package: adduser
version: 3.118
Debian 10.10 default graphical install, desktop enviroment (default GNOME), setup user 'user' and password.
iso used: https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-10.10.0-amd64-netinst.iso
virtualization used: VM VirtualBox and another
[1]
Removing unused (and locked) is part of hardening guidelines and it has become a common security and maintentance practice and it may be necessary for compliance reasons. This includes unused system users.
During a test I found that "deluser --remove-home bin" removes the bin directory.
deluser should not remove any system directory, or at least not without a clear warning and explicit confirmation.
The code suggests that 'no_del_paths' should be applied as a filter. That filter is defined in '/usr/share/perl5/Debian/AdduserCommon.pm'. This file is present, found and read (strace).
'deluser' lines from 155 attempt to get settings.
command used: deluser --remove-home --backup bin
output:
Looking for files to backup/remove ...
Backing up files to be removed to . ...
backup_name = ./bin.tar
/bin/tar: Removing leading `/' from member names
Removing files ...
Can't exec "/bin/sh": No such file or directory at /usr/sbin/deluser line 351.
Removing user `bin' ...
Warning: group `bin' has no more members.
Done.
The output shows that the bin directory was removed because a call to /bin/sh fails.
Other users with system directories set as home directory may be have similar results. Users do not have to exclusively own the set directory. Also, in the case of 'bin' and some other system users, there are no files owned by 'bin'.
[2]
A second issue is that a failed or incomplete backup does not stop removing the directory. A complete backup should be secured before removal is performed.
strace partial output on reading /usr/share/perl5/Debian/AdduserCommon.pm:
stat("/usr/share/perl5/Debian/AdduserCommon.pm", {st_mode=S_IFREG|0644, st_size=6185, ...}) = 0
openat(AT_FDCWD, "/usr/share/perl5/Debian/AdduserCommon.pm", O_RDONLY|O_CLOEXEC) = 4
ioctl(4, TCGETS, 0x7ffcff82bfc0) = -1 ENOTTY (Inappropriate ioctl for device)
lseek(4, 0, SEEK_CUR) = 0
read(4, "use vars qw(@EXPORT $VAR1);\n\n\n# "..., 8192) = 6185
brk(0x55e4c6ebb000) = 0x55e4c6ebb000
read(4, "", 8192) = 0
close(4) = 0
The file size is 6185 bytes.
root directory:
4 drwxr-xr-x 19 root root 4096 Aug 13 21:29 .
4 drwxr-xr-x 19 root root 4096 Aug 13 21:29 ..
0 lrwxrwxrwx 1 root root 7 Aug 13 21:02 bin -> usr/bin
4 drwxr-xr-x 3 root root 4096 Aug 13 21:34 boot
4 drwx------ 2 root root 4096 Aug 13 21:29 .cache
0 drwxr-xr-x 17 root root 3180 Aug 13 21:47 dev
4 drwxr-xr-x 118 root root 4096 Aug 13 21:47 etc
4 drwxr-xr-x 3 root root 4096 Aug 13 21:35 home
0 lrwxrwxrwx 1 root root 31 Aug 13 21:04 initrd.img -> boot/initrd.img-4.19.0-17-amd64
0 lrwxrwxrwx 1 root root 31 Aug 13 21:04 initrd.img.old -> boot/initrd.img-4.19.0-17-amd64
0 lrwxrwxrwx 1 root root 7 Aug 13 21:02 lib -> usr/lib
0 lrwxrwxrwx 1 root root 9 Aug 13 21:02 lib32 -> usr/lib32
0 lrwxrwxrwx 1 root root 9 Aug 13 21:02 lib64 -> usr/lib64
0 lrwxrwxrwx 1 root root 10 Aug 13 21:02 libx32 -> usr/libx32
16 drwx------ 2 root root 16384 Aug 13 21:02 lost+found
4 drwxr-xr-x 3 root root 4096 Aug 13 21:02 media
4 drwxr-xr-x 2 root root 4096 Aug 13 21:02 mnt
4 drwxr-xr-x 2 root root 4096 Aug 13 21:02 opt
0 dr-xr-xr-x 192 root root 0 Aug 13 21:47 proc
4 drwx------ 4 root root 4096 Aug 13 21:54 root
0 drwxr-xr-x 23 root root 620 Aug 13 21:47 run
0 lrwxrwxrwx 1 root root 8 Aug 13 21:02 sbin -> usr/sbin
4 drwxr-xr-x 2 root root 4096 Aug 13 21:02 srv
0 dr-xr-xr-x 13 root root 0 Aug 13 21:52 sys
4 drwxrwxrwt 15 root root 4096 Aug 13 21:52 tmp
4 drwxr-xr-x 14 root root 4096 Aug 13 21:26 usr
4 drwxr-xr-x 11 root root 4096 Aug 13 21:02 var
0 lrwxrwxrwx 1 root root 28 Aug 13 21:04 vmlinuz -> boot/vmlinuz-4.19.0-17-amd64
0 lrwxrwxrwx 1 root root 28 Aug 13 21:04 vmlinuz.old -> boot/vmlinuz-4.19.0-17-amd64
bin is a link to usr/bin
Attachments:
'dpkg -l' output
mount file
passwd file
fstab file (ids replaced)