Debian Bug report logs - #693218
adduser --system should default to --group

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Wessel Dankers <wsl-deb-bug-submit@fruit.je>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: adduser --system should default to --group

Date: Wed, 14 Nov 2012 12:36:18 +0100

[Message part 1 (text/plain, inline)]

Package: adduser
Version: 3.112+nmu2
Severity: wishlist
Tags: security

Hi,

Currently, system users get nogroup (65534) as their default primary group.

However, multiple (system) accounts sharing a common group is not good
from a security standpoint. It gives unrelated processes access to each
other's files and other resources.

While this could be considered a bug in the invoker's script, it's
something that is easy to overlook and it could be argued that defaults
should be sane and secure (‘graceful degradation’).

Please make --group the default for --system.

Kind regards,

-- 
Wessel Dankers <wsl-deb-bug-submit@fruit.je>

[signature.asc (application/pgp-signature, inline)]

Message #12 received at 693218@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: Wessel Dankers <wsl-deb-bug-submit@fruit.je>, 693218@bugs.debian.org, 693218-submitter@bugs.debian.org

Subject: Re: Bug#693218: adduser --system should default to --group

Date: Wed, 6 Jul 2022 18:31:55 +0200

Control: tags -1 - security - confirmed + wontfix
thanks

On Wed, Nov 14, 2012 at 12:36:18PM +0100, Wessel Dankers wrote:
> However, multiple (system) accounts sharing a common group is not good
> from a security standpoint. It gives unrelated processes access to each
> other's files and other resources.

/usr/share/doc/base-passwd/users-and-groups.txt.gz says:
    Daemons that need not own any files sometimes run as
    user nobody and group nogroup, although using a
    dedicated user is far preferable. Thus, no files on a
    system should be owned by this user or group.

That being said I think that adduser does the right thing.

I am ready to be convinced, but for the time being this is a wontfix.

Greetings
Marc

Send a report that this bug log contains spam.