Package: adduser Version: 3.112+nmu2 Severity: wishlist Tags: security Hi,
Currently, system users get nogroup (65534) as their default primary group. However, multiple (system) accounts sharing a common group is not good from a security standpoint. It gives unrelated processes access to each other's files and other resources. While this could be considered a bug in the invoker's script, it's something that is easy to overlook and it could be argued that defaults should be sane and secure (‘graceful degradation’). Please make --group the default for --system. Kind regards, -- Wessel Dankers <wsl-deb-bug-sub...@fruit.je>
signature.asc
Description: Digital signature
