From a321c90db4a6d323f1a9bc06c4d861cee8868664 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@debian.org>
Date: Mon, 15 Feb 2021 00:32:29 +0100
Subject: Use dedicated system users for internal components.

  * The internal webserver now runs as a dedicated system user _lacme-www
    (and group nogroup) instead of www-data:www-data.  This is configurable
    in the [webserver] section of the lacme(8) configuration file.
  * The internal ACME client now runs as a dedicated system user _lacme-client
    (and group nogroup) instead of nobody:nogroup.  This is configurable in
    the [client] section of the lacme(8) configuration file.
  * The _lacme-www and _lacme-client system users are created automatically by
    lacme.postinst (hence a new Depends: adduser), and deleted on purge.  (So
    make sure not to chown any file to these internal users.)
---
 debian/changelog      |  9 +++++++++
 debian/control        |  3 ++-
 debian/lacme.postinst | 21 +++++++++++++++++++++
 debian/lacme.postrm   | 15 +++++++++++++++
 debian/rules          |  4 +++-
 5 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100755 debian/lacme.postinst
 create mode 100755 debian/lacme.postrm

diff --git a/debian/changelog b/debian/changelog
index 9c56889..2eeeb5c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,14 @@
 lacme (0.7-2) UNRELEASED; urgency=medium
 
+  * The internal webserver now runs as a dedicated system user _lacme-www
+    (and group nogroup) instead of www-data:www-data.  This is configurable
+    in the [webserver] section of the lacme(8) configuration file.
+  * The internal ACME client now runs as a dedicated system user _lacme-client
+    (and group nogroup) instead of nobody:nogroup.  This is configurable in
+    the [client] section of the lacme(8) configuration file.
+  * The _lacme-www and _lacme-client system users are created automatically by
+    lacme.postinst (hence a new Depends: adduser), and deleted on purge.  (So
+    make sure not to chown any file to these internal users.)
   * d/control: New lacme-accountd Suggests: openssl, gpg (for account key
     generation and decryption).
   * Add d/upstream/signing-key.asc, the OpenPGP used to signed upstream tags.
diff --git a/debian/control b/debian/control
index 91bdac2..07419a2 100644
--- a/debian/control
+++ b/debian/control
@@ -11,7 +11,8 @@ Vcs-Browser: https://salsa.debian.org/debian/lacme
 
 Package: lacme
 Architecture: all
-Depends: libconfig-tiny-perl,
+Depends: adduser,
+         libconfig-tiny-perl,
          libjson-perl,
          libnet-ssleay-perl,
          libtimedate-perl,
diff --git a/debian/lacme.postinst b/debian/lacme.postinst
new file mode 100755
index 0000000..536e37f
--- /dev/null
+++ b/debian/lacme.postinst
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = "configure" ]; then
+    if ! getent passwd _lacme-www >/dev/null; then
+	    adduser --force-badname --system \
+            --home /nonexistent --no-create-home \
+            --gecos "lacme www user" \
+            --quiet _lacme-www || true
+    fi
+    if ! getent passwd _lacme-client >/dev/null; then
+	    adduser --force-badname --system \
+            --home /nonexistent --no-create-home \
+            --gecos "lacme client user" \
+            --quiet _lacme-client || true
+    fi
+fi
+
+#DEBHELPER#
+exit 0
diff --git a/debian/lacme.postrm b/debian/lacme.postrm
new file mode 100755
index 0000000..c52a198
--- /dev/null
+++ b/debian/lacme.postrm
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1" = "purge" ]; then
+    if getent passwd _lacme-www >/dev/null; then
+        deluser --quiet --system _lacme-www
+    fi
+    if getent passwd _lacme-client >/dev/null; then
+        deluser --quiet --system _lacme-client
+    fi
+fi
+
+#DEBHELPER#
+exit 0
diff --git a/debian/rules b/debian/rules
index cc86c79..9ba6afd 100755
--- a/debian/rules
+++ b/debian/rules
@@ -1,7 +1,9 @@
 #!/usr/bin/make -f
 
 override_dh_auto_build:
-	dh_auto_build -- DESTDIR= exec_prefix=/usr datadir=/usr/share runstatedir=/run
+	dh_auto_build -- DESTDIR= exec_prefix=/usr datadir=/usr/share runstatedir=/run \
+		lacme_www_user=_lacme-www lacme_www_group=nogroup \
+		lacme_client_user=_lacme-client lacme_client_group=nogroup
 
 %:
 	dh $@
-- 
cgit v1.2.3