Created attachment 272875 [details] [patch] Run turnserver as non-root by default Currently turnserver is started as root by default. While privileges can be dropped via the `proc-user` and `proc-group` configuration options, there is no registered user/group for turnserver. This patch fixes this.
There are 2 days left until the "maintainer timeout".
Created attachment 273466 [details] 0001-net-turnserver-Run-as-non-root-by-default.patch It seems UIDs/GIDs were taken by another port, so I have updated it, taking next number instead. Also there's a ongoing update process for turnserver, bug #297251. I hope we can address this together with the update. Thanks.
(In reply to Yusuf Yaman from comment #2) @Yusuf Sorry I missed this! I'll incorporate these changes in bug #297251. Testing now...
Please be aware that running as non-root user may require additional workarounds on FreeBSD, as suggested by this bug report: https://github.com/coturn/coturn/issues/1098
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=87d11fd7305cb245dff284e34be3a5c0c423aa60 commit 87d11fd7305cb245dff284e34be3a5c0c423aa60 Author: Chris Hutchinson <portmaster@bsdforge.com> AuthorDate: 2026-08-04 19:04:49 +0000 Commit: Yusuf Yaman <nxjoseph@FreeBSD.org> CommitDate: 2026-08-05 09:10:05 +0000 net/turnserver: Update 4.14.0 => 4.16.0 Port changes: - Run turnserver as non-root by default. - Pet port(lint|fmt|clippy). PR: 297251, 296810 Reported by: Frank Wall <freebsd@moov.de> Reported by Zixu Wu <zx@bv3.dev> Approved by: Chris Hutchinson <portmaster@bsdforge.com> (maintainer) Approved by: osa, vvd (Mentors, implicit) Co-authored-by: Frank Wall <freebsd@moov.de> Co-authored-by: Zixu Wu <zx@bv3.dev> Security: GHSA-5538-7cxj-5jcc MFH: 2026Q3 GIDs | 2 +- UIDs | 2 +- net/turnserver/Makefile | 106 ++++++++++++++++++++---------------- net/turnserver/distinfo | 4 +- net/turnserver/files/pkg-message.in | 4 ++ net/turnserver/files/turnserver.in | 8 ++- 6 files changed, 74 insertions(+), 52 deletions(-)
A commit in branch 2026Q3 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=8bd693b6edc9d83ceecdafa886b4185b7f3f0623 commit 8bd693b6edc9d83ceecdafa886b4185b7f3f0623 Author: Chris Hutchinson <portmaster@bsdforge.com> AuthorDate: 2026-08-04 19:04:49 +0000 Commit: Yusuf Yaman <nxjoseph@FreeBSD.org> CommitDate: 2026-08-05 09:11:54 +0000 net/turnserver: Update 4.14.0 => 4.16.0 Port changes: - Run turnserver as non-root by default. - Pet port(lint|fmt|clippy). PR: 297251, 296810 Reported by: Frank Wall <freebsd@moov.de> Reported by Zixu Wu <zx@bv3.dev> Approved by: Chris Hutchinson <portmaster@bsdforge.com> (maintainer) Approved by: osa, vvd (Mentors, implicit) Co-authored-by: Frank Wall <freebsd@moov.de> Co-authored-by: Zixu Wu <zx@bv3.dev> Security: GHSA-5538-7cxj-5jcc MFH: 2026Q3 (cherry picked from commit 87d11fd7305cb245dff284e34be3a5c0c423aa60) GIDs | 2 +- UIDs | 2 +- net/turnserver/Makefile | 106 ++++++++++++++++++++---------------- net/turnserver/distinfo | 4 +- net/turnserver/files/pkg-message.in | 4 ++ net/turnserver/files/turnserver.in | 8 ++- 6 files changed, 74 insertions(+), 52 deletions(-)
(In reply to Frank Wall from comment #4) Thanks, I have added it as a note into pkg-message. Committed.
(In reply to Yusuf Yaman from comment #7) The cited GitHub issue mentions that: > However, if you drop privileges before starting coturn (for example, by setting > turnserver_user=nobody and turnserver_group=nobody in /etc/rc.conf, then it works fine > without the ne=2. So this new default configuration running as non-root should be fine without any additional workaround. A more accurate description for pkg-message may be: "Dropping privileges using the `proc-user` configuration option may require additional workarounds on FreeBSD ..." Not sure it's worth putting a line like this in pkg-message as the new package default eliminates the need to play with the `proc-user` option. Thanks.