# Running mender agent as a non-root user
**URL:** https://hub.mender.io/t/running-mender-agent-as-a-non-root-user/1664
**Category:** General Discussions
**Created:** [March 20, 2020, 4:34pm UTC](https://hub.mender.io/t/running-mender-agent-as-a-non-root-user/1664 "2020-03-20T16:34:14Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@madisox](https://hub.mender.io/u/madisox)
#### Post date: [March 20, 2020, 4:34pm UTC](https://hub.mender.io/t/running-mender-agent-as-a-non-root-user/1664/1 "2020-03-20T16:34:14Z")
For our product we’ve been trying to make sure all services running on the device are run under unprivileged service accounts, rather than as root, particularly if they are network-facing. Any thoughts on how easy it would be to do that with the Mender agent?
---
### Author:  [@mirzak](https://hub.mender.io/u/mirzak)
#### Post date: [March 20, 2020, 4:56pm UTC](https://hub.mender.io/t/running-mender-agent-as-a-non-root-user/1664/2 "2020-03-20T16:56:46Z")
Hi @madisox,
I would not expect this to be a to big of a problem. The user that is running the Mender client process needs access to:
- read/write to disk (`group disk`)
- read/write `/var/lib/mender` (this is normally a mount point)
- read/execute `/usr/share/mender` (contains inventory/identity scripts and Update Modules if you are using them)
These are at least the things that come to mind from the top of my head.
---
### Author:  [@madisox](https://hub.mender.io/u/madisox)
#### Post date: [March 20, 2020, 5:37pm UTC](https://hub.mender.io/t/running-mender-agent-as-a-non-root-user/1664/3 "2020-03-20T17:37:07Z")
Thanks @mirzak. I’d also need to review the state scripts - I know I have some that assume they’re running as root - and for U-Boot-based platforms the direct invocations of fw\_setenv/fw\_printenv would need to be looked at.
---
### Author:  [@mirzak](https://hub.mender.io/u/mirzak)
#### Post date: [March 23, 2020, 7:23am UTC](https://hub.mender.io/t/running-mender-agent-as-a-non-root-user/1664/4 "2020-03-23T07:23:39Z")
> [@madisox](#):
>
> fw\_setenv/fw\_printenv
I would expect that the `fw_setenv_/fw_printenv` tools would be covered by the `disk` group.
---
### Author:  [@madisox](https://hub.mender.io/u/madisox)
#### Post date: [March 24, 2020, 4:11pm UTC](https://hub.mender.io/t/running-mender-agent-as-a-non-root-user/1664/5 "2020-03-24T16:11:15Z")
> I would expect that the `fw_setenv_/fw_printenv` tools would be covered by the `disk` group.
Mostly. The version of U-Boot I’m using also uses a lock file, but by pre-creating that file with suitable ownership and permissions, I was able to deal with that issue.
I do have this working now. Besides the lock file mentioned above, I needed to add some udev rules to set some permissions on some sysfs entries that were being accessed by my state scripts. I also needed sudo for some of the state script operations. I also added a wrapper script for the `reboot` command that would use sudo to invoke the real reboot command, and put that on the mender agent’s PATH.
Thanks!
---
### Author:  [@Rayan](https://hub.mender.io/u/Rayan)
#### Post date: [July 28, 2025, 9:53am UTC](https://hub.mender.io/t/running-mender-agent-as-a-non-root-user/1664/6 "2025-07-28T09:53:13Z")
Hello everyone,
We’re facing the same challenge with our product: we need to comply with the principle of least privilege as part of the RED cybersecurity requirements.
I’m currently using Mender 5.0.1 with systemd integration, and I believe both `mender-connect.service` and `mender-update.service` should be updated to avoid running as root, since they have direct network access.
Would it be possible to have this change upstream, using a dedicated `mender` user by default?
---
### Author:  [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)
#### Post date: [July 30, 2025, 10:50am UTC](https://hub.mender.io/t/running-mender-agent-as-a-non-root-user/1664/7 "2025-07-30T10:50:15Z")
Hi @Rayan,
As far as I can tell there are no actions immediately planned in this area, but I definitely agree that it would be a good possible improvement. Can you submit is as a support request so it gets picked up in the product planning process?
Thanks,
Josef
---
### Author:  [@Rayan](https://hub.mender.io/u/Rayan)
#### Post date: [August 5, 2025, 2:25pm UTC](https://hub.mender.io/t/running-mender-agent-as-a-non-root-user/1664/8 "2025-08-05T14:25:51Z")
Hi Josef,
Thanks a lot, I sent a support request at [support@northern.tech](mailto:support@northern.tech).
I am almost done patching my system with Yocto. So far I did the following:
- Override the User/Group to `mender` in the systemd configuration (`mender-authd`, `mender-updated` and `mender-connect` services)
- Adapt permissions for `/etc/mender`, `/usr/share/mender`, and `/var/lib/mender` directories
- Tweak D-Bus config to allow `mender` user
To use the Mender troubleshooting terminal, I am still having issues to spawn a remote shell running under a different user.
`$ cat /etc/mender/mender-connect.conf`
`{`
`“ShellCommand”: “/bin/bash”,`
`“User”: “remote”`
`}`
I did try to add more capabilities to the `mender-connect` service but no luck so far, as I still get the following log: `level=error msg=“failed to start shell: fork/exec /bin/bash: permission denied”`
Do you have any suggestions on how I could achieve it?
Do you think I missed something else?
Thanks,
Rayan
---
### Author:  [@Rayan](https://hub.mender.io/u/Rayan)
#### Post date: [August 29, 2025, 3:07pm UTC](https://hub.mender.io/t/running-mender-agent-as-a-non-root-user/1664/9 "2025-08-29T15:07:56Z")
Quick update: To avoid the issues mentioned above, I kept the default `mender` user in the `mender-connect` configuration as well.