dinit-interchange

A lightweight, fail-secure D-Bus privilege gateway for the Dinit init system.

dinit-interchange acts as a secure, stateless authorization bridge between unprivileged user-space applications and the root-restricted dinit supervisor daemon. It enables granular, per-service privilege delegation without compromising host security or relying on monolithic systemd frameworks.

Why Use It?

Upstream dinit strictly protects its control socket (/run/dinitctl) using kernel-level peer credential validation. It explicitly rejects transactions from non-root users, rendering filesystem-level permissions (such as setfacl) useless by design.

Traditionally, letting an unprivileged server-side process (like an Apache CGI worker or a local desktop application) start or restart a service required dangerous workarounds, such as sweeping, passwordless entries in /etc/sudoers or un-auditable SUID binaries.

dinit-interchange solves this by providing a lightweight alternative to Polkit's service-management layer:

• Stateless Token Evaluation: Validates caller identities via kernel-level UNIX UIDs over the D-Bus system layer.
• Fail-Secure Logic: Implements a default-to-fail security policy.
• Granular Control: Grants permission to start, stop, restart, or reload explicit daemons on a strict, per-service basis via simple JSON files.

Practical Use Case: Headless Web Rendering

Consider a server-side HTML-to-PDF engine (wkgtk-html2pdf) triggered by an unprivileged web worker (www-data). WebKitGTK requires a functional X11 or Wayland surface (Xvfb) to initialize its rendering nodes, or the process crashes.

Instead of granting the web server broad root access to kick-start a missing display dependency, dinit-interchange allows www-data to securely verify, initialize, and orchestrate the specific xvfb daemon on demand.

Installation

dinit-interchange is available in the Arch User Repository (AUR).

1. Install Prerequisites

Because libdinitctl is an AUR package, it must be compiled and present on your system first:

yay -S libdinitctl

2. Build and Install

Compile the daemon natively. Remaining core dependencies (such as json-c and glib2) are resolved automatically:

yay -S dinit-interchange

3. Activate the Service

Enable and start the background daemon:

sudo dinitctl enable dinit-interchange
sudo dinitctl start dinit-interchange

Configuration

Policies are stored as standard JSON files inside /etc/dinit-interchange/rules.d/ and must match the name of the target service (e.g., sshd.policy).

{
  "users": {
    "fiona": ["status"],
    "www-data": ["start", "status"]
  },
  "groups": {
    "server_admins": ["start", "stop", "restart", "reload", "status"]
  }
}

Documentation

• 📄 Download the Printable Technical Manual (PDF)

---

📜 Authors & License

Engineered and maintained by Tim (uk.inplico).
Distributed under the GPLv3 License.