How does Homebrew run services as root without sudo?

[sryze]

Output of brew config

HOMEBREW_VERSION: 4.1.21
ORIGIN: https://github.com/Homebrew/brew
HEAD: ad1bb178d4a478840c4524063ac5cd52d8667d25
Last commit: 5 days ago
Core tap JSON: 24 Nov 20:44 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: ["--require-sha"]
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.ixDPASRwOG/org.xquartz:0
HOMEBREW_EDITOR: vim
HOMEBREW_MAKE_JOBS: 8
HOMEBREW_NO_ANALYTICS: set
HOMEBREW_NO_INSECURE_REDIRECT: set
Homebrew Ruby: 2.6.10 => /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/bin/ruby
CPU: octa-core 64-bit arm_firestorm_icestorm
Clang: 15.0.0 build 1500
Git: 2.43.0 => /opt/homebrew/bin/git
Curl: 8.1.2 => /usr/bin/curl
macOS: 13.6.1-arm64
CLT: 15.0.0.0.1.1694021235
Xcode: 15.0.1
Rosetta 2: false

Output of brew doctor

... some irrelevant gibberish ...

Description of issue

After installing dnscrypt-proxy I noticed that it runs as root but I did not provide a password nor did I run Homebrew via sudo.

How does Homebrew achieve this?

Also, I made a mistake of restarting dnscrypt-proxy, and upon restart I was told that it's supposed to be run as root:

$ brew services restart dnscrypt-proxy
Warning: dnscrypt-proxy must be run as root to start at system startup!

and then restarted it as instructed:

sudo brew services restart dnscrypt-proxy
Password:
Stopping `dnscrypt-proxy`... (might take a while)
==> Successfully stopped `dnscrypt-proxy` (label: homebrew.mxcl.dnscrypt-proxy)
Warning: Taking root:admin ownership of some dnscrypt-proxy paths:
  /opt/homebrew/Cellar/dnscrypt-proxy/2.1.5/sbin
  /opt/homebrew/Cellar/dnscrypt-proxy/2.1.5/sbin/dnscrypt-proxy
  /opt/homebrew/opt/dnscrypt-proxy
  /opt/homebrew/opt/dnscrypt-proxy/sbin
  /opt/homebrew/var/homebrew/linked/dnscrypt-proxy
This will require manual removal of these paths using `sudo rm` on
brew upgrade/reinstall/uninstall.
==> Successfully started `dnscrypt-proxy` (label: homebrew.mxcl.dnscrypt-proxy)

Apparently now the files are owned by root, and they were not before (I've double-checked by reinstalling the package).

This is a little bit confusing - why was it not necessary before, when the service was running as root as well? Was it dangerous then, since some malicious script could be run by my user that would be able to plant another script to start as root? I'm concerned that there is a security hole here.

[SMillerDev]

After installing dnscrypt-proxy it noticed that it runs as root but I did not provide a password nor did I run Homebrew via sudo.

Because you enabled the service as sudo? There is simply no other way.

[sryze]

Hmm, I didn't execute sudo brew services start if that's what you mean. It starts by itself after the installation and runs as root.

dnscrypt-proxy executable is owned by myuser:admin, not root.

[SMillerDev]

Nothing in Homebrew can or will start by itself. The only way this can run as root without your explicit execution of it is if an admin on your machine executed it, or if you started the service as root before and now it runs as a service on boot.

[sryze]

@SMillerDev Thanks for clarifying. There was a launchtl daemon file in /Library that caused it to run as root. I didn't know about that.

[sryze]

Problem solved:

Deleted rm /Library/LaunchDaemons/homebrew.mxcl.dnscrypt-proxy.plist and rebooted, dnscrypt-proxy no longer starts as root.

But apparently it's not that useful to run is as non-root because then it can't listen on the 53 port and macOS will ignore DNS servers specified in network settings that are not running on port 53 (or at least for me it does so). So in the end I started the service with sudo, which in turn changed the owner of corresponding files to root.