A user is created after installing the software on Linux, as per https://github.com/mickem/nscp/blob/master/files/deb/postinst
Most modern distros uses systemd that supports DynamicUser inside service unit files, this would be more appropriate because it won't leave traces if the software is removed and there's no requirement of modifying filesystem permissions to write logs using LogsDirectory.
Maybe I am ignorant or didn't read the correct files, but it seems to me we do not need to be able to store persistent files expect for the logs.
/usr/share/nsclient seems to be used to store a PID file, it could either not be stored at all (systemd doesn't need a PID file to terminate a process), or could be stored inside /run if you found a se case where a PID file would be required with systemd using RuntimeDirectory parameter. I don't feel changing the PID file path to be at the correct /run directory would be a problem as it seems this path is always explicitly called by other tools than nsclient itself.
While i could make a pullrequest, since there's no commit for 2019 I am not sure if the project is stall or if owner made local changes without pushing, for the latter, a push would be appreciable as the service file in the repo may have changes we cannot see, or other files may have changes that would make the resulting systemd service file too strict to allow it to work.
A user is created after installing the software on Linux, as per https://github.com/mickem/nscp/blob/master/files/deb/postinst Most modern distros uses
systemd
that supportsDynamicUser
inside service unit files, this would be more appropriate because it won't leave traces if the software is removed and there's no requirement of modifying filesystem permissions to write logs usingLogsDirectory
.Some literature about it : https://www.freedesktop.org/software/systemd/man/systemd.exec.html#DynamicUser= https://noise.getoto.net/2017/10/06/dynamic-users-with-systemd/ https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing
Maybe I am ignorant or didn't read the correct files, but it seems to me we do not need to be able to store persistent files expect for the logs. /usr/share/nsclient seems to be used to store a PID file, it could either not be stored at all (systemd doesn't need a PID file to terminate a process), or could be stored inside /run if you found a se case where a PID file would be required with systemd using
RuntimeDirectory
parameter. I don't feel changing the PID file path to be at the correct /run directory would be a problem as it seems this path is always explicitly called by other tools than nsclient itself.While i could make a pullrequest, since there's no commit for 2019 I am not sure if the project is stall or if owner made local changes without pushing, for the latter, a push would be appreciable as the service file in the repo may have changes we cannot see, or other files may have changes that would make the resulting systemd service file too strict to allow it to work.