities
@ -46,6 +46,6 @@ A very basic unit file would look like this:
AmbientCapabilities=CAP_DAC_READ_SEARCH AmbientCapabilities=CAP_DAC_READ_SEARCH
The CAP_DAC_READ_SEARCH capability gives borg readonly access to all files and directories on the system. The ``CAP_DAC_READ_SEARCH`` capability gives borg read-only access to all files and directories on the system.
This service can then be started manually using ``systemctl start`` or regularly with a systemd timer. This service can then be started manually using ``systemctl start``, a systemd timer or other methods.