maintainer-script-lacks-home-in-adduser

The maintainer script apparently runs 'adduser --system' but hardcodes a path under '/home' for the '--home' option or does not use the '--home' option.

The FHS says: /home is a fairly standard concept, but it is clearly a site-specific filesystem. The setup will differ from host to host. Therefore, no program should rely on this location.

Note that passing --no-create-home alone does not solve the issue because home field of passwd file point to a non existing /home subdirectory. Please use adduser --no-create-home --home /nonexistent instead.

For more information please consult:

/home : User home directories (optional) (Section 3.8) in the Filesystem Hierarchy Standard
the adduser(8) manual page

The tag is present in Lintian version 2.114.163. That is the most recent version we know about.

We use semantic versions. The patch number is a commit step indicator relative to the 2.114.0 release tag in our Git repository.

You can find the detection logic for this version at commit d219a5a. For merge requests, please use the latest version in the Lintian check scripts.

Visibility: error

Renamed from:

maintainer-script-should-not-use-adduser-system-without-home

The following 4 source packages in the archive triggered the tag 4 times (in any Lintian version).

We found 2 overrides. The tag performed 50% of the time.

cereal

"adduser --quiet --system --no-create-home --home '/var/lib/cereal' --shell '/bin/false' --gecos 'cereal logfile owner,,,' cereal" [postinst:11]

rtpproxy

- # false positive
"adduser --system --no-create-home --group rtpproxy" [postinst:8]

smtpprox-loopprevent

"adduser --quiet --system --ingroup $_GROUP --no-create-home --disabled-password $_USER 2>/dev/null || true" [postinst:36]

snort

- # The maintainer script uses --no-create-home but this gets flagged by lintian as an error when it is not.
"adduser --quiet --system --ingroup $SNORTGROUP --no-create-home --disabled-password $SNORTUSER 2>/dev/null || true" [preinst:71]