Hi everyone, Our Kea (ISC's DHCP server) package is moving to a non-root setup to run services for improved security. This implies a manual intervention for users upgrading from an existing installation. See the news draft below (pad available at https://md.archlinux.org/1TykcWc0TPaz3MAuwfm9Fw). --- Starting with `kea 1:3.0.3-2`, all kea services now run as a dedicated non-privileged `kea` user (instead of `root`) for improved security. This change requires a manual intervention for users upgrading from `kea` <= `1:3.0.3-1` to >= `1:3.0.3-2`, in order to update the permissions and ownership of the kea files and directories accordingly. After upgrading, run the following commands to update permissions and ownership of kea files and directories, then restart the affected services (if they are running): ```bash chmod 755 /etc/kea/{,radius} /usr/include/kea/{,asiodns,asiolink,cc,config,config_backend,cryptolink,d2srv,database,dhcp,dhcp_ddns,dhcpsrv,dhcpsrv/parsers,dns,eval,exceptions,hooks,http,log,log/interprocess,mysql,pgsql,process,process/cfgrpt,stats,tcp,util,util/encode,util/io} /usr/lib/kea/{,hooks} /usr/lib/python3.14/site-packages/kea/{,__pycache__/} /usr/share/kea/{,api,meson-info,scripts,scripts/mysql,scripts/pgsql} chmod 644 /etc/kea/*.conf /etc/kea/radius/* chown kea: /var/lib/kea/* /var/log/kea/* /run/lock/kea/logger_lockfile systemctl try-restart kea-ctrl-agent.service kea-dhcp{4,6,-ddns}.service ``` If necessary, you can run `pacman -Qkk kea` to find any other permission deviations and adjust as needed. --- -- Regards, Robin Candau / Antiz