[Pkg-swan-devel] [Git][debian/strongswan][debian/master] 3 commits: Stop deleting system user on remove/purge

[Yves-Alexis Perez (@corsac)]

Yves-Alexis Perez pushed to branch debian/master at Debian / strongswan


Commits:
3f12bbc6 by Luca Boccassi at 2026-09-13T12:06:48+00:00
Stop deleting system user on remove/purge

This is widely considered bad practice, as the kernel recycles
UIDs/GIDs. So any potential leftover file/directory can then
become owned by the next user/group that gets added, with
unpredictable consequences.

- - - - -
d5645fe6 by Luca Boccassi at 2026-09-13T12:06:48+00:00
Install and use sysusers.d config file

sysusers.d config files allow a package to use declarative
configuration instead of manually written maintainer scripts.
This also allows image-based systems to be created with /usr/
only, and also allows for factory resetting a system and
recreating /etc/ on boot.

debhelper already takes care of starting the init script
on install with the generated snippet, so drop the manual
start, to avoid ordering issues with the creation of the
system user.

https://www.freedesktop.org/software/systemd/man/latest/sysusers.d.html

- - - - -
b3274299 by Yves-Alexis Perez at 2026-09-13T13:01:29+00:00
Merge branch 'sysusers' into 'debian/master'

Install and use sysusers.d config file

See merge request debian/strongswan!14
- - - - -


4 changed files:

- debian/control
- debian/strongswan-starter.postinst
- debian/strongswan-starter.postrm
- + debian/strongswan-starter.sysusers


Changes:

=====================================
debian/control
=====================================
@@ -10,6 +10,7 @@ Build-Depends: bison,
                bzip2,
                debhelper-compat (= 12),
                dh-apparmor,
+               dh-sequence-installsysusers,
                dpkg-dev (>= 1.16.2),
                flex,
                gperf,
@@ -196,8 +197,7 @@ Description: strongSwan charon library (extra plugins)
 Package: strongswan-starter
 Architecture: any
 Pre-Depends: ${misc:Pre-Depends}
-Depends: adduser,
-         libstrongswan (= ${binary:Version}),
+Depends: libstrongswan (= ${binary:Version}),
          sysvinit-utils (>= 3.05-3),
          ${misc:Depends},
          ${shlibs:Depends}


=====================================
debian/strongswan-starter.postinst
=====================================
@@ -119,12 +119,6 @@ disable_daemon_start() {
     fi
 }
 
-setup_strongswan_user() {
-        if ! getent passwd strongswan >/dev/null; then
-                adduser --quiet --system --no-create-home --home /var/lib/strongswan --shell /usr/sbin/nologin strongswan
-        fi
-}
-
 . /usr/share/debconf/confmodule
 
 case "$1" in
@@ -234,13 +228,7 @@ case "$1" in
         #    disable_daemon_start "charon" "IKEv2"
         #fi
 
-	# create user for strongswan to change its uid into
-	setup_strongswan_user
-
-	if [ -z "$2" ]; then
-	    # no old configured version - start strongswan now
-            invoke-rc.d ipsec start || true
-        else
+	if [ -n "$2" ]; then
   	    # does the user wish strongswan to restart?
 	    db_get strongswan/restart
 	    if [ "$RET" = "true" ]; then


=====================================
debian/strongswan-starter.postrm
=====================================
@@ -31,12 +31,6 @@ case "$1" in
 esac
 
 if [ "$1" = "purge" ] ; then
-        if getent passwd strongswan>/dev/null; then
-                if which deluser > /dev/null; then
-                        deluser --system strongswan
-                fi
-        fi
-
         rm -rf /etc/ipsec.d/
         rm -rf /var/run/pluto/
         rm -rf /var/lib/strongswan/


=====================================
debian/strongswan-starter.sysusers
=====================================
@@ -0,0 +1 @@
+u! strongswan -:nogroup - /var/lib/strongswan /usr/sbin/nologin



View it on GitLab: https://salsa.debian.org/debian/strongswan/-/compare/1dd7e0f9c3e2e2ba224c7707242fb876d41c2455...b32742997d4075e85a3120039e20a28546488e5d

-- 
View it on GitLab: https://salsa.debian.org/debian/strongswan/-/compare/1dd7e0f9c3e2e2ba224c7707242fb876d41c2455...b32742997d4075e85a3120039e20a28546488e5d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-swan-devel/attachments/20260913/def0c7c2/attachment-0001.htm>