#693218 adduser --system should default to --group

Package:
adduser
Source:
adduser
Submitter:
Wessel Dankers
Date:
2022-07-06 16:33:05 UTC
Severity:
wishlist
Tags:
#693218#5
Date:
2012-11-14 11:36:18 UTC
From:
To:
Hi,

Currently, system users get nogroup (65534) as their default primary group.

However, multiple (system) accounts sharing a common group is not good
from a security standpoint. It gives unrelated processes access to each
other's files and other resources.

While this could be considered a bug in the invoker's script, it's
something that is easy to overlook and it could be argued that defaults
should be sane and secure (‘graceful degradation’).

Please make --group the default for --system.

Kind regards,
#693218#12
Date:
2022-07-06 16:31:55 UTC
From:
To:
Control: tags -1 - security - confirmed + wontfix
thanks

/usr/share/doc/base-passwd/users-and-groups.txt.gz says:
    Daemons that need not own any files sometimes run as
    user nobody and group nogroup, although using a
    dedicated user is far preferable. Thus, no files on a
    system should be owned by this user or group.

That being said I think that adduser does the right thing.

I am ready to be convinced, but for the time being this is a wontfix.

Greetings
Marc
#693218#21
Date:
2022-07-06 16:31:55 UTC
From:
To:
Control: tags -1 - security - confirmed + wontfix
thanks

/usr/share/doc/base-passwd/users-and-groups.txt.gz says:
    Daemons that need not own any files sometimes run as
    user nobody and group nogroup, although using a
    dedicated user is far preferable. Thus, no files on a
    system should be owned by this user or group.

That being said I think that adduser does the right thing.

I am ready to be convinced, but for the time being this is a wontfix.

Greetings
Marc