Do not add pihole user to web server group #3226
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
By submitting this pull request, I confirm the following:
git rebase
)Signed-off-by: MichaIng micha@dietpi.com
What does this PR aim to accomplish?:
pihole
user is currently added towww-data
webserver group.www-data
+ user !=dietpi
+ higher group mode than "others" mode are/var/cache/lighttpd/compress/
,/var/cache/lighttpd/uploads/
, both with 750 modes, and/var/www/html
with 775 mode. Hence as long as Pi-hole does not directly read one of the first two directories or writes to/var/www/html
(excluding subdirs!), in fact thewww-data
group does not add any other permissions. I could not find any hint for both cases.usermod
was actually added, to probably find some explanation: Full systemd support #2900 (comment)pi
was added towww-data
as a regular step to enable the default RPi login user administrating the webroot. Thepihole
user did not exist at that time and no service/process ran aspi
user. Thepihole
was first introduced as fallback if the userpi
does not exist, to have a similar pseudo-admin user on non-RPi devices. Full transition to pihole user was done later, using it as actual run user for services/processes again later. Adding it towww-data
group was migrated over the years while the initial reason, to give the default login user some website admin capabilities, is not valid anymore.How does this PR accomplish the above?:
usermod -a -G www-data pihole
.