run auditd under his own separate user, not root

debian/ai-auditd.init

@@ -18,6 +18,7 @@ DAEMON=/usr/sbin/$NAME
 DAEMON_ARGS=""
 PIDFILE=/var/run/$NAME.pid
 SCRIPTNAME=/etc/init.d/$NAME
+USER=ai-auditd
 
 # Exit if the package is not installed
 [ -x "$DAEMON" ] || exit 0
@@ -42,9 +43,9 @@ do_start()
 	#   0 if daemon has been started
 	#   1 if daemon was already running
 	#   2 if daemon could not be started
-	start-stop-daemon --start --quiet --background --make-pidfile --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+	start-stop-daemon --start --quiet --background --make-pidfile --pidfile $PIDFILE --chuid $USER --exec $DAEMON --test > /dev/null \
 		|| return 1
-	start-stop-daemon --start --quiet --background --make-pidfile --pidfile $PIDFILE --exec $DAEMON -- \
+	start-stop-daemon --start --quiet --background --make-pidfile --pidfile $PIDFILE --chuid $USER --exec $DAEMON -- \
 		$DAEMON_ARGS \
 		|| return 2
 	# Add code here, if necessary, that waits for the process to be ready
@@ -62,7 +63,7 @@ do_stop()
 	#   1 if daemon was already stopped
 	#   2 if daemon could not be stopped
 	#   other if a failure occurred
-	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --user $USER --name $NAME
 	RETVAL="$?"
 	[ "$RETVAL" = 2 ] && return 2
 	# Wait for children to finish too if this is a daemon that forks
@@ -71,8 +72,8 @@ do_stop()
 	# that waits for the process to drop all resources that could be
 	# needed by services started subsequently.  A last resort is to
 	# sleep for some time.
-	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
-	[ "$?" = 2 ] && return 2
+	#start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
+	#[ "$?" = 2 ] && return 2
 	# Many daemons don't delete their pidfiles when they exit.
 	rm -f $PIDFILE
 	return "$RETVAL"

debian/ai-auditd.postinst

+#!/bin/sh
+# postinstall script for ai-audit.
+
+case "$1" in
+configure)
+
+        if ! getent user ai-auditd >/dev/null; then
+        	adduser --system --home /var/lib/auditd --no-create-home \
+			--disabled-password ai-auditd
+	fi
+
+	mkdir -p /var/lib/auditd
+	chown -R ai-auditd:root /var/lib/auditd
+        chmod 0700 /var/lib/auditd
+
+	;;
+abort-upgrade|abort-remove|abort-deconfigure)
+	;;
+*)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+

debian/localauditd.postinst

@@ -10,7 +10,7 @@ configure)
 
         if ! getent user localaudit >/dev/null; then
 		adduser --system --home /var/spool/audit --no-create-home \
-			--ingroup audit localaudit
+			--disabled-password --ingroup audit localaudit
 	fi
 
 	mkdir -p /var/spool/audit/incoming