Dear Maintainer,

The unitfile for radvd should probably have:

```
EnvironmentFile=-/etc/default/radvd
StartExec=/usr/sbin/radvd --logmethod stderr_clean $OPTIONS
```

So that people can set command-line options.

But further, we probably want the default options to include `-u radvd`
like most Debian packages - the package already sets up the user, and
pre-systemd setup privelegeseparation, but this was dropped in the
systemd move. To accomplish this you'll also need to add `CAP_SETUID
CAP_SETGID` to the `CapabilityBoundingSet`.

Finally, errors are masked as currently configured because we fork, but
expect logs on stderr. We should set the `Type` to `simple` and add
`--nodaemon` to the default OPTIONS. So something like:

/etc/default/radvd:
```
OPTIONS="--logmethod stderr_clean -u radvd --nodaemon"
```

/lib/systemd/system/radvd.service
```
# It's not recommended to modify this file in-place, because it
# will be overwritten during upgrades.  If you want to customize,
# the best way is to use the "systemctl edit" command.

[Unit]
Description=Router advertisement daemon for IPv6
Documentation=man:radvd(8)
After=network.target
ConditionPathExists=/etc/radvd.conf

[Service]
Type=simple
ExecStartPre=/usr/sbin/radvd $OPTIONS --configtest
ExecStart=/usr/sbin/radvd $OPTIONS
ExecReload=/usr/sbin/radvd $OPTIONS --configtest
ExecReload=/bin/kill -HUP $MAINPID
PIDFile=/run/radvd.pid

# Set the CPU scheduling policy to idle which is for running very low priority backg>
CPUSchedulingPolicy=idle

# Allow for binding to low ports and doing raw network access
CapabilityBoundingSet=CAP_NET_BIND_SERVICE  CAP_NET_RAW

# Set up a new file system namespace and mounts private /tmp and /var/tmp directories
# so this service cannot access the global directories and other processes cannot
# access this service's directories.
PrivateTmp=yes

# Sets up a new /dev namespace for the executed processes and only adds API pseudo d>
# such as /dev/null, /dev/zero or /dev/random (as well as the pseudo TTY subsystem) >
# but no physical devices such as /dev/sda.
PrivateDevices=yes

# Mounts the /usr, /boot, and /etc directories read-only for processes invoked by th>
ProtectSystem=full

# The directories /home, /root and /run/user are made inaccessible and empty for pro>
# invoked by this unit.
ProtectHome=yes

# Ensures that the service process and all its children can never gain new privileges
NoNewPrivileges=yes

[Install]
WantedBy=multi-user.target
```

This is roughly what I've done on my system with override files.

Finally - I couldn't run `reportbug` from the system in question, so
here's the relevant info:

radvd: 1:2.19-1+b1
Debian Release: 12.9
Architecture: amd64 (x86_64)
Kernel: 5.10.0-0.deb10.28-amd64

Strange version number

I understand the wish.

Username  _radvd  is (somewhere) on the todo list.

a unified diff does make changes more visable.

Acknowledge on "There was an attempt"

a.k.a.  Bookworm

I did expect kernel version 6 something.

a.k.a.   13

Kernel version 6 something



Groeten
Geert Stappers

Thanks for the quick reply!

On 2/27/25 10:20 PM, Geert Stappers wrote:
 >> Package: radvd
 >> Version: 1:2.19-1+b1
 >
 > Strange version number


How so?

```
$ dpkg -l radvd
...
ii  radvd          1:2.19-1+b1  amd64        Router Advertisement Daemon
```

And the same version reported here:
https://packages.debian.org/bookworm/radvd

I've seen Debian moving usernames to _ prefix, though I'm not sure I
understand the significance there. But I think that's orthogonal.
There's already a user, we used to use, but no longer use.

Haven't rebooted it in a while. 6.1.119-1 is installed...

Yes, but that's my desktop, not the system in question, so (I believe)
irrelevant.