Run as a dedicated user instead of root

hbbr.service

@@ -4,10 +4,19 @@ After=network.target
 
 [Service]
 Type=simple
+User=rustdesk
+Group=rustdesk
 WorkingDirectory=/var/lib/rustdesk-server
 ExecStart=/usr/bin/hbbr
-Restart=always
+Restart=on-failure
 RestartSec=10
 
+# Security Hardening
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/rustdesk-server
+
 [Install]
 WantedBy=multi-user.target

hbbs.service

@@ -4,10 +4,19 @@ After=network.target
 
 [Service]
 Type=simple
+User=rustdesk
+Group=rustdesk
 WorkingDirectory=/var/lib/rustdesk-server
 ExecStart=/usr/bin/hbbs
-Restart=always
+Restart=on-failure
 RestartSec=10
 
+# Security Hardening
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/rustdesk-server
+
 [Install]
 WantedBy=multi-user.target

rustdesk-server.spec

@@ -11,7 +11,7 @@
 
 Name:           rustdesk-server
 Version:        1.1.15
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        RustDesk Server Program
 
 License:        AGPL-3.0-only
@@ -22,6 +22,8 @@ Source2:        hbbs.xml
 Source3:        hbbr.xml
 Source4:        hbbs.service
 Source5:        hbbr.service
+Source6:        rustdesk-server.sysusers
+Source7:        rustdesk-server.tmpfiles
 
 BuildRequires:  cargo
 BuildRequires:  rust
@@ -33,6 +35,7 @@ BuildRequires:  openssl-devel
 BuildRequires:  systemd-rpm-macros
 Requires:       firewalld-filesystem
 %{?systemd_requires}
+%sysusers_requires
 
 %description
 RustDesk Server Program. Includes the hbbs (RustDesk ID/Rendezvous server)
@@ -68,8 +71,20 @@ install -m 0644 %{SOURCE5} %{buildroot}%{_unitdir}/hbbr.service
 # Create working directory for keys/database
 mkdir -p %{buildroot}%{_sharedstatedir}/%{name}
 
+# Create sysusers.d config
+mkdir -p %{buildroot}%{_sysusersdir}
+install -m 0644 %{SOURCE6} %{buildroot}%{_sysusersdir}/%{name}.conf
+
+# Create tmpfiles.d config
+mkdir -p %{buildroot}%{_tmpfilesdir}
+install -m 0644 %{SOURCE7} %{buildroot}%{_tmpfilesdir}/%{name}.conf
+
+%pre
+%sysusers_create_compat %{name}.conf
+
 %post
 %systemd_post hbbs.service hbbr.service
+systemd-tmpfiles --create %{name}.conf || :
 
 %preun
 %systemd_preun hbbs.service hbbr.service
@@ -85,9 +100,14 @@ mkdir -p %{buildroot}%{_sharedstatedir}/%{name}
 %{_prefix}/lib/firewalld/services/hbbr.xml
 %{_unitdir}/hbbs.service
 %{_unitdir}/hbbr.service
+%{_sysusersdir}/%{name}.conf
+%{_tmpfilesdir}/%{name}.conf
 %dir %{_sharedstatedir}/%{name}
 
 %changelog
+* Tue May 12 2026 Jason Rothstein
+- Run as a dedicated user instead of root
+
 * Sat May 09 2026 Jason Rothstein
 - No debug packages for EL10
 
@@ -99,4 +119,3 @@ mkdir -p %{buildroot}%{_sharedstatedir}/%{name}
 
 * Fri May 01 2026 Jason Rothstein
 - Initial package creation for RHEL and Fedora
-

rustdesk-server.sysusers

@@ -0,0 +1 @@
+u rustdesk - "RustDesk Server" /var/lib/rustdesk-server /sbin/nologin

rustdesk-server.tmpfiles

@@ -0,0 +1 @@
+d /var/lib/rustdesk-server 0750 rustdesk rustdesk - -