From 8fa62f9b91745bf6d77ec2c92a8dd6d9c2fa9ef5 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Fri, 23 Oct 2026 12:46:53 +0100 Subject: [PATCH] Package: put the guard user in adm and systemd-journal Only the unit's SupplementaryGroups gave them, so 'sudo -u guard guard test' and 'guard check' could read neither /var/log's files nor the journal. systemd-sysusers (run on every install and upgrade) adds them. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 8 ++++++++ deploy/sysusers.d/guard.conf | 6 +++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dce73f5..263ae2f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,3 +28,11 @@ All notable changes to Guard are documented here. The format follows the `adm` and `systemd-journal` groups, published with each release to the Gitea Debian registry (`stable`, or `testing` for a release candidate) along with tarballs for Linux amd64 and arm64. + +### Fixed + +- The package's `guard` user is now in the `adm` and `systemd-journal` + groups itself, as the documentation said, not only through its unit's + `SupplementaryGroups`. `sudo -u guard guard test` and `guard check` + could read neither `/var/log`'s files (`permission denied`) nor the + journal. Upgrading adds the groups. diff --git a/deploy/sysusers.d/guard.conf b/deploy/sysusers.d/guard.conf index b668c38..a947086 100644 --- a/deploy/sysusers.d/guard.conf +++ b/deploy/sysusers.d/guard.conf @@ -1,3 +1,7 @@ # Guard's system user (systemd-sysusers): it reads logs and talks to -# Housecarl, nothing more. +# Housecarl, nothing more. adm reads /var/log's files, systemd-journal +# the journal, for the daemon (its unit adds them too) and for +# 'sudo -u guard guard test'. u guard - "Guard log watcher" /var/lib/guard /usr/sbin/nologin +m guard adm +m guard systemd-journal