Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

7.5. Running the Agent as a Non-Root User

To access some resource information, the agent must have root access to the resource itself. However, for security, many administrators do not want to run the agent process as root.
On Red Hat Enterprise Linux, it is possible to grant access to the agent to specific resources while running the agent as a non-root user. This is done by setting local access control rules to the local directories or files for the resource.
Note
This example sets ACLs for a PostgreSQL database; the directories and files to specify in the setfacl command will vary depending on the resource type.
  1. Log into the system as root.
  2. Make sure that the acl package is installed on the system. 
    # rpm -q acl
acl-2.2.39-6.el5
    Copy to Clipboard Toggle word wrap
    The acl option must be applied to the filesystem. This can be done by editing the /etc/fstab file or using tune2fs. For example: 
    # vim /etc/fstab

LABEL=/           /             ext3    defaults,acl    1 1
...
    Copy to Clipboard Toggle word wrap
    Then re-mount the filesystem. 
    # mount -o remount /
    Copy to Clipboard Toggle word wrap
  3. Optionally, create a system user to use for the agent. 
    useradd jbosson-agent
    Copy to Clipboard Toggle word wrap
  4. For PostgreSQL, the agent needs to be able to access the postgresql.conf file. Open the PostgreSQL directory: 
    # cd /var/lib/pgsql
    Copy to Clipboard Toggle word wrap
  5. Grant read and write access to the postgresql.conf file to the agent user. For example: 
    # setfacl -m u:jbosson-agent:rw $PGDATA/postgresql.conf
    Copy to Clipboard Toggle word wrap
  6. Then, grant access to the data/ directory to the agent user. For example: 
    # setfacl -m u:jbosson-agent:x $PGDATA
    Copy to Clipboard Toggle word wrap
  7. Check that the new ACLs were added properly using the getfacl command: 
    # getfacl .
# file: .
# owner: postgres
# group: postgres
user::rwx
user:jbosson-agent:--x
group::---
mask::--x
other::---
    Copy to Clipboard Toggle word wrap
Report a bug
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat