[PATCH 5/5] vm/sys/net: run dbus-daemon as non-root

[Alyssa Ross <hi@alyssa.is>]

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
 vm/sys/net/file-list.mk                 | 2 +-
 vm/sys/net/image/etc/dbus-1/system.conf | 8 --------
 vm/sys/net/image/etc/group              | 1 +
 vm/sys/net/image/etc/group.license      | 2 ++
 vm/sys/net/image/etc/passwd             | 1 +
 vm/sys/net/image/etc/s6-rc/dbus/run     | 6 ++++--
 6 files changed, 9 insertions(+), 11 deletions(-)
 delete mode 100644 vm/sys/net/image/etc/dbus-1/system.conf
 create mode 100644 vm/sys/net/image/etc/group
 create mode 100644 vm/sys/net/image/etc/group.license

diff --git a/vm/sys/net/file-list.mk b/vm/sys/net/file-list.mk
index a6f1a41..15ccd24 100644
--- a/vm/sys/net/file-list.mk
+++ b/vm/sys/net/file-list.mk
@@ -2,8 +2,8 @@
 # SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
 
 FILES = \
-	image/etc/dbus-1/system.conf \
 	image/etc/fstab \
+	image/etc/group \
 	image/etc/init \
 	image/etc/mdev.conf \
 	image/etc/mdev/iface \
diff --git a/vm/sys/net/image/etc/dbus-1/system.conf b/vm/sys/net/image/etc/dbus-1/system.conf
deleted file mode 100644
index 9ceda7c..0000000
--- a/vm/sys/net/image/etc/dbus-1/system.conf
+++ /dev/null
@@ -1,8 +0,0 @@
-<?xml version="1.0"?>
-<!-- SPDX-License-Identifier: CC0-1.0 -->
-<!-- SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is> -->
-<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
-    "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
-<busconfig>
-  <user>root</user>
-</busconfig>
diff --git a/vm/sys/net/image/etc/group b/vm/sys/net/image/etc/group
new file mode 100644
index 0000000..6d4e77d
--- /dev/null
+++ b/vm/sys/net/image/etc/group
@@ -0,0 +1 @@
+messagebus:x:4:
diff --git a/vm/sys/net/image/etc/group.license b/vm/sys/net/image/etc/group.license
new file mode 100644
index 0000000..0d3d47c
--- /dev/null
+++ b/vm/sys/net/image/etc/group.license
@@ -0,0 +1,2 @@
+SPDX-License-Identifier: CC0-1.0
+SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
diff --git a/vm/sys/net/image/etc/passwd b/vm/sys/net/image/etc/passwd
index 29f3b25..6a54d1d 100644
--- a/vm/sys/net/image/etc/passwd
+++ b/vm/sys/net/image/etc/passwd
@@ -1 +1,2 @@
 root:x:0:0:System administrator:/:/bin/sh
+messagebus:x:4:4::/nonexistent:/usr/bin/nologin
diff --git a/vm/sys/net/image/etc/s6-rc/dbus/run b/vm/sys/net/image/etc/s6-rc/dbus/run
index 26dd403..6e88e80 100644
--- a/vm/sys/net/image/etc/s6-rc/dbus/run
+++ b/vm/sys/net/image/etc/s6-rc/dbus/run
@@ -1,8 +1,10 @@
 #!/bin/execlineb -P
 # SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>
 
-foreground { mkdir /run/dbus }
+if { install -do messagebus -g messagebus /run/dbus }
+
+s6-setuidgid messagebus
 
 dbus-daemon
   --config-file=/usr/share/dbus-1/system.conf
-- 
2.51.0