Add the rma_fw_keeper user/group and suzy-q group
Will be used for running sandboxed cr50-verify-ro.sh in debugd
The group suzy-q will be granted SuzyQ access in CL:1347531. I
created the group suzy-q and add the user chronos in it because
currently chronos has SuzyQ access, and I don't want to just revoke
it from chronos in case that could possibly break something.
BUG=b:113893821
TEST=patch the M72 branch, build Chrome OS image, and check
/etc/passwd and /etc/group
(tested together with CL:1366677)
Change-Id: I7ff92aff0df7bf0ba9fa16c669c59be459c74cc2
Reviewed-on: https://chromium-review.googlesource.com/1347552
Commit-Ready: Wei-Cheng Xiao <garryxiao@chromium.org>
Tested-by: Wei-Cheng Xiao <garryxiao@chromium.org>
Reviewed-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
(cherry picked from commit 04c752dbd04fb2845b5a47b6729101339704e3e9)
Reviewed-on: https://chromium-review.googlesource.com/c/1366660
Reviewed-by: Wei-Cheng Xiao <garryxiao@chromium.org>
Commit-Queue: Wei-Cheng Xiao <garryxiao@chromium.org>
diff --git a/profiles/base/accounts/group/rma_fw_keeper b/profiles/base/accounts/group/rma_fw_keeper
new file mode 100644
index 0000000..0432b86
--- /dev/null
+++ b/profiles/base/accounts/group/rma_fw_keeper
@@ -0,0 +1,3 @@
+group:rma_fw_keeper
+gid:20124
+users:rma_fw_keeper
diff --git a/profiles/base/accounts/group/suzy-q b/profiles/base/accounts/group/suzy-q
new file mode 100644
index 0000000..c41c968
--- /dev/null
+++ b/profiles/base/accounts/group/suzy-q
@@ -0,0 +1,3 @@
+group:suzy-q
+gid:415
+users:chronos,rma_fw_keeper
diff --git a/profiles/base/accounts/user/rma_fw_keeper b/profiles/base/accounts/user/rma_fw_keeper
new file mode 100644
index 0000000..ebd7856
--- /dev/null
+++ b/profiles/base/accounts/user/rma_fw_keeper
@@ -0,0 +1,6 @@
+user:rma_fw_keeper
+uid:20124
+gid:20124
+gecos:RMA'ed device FW keeper. verify_ro in crosh runs as this user.
+home:/dev/null
+shell:/bin/false
