Add cros-disks user to disk, chronos-access groups.
-'disk' group is required to access block devices, and loop devices
(for testing).
-'chronos-access' group is required for cros-disks to mount files under
/home/chronos/u-<hash>/{Downloads, GCache}.
Even though this does give the cros-disks user more power, the
comparison should be made against cros-disks running as root,
which already has access to these /dev nodes.
BUG=chromium:726036
TEST=Build image, check /etc/group.
TEST=security_AccountsBaseline passes on minnie.
TEST=With CL:563738:
TEST=Run platform_CrosDisks* tests.
CQ-DEPEND=CL:571951
Change-Id: I136cf4494bd89ed87c431858bf82d795f25f4e7b
Reviewed-on: https://chromium-review.googlesource.com/571280
Commit-Ready: Jorge Lucangeli Obes <jorgelo@chromium.org>
Tested-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
diff --git a/profiles/base/accounts/group/chronos-access b/profiles/base/accounts/group/chronos-access
index 3733b7d..993975f 100644
--- a/profiles/base/accounts/group/chronos-access
+++ b/profiles/base/accounts/group/chronos-access
@@ -5,4 +5,4 @@
# to access files/directories owned by chronos.
# This includes all users accessing opencryptoki database files and all users
# we run FUSE-based filesystem daemons as.
-users:root,ipsec,chronos,ntfs-3g,avfs,fuse-exfat,chaps,imageloaderd
+users:root,ipsec,chronos,ntfs-3g,avfs,fuse-exfat,chaps,cros-disks,imageloaderd
diff --git a/profiles/base/accounts/group/disk b/profiles/base/accounts/group/disk
index 813756f..bce16ee 100644
--- a/profiles/base/accounts/group/disk
+++ b/profiles/base/accounts/group/disk
@@ -1,3 +1,3 @@
group:disk
gid:6
-users:root,adm
+users:root,adm,cros-disks
