From 4c9436a8215683e86fcbe8018ea2b57deab2e47d Mon Sep 17 00:00:00 2001
From: Jason Rothstein <fdragon@fdragon.org>
Date: Tue, 12 May 2026 11:36:00 -0500
Subject: [PATCH] Run as a dedicated user instead of root

---
 hbbr.service             | 11 ++++++++++-
 hbbs.service             | 11 ++++++++++-
 rustdesk-server.spec     | 23 +++++++++++++++++++++--
 rustdesk-server.sysusers |  1 +
 rustdesk-server.tmpfiles |  1 +
 5 files changed, 43 insertions(+), 4 deletions(-)
 create mode 100644 rustdesk-server.sysusers
 create mode 100644 rustdesk-server.tmpfiles

diff --git a/hbbr.service b/hbbr.service
index a01848a..8593d94 100644
--- a/hbbr.service
+++ b/hbbr.service
@@ -4,10 +4,19 @@ After=network.target
 
 [Service]
 Type=simple
+User=rustdesk
+Group=rustdesk
 WorkingDirectory=/var/lib/rustdesk-server
 ExecStart=/usr/bin/hbbr
-Restart=always
+Restart=on-failure
 RestartSec=10
 
+# Security Hardening
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/rustdesk-server
+
 [Install]
 WantedBy=multi-user.target
\ No newline at end of file
diff --git a/hbbs.service b/hbbs.service
index 7b9524c..31475e1 100644
--- a/hbbs.service
+++ b/hbbs.service
@@ -4,10 +4,19 @@ After=network.target
 
 [Service]
 Type=simple
+User=rustdesk
+Group=rustdesk
 WorkingDirectory=/var/lib/rustdesk-server
 ExecStart=/usr/bin/hbbs
-Restart=always
+Restart=on-failure
 RestartSec=10
 
+# Security Hardening
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/rustdesk-server
+
 [Install]
 WantedBy=multi-user.target
\ No newline at end of file
diff --git a/rustdesk-server.spec b/rustdesk-server.spec
index c1747a9..47eac7f 100644
--- a/rustdesk-server.spec
+++ b/rustdesk-server.spec
@@ -11,7 +11,7 @@
 
 Name:           rustdesk-server
 Version:        1.1.15
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        RustDesk Server Program
 
 License:        AGPL-3.0-only
@@ -22,6 +22,8 @@ Source2:        hbbs.xml
 Source3:        hbbr.xml
 Source4:        hbbs.service
 Source5:        hbbr.service
+Source6:        rustdesk-server.sysusers
+Source7:        rustdesk-server.tmpfiles
 
 BuildRequires:  cargo
 BuildRequires:  rust
@@ -33,6 +35,7 @@ BuildRequires:  openssl-devel
 BuildRequires:  systemd-rpm-macros
 Requires:       firewalld-filesystem
 %{?systemd_requires}
+%sysusers_requires
 
 %description
 RustDesk Server Program. Includes the hbbs (RustDesk ID/Rendezvous server)
@@ -68,8 +71,20 @@ install -m 0644 %{SOURCE5} %{buildroot}%{_unitdir}/hbbr.service
 # Create working directory for keys/database
 mkdir -p %{buildroot}%{_sharedstatedir}/%{name}
 
+# Create sysusers.d config
+mkdir -p %{buildroot}%{_sysusersdir}
+install -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/%{name}.conf
+
+# Create tmpfiles.d config
+mkdir -p %{buildroot}%{_tmpfilesdir}
+install -m 0644 %{SOURCE7} %{buildroot}%{_tmpfilesdir}/%{name}.conf
+
+%pre
+%sysusers_create_compat %{name}.conf
+
 %post
 %systemd_post hbbs.service hbbr.service
+systemd-tmpfiles --create %{name}.conf || :
 
 %preun
 %systemd_preun hbbs.service hbbr.service
@@ -85,9 +100,14 @@ mkdir -p %{buildroot}%{_sharedstatedir}/%{name}
 %{_prefix}/lib/firewalld/services/hbbr.xml
 %{_unitdir}/hbbs.service
 %{_unitdir}/hbbr.service
+%{_sysusersdir}/%{name}.conf
+%{_tmpfilesdir}/%{name}.conf
 %dir %{_sharedstatedir}/%{name}
 
 %changelog
+* Tue May 12 2026 Jason Rothstein
+- Run as a dedicated user instead of root
+
 * Sat May 09 2026 Jason Rothstein
 - No debug packages for EL10
 
@@ -99,4 +119,3 @@ mkdir -p %{buildroot}%{_sharedstatedir}/%{name}
 
 * Fri May 01 2026 Jason Rothstein
 - Initial package creation for RHEL and Fedora
-
diff --git a/rustdesk-server.sysusers b/rustdesk-server.sysusers
new file mode 100644
index 0000000..91b0361
--- /dev/null
+++ b/rustdesk-server.sysusers
@@ -0,0 +1 @@
+u rustdesk - "RustDesk Server" /var/lib/rustdesk-server /sbin/nologin
\ No newline at end of file
diff --git a/rustdesk-server.tmpfiles b/rustdesk-server.tmpfiles
new file mode 100644
index 0000000..5b2b226
--- /dev/null
+++ b/rustdesk-server.tmpfiles
@@ -0,0 +1 @@
+d /var/lib/rustdesk-server 0750 rustdesk rustdesk - -
\ No newline at end of file