dhcpcd: unprivileged service

[dkwo]

I tested the changes in this PR: yes
If not using privsep, these capabilieties are enough in my tests to run as non-root user.

[dogknowsnx]

Been running v10.2.4 for several weeks now without issues - haven't tested this PR though.

[dkwo]

You are also welcome to test this pr: the usual root service is still there, unchanged.

[dogknowsnx]

So just in theory before testing this:

• changing the group is fine since we'd be root otherwise anyway
• excluding the world from /etc/dhcpcd.conf is desirable in terms of security
• the changes to /run/dhcpcd won't affect root access, either, and are only effective during runtime
• I'm not familiar with the exec flags, tbh - I won't have to add myself to the _dhcpcd group in order for this to work, correct?

[dkwo]

That is right. Note that you can run either the old service (which should be unaffeted) or the new -unprivileged one, which also works fine in my experience, but clearly not both at the same time.

[dogknowsnx]

@dkwo Maybe adjust the title reflecting the update, as well

[github-actions]

Pull Requests become stale 90 days after last activity and are closed 14 days after that. If this pull request is still relevant bump it or assign it.

[ahesford]

My objections for wpa_supplicant also apply here.

[dkwo]

Although this has been working fine for me, it can be more tricky than the wpa_supplicant case: even if we ignore setpriv (as we should), this daemon runs many hooks, and I did not check that all of them work fine. I think I can fix the resolvconf one, but I do not use the others.