[PATCH 5/5] vm/sys/net: run dbus-daemon as non-root

Alyssa Ross
2025-11-13T13:27:11Z

vm/sys/net/file-list.mk | 2 +-
vm/sys/net/image/etc/dbus-1/system.conf | 8 --------
vm/sys/net/image/etc/group | 1 +
vm/sys/net/image/etc/group.license | 2 ++
vm/sys/net/image/etc/passwd | 1 +
vm/sys/net/image/etc/s6-rc/dbus/run | 6 ++++--
6 files changed, 9 insertions(+), 11 deletions(-)
delete mode 100644 vm/sys/net/image/etc/dbus-1/system.conf
create mode 100644 vm/sys/net/image/etc/group
create mode 100644 vm/sys/net/image/etc/group.license

diff --git a/vm/sys/net/file-list.mk b/vm/sys/net/file-list.mk
index a6f1a41..15ccd24 100644
--- a/vm/sys/net/file-list.mk
+++ b/vm/sys/net/file-list.mk
@@ -2,8 +2,8 @@
# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>

FILES = \
- image/etc/dbus-1/system.conf \
image/etc/fstab \
+ image/etc/group \
image/etc/init \
image/etc/mdev.conf \
image/etc/mdev/iface \
diff --git a/vm/sys/net/image/etc/dbus-1/system.conf b/vm/sys/net/image/etc/dbus-1/system.conf
deleted file mode 100644
index 9ceda7c..0000000
--- a/vm/sys/net/image/etc/dbus-1/system.conf
+++ /dev/null
@@ -1,8 +0,0 @@
-<?xml version="1.0"?>
-
-<!-- SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is> -->
-<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
- "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
-<busconfig>
- <user>root</user>
-</busconfig>
diff --git a/vm/sys/net/image/etc/group b/vm/sys/net/image/etc/group
new file mode 100644
index 0000000..6d4e77d
--- /dev/null
+++ b/vm/sys/net/image/etc/group
@@ -0,0 +1 @@
+messagebus:x:4:
diff --git a/vm/sys/net/image/etc/group.license b/vm/sys/net/image/etc/group.license
new file mode 100644
index 0000000..0d3d47c
--- /dev/null
+++ b/vm/sys/net/image/etc/group.license
@@ -0,0 +1,2 @@
+SPDX-License-Identifier: CC0-1.0
+SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
diff --git a/vm/sys/net/image/etc/passwd b/vm/sys/net/image/etc/passwd
index 29f3b25..6a54d1d 100644
--- a/vm/sys/net/image/etc/passwd
+++ b/vm/sys/net/image/etc/passwd
@@ -1 +1,2 @@
root:x:0:0:System administrator:/:/bin/sh
+messagebus:x:4:4::/nonexistent:/usr/bin/nologin
diff --git a/vm/sys/net/image/etc/s6-rc/dbus/run b/vm/sys/net/image/etc/s6-rc/dbus/run
index 26dd403..6e88e80 100644
--- a/vm/sys/net/image/etc/s6-rc/dbus/run
+++ b/vm/sys/net/image/etc/s6-rc/dbus/run
@@ -1,8 +1,10 @@
#!/bin/execlineb -P
# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2020-2021, 2025 Alyssa Ross <hi@alyssa.is>

-foreground { mkdir /run/dbus }
+if { install -do messagebus -g messagebus /run/dbus }
+
+s6-setuidgid messagebus

dbus-daemon
--config-file=/usr/share/dbus-1/system.conf
--
2.51.0