Idea: Possibility to run Salt Minion without root permissions

[stdevel]

Hi community,

I have a customer running Uyuni in an environment with enhanced security environments. They're asking whether it is possible to run the Salt minion without root permissions - e.g. with a dedicated user and appropriate sudo permissions.

The minion configuration file seems to support this:

# The user to run salt.
#user: root

# The user to run salt remote execution commands as via sudo. If this option is
# enabled then sudo will be used to change the active user executing the remote
# command. If enabled the user will need to be allowed access via the sudoers
# file for the user that the salt minion is configured to run as. The most
# common option would be to use the root user. If this option is set the user
# option should also be set to a non-root user. If migrating from a root minion
# to a non root minion the minion cache should be cleared and the minion pki
# directory will need to be changed to the ownership of the new user.
#sudo_user: root

But - would this also work from an Uyuni perspective? I don't know the Uyuni-internal Salt states and couldn't find information about this in the documentation.

Thanks a lot in advance!

[rjmateus]

Hey
You can have a look in here: https://documentation.suse.com/suma/4.3/en/suse-manager/client-configuration/clients-ubuntu.html#_root_access

This is on the ubuntu section but can be applied to any OS.

Salt also have some information: https://docs.saltproject.io/en/3006/ref/configuration/nonroot.html

Note that on the salt docs would need to be adapt to grant access to the virtual env for uyuni.