Running daemon under nobody user is not recommended (Closes: #970045)

Create a galera user that will run the daemon instead. See: https://github.com/systemd/systemd/blob/v246/NEWS#L106-L113
codership · Jan 16, 2023 · 4530666 · 4530666
1 parent d54ebf8
commit 4530666
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 2 deletions.
diff --git a/debian/galera-4.preinst b/debian/galera-4.preinst
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+set -o posix
+
+# creating galera user
+getent passwd galera >/dev/null 2>&1 ||
+  adduser --system --no-create-home --home /nonexistent \
+    --disabled-password --disabled-login galera
diff --git a/garb/files/garb.service b/garb/files/garb.service
@@ -11,7 +11,7 @@ WantedBy=multi-user.target
 Alias=garbd.service
 
 [Service]
-User=nobody
+User=galera
 ExecStart=/usr/bin/garb-systemd start
 
 # Use SIGINT because with the default SIGTERM

diff --git a/garb/files/garb.sh b/garb/files/garb.sh
@@ -49,7 +49,7 @@ program_start() {
 	local rcode
 	if [ -f /etc/redhat-release ]; then
 		echo -n $"Starting $prog: "
-		daemon --user nobody $prog "$@" >/dev/null
+		daemon --user galera $prog "$@" >/dev/null
 		rcode=$?
 		if [ $rcode -eq 0 ]; then
 			pidof $prog > $PIDFILE || rcode=$?