contrib/systemd: run as osmocom user
I have verified that with AmbientCapabilities=CAP_SYS_NICE, setting
scheduling policy as described in the manual still works as expected.
Related: OS#4107
Change-Id: I362a9e55309033c42b16f12321f8d1aa27da7b59
diff --git a/contrib/systemd/osmo-pcu.service b/contrib/systemd/osmo-pcu.service
index 521f6fc..8c0fd69 100644
--- a/contrib/systemd/osmo-pcu.service
+++ b/contrib/systemd/osmo-pcu.service
@@ -9,7 +9,10 @@
StateDirectory=osmocom
WorkingDirectory=%S/osmocom
Restart=always
+User=osmocom
+Group=osmocom
RestartSec=2
+AmbientCapabilities=CAP_SYS_NICE
# CPU scheduling policy:
CPUSchedulingPolicy=rr
# For real-time scheduling policies an integer between 1 (lowest priority) and 99 (highest priority):
diff --git a/debian/postinst b/debian/postinst
new file mode 100755
index 0000000..cfd72a2
--- /dev/null
+++ b/debian/postinst
@@ -0,0 +1,39 @@
+#!/bin/sh -e
+case "$1" in
+ configure)
+ # Create the osmocom group and user (if it doesn't exist yet)
+ if ! getent group osmocom >/dev/null; then
+ groupadd --system osmocom
+ fi
+ if ! getent passwd osmocom >/dev/null; then
+ useradd \
+ --system \
+ --gid osmocom \
+ --home-dir /var/lib/osmocom \
+ --shell /sbin/nologin \
+ --comment "Open Source Mobile Communications" \
+ osmocom
+ fi
+
+ # Fix permissions of previous (root-owned) install (OS#4107)
+ if dpkg --compare-versions "$2" le "1.5.0"; then
+ if [ -e /etc/osmocom/osmo-pcu.cfg ]; then
+ chown -v osmocom:osmocom /etc/osmocom/osmo-pcu.cfg
+ chmod -v 0660 /etc/osmocom/osmo-pcu.cfg
+ fi
+
+ if [ -d /etc/osmocom ]; then
+ chown -v root:osmocom /etc/osmocom
+ chmod -v 2775 /etc/osmocom
+ fi
+
+ mkdir -p /var/lib/osmocom
+ chown -R -v osmocom:osmocom /var/lib/osmocom
+ fi
+ ;;
+esac
+
+# dh_installdeb(1) will replace this with shell code automatically
+# generated by other debhelper scripts.
+#DEBHELPER#
+