[nfcd] Run nfcd under nfc user account. Fixes JB#45270

Root privileges are not required, and for a service that accepts
random input (e.g. data from NFC tags) running as root is generally
not a very good idea.

plugins/dbus_neard/org.neard.conf

@@ -1,7 +1,7 @@
 <!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
     "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
 <busconfig>
-    <policy user="root">
+    <policy user="nfc">
         <allow own="org.neard"/>
         <allow send_destination="org.neard"/>
         <allow send_interface="org.neard.NDEFAgent"/>

plugins/dbus_service/org.sailfishos.nfc.daemon.conf

@@ -1,7 +1,7 @@
 <!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
     "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
 <busconfig>
-    <policy user="root">
+    <policy user="nfc">
         <allow own="org.sailfishos.nfc.daemon"/>
     </policy>
     <policy context="default">

plugins/settings/org.sailfishos.nfc.settings.conf

@@ -1,7 +1,7 @@
 <!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
 <busconfig>
-    <policy user="root">
+    <policy user="nfc">
         <allow own="org.sailfishos.nfc.settings"/>
     </policy>
     <policy context="default">

rpm/nfcd.spec

@@ -13,8 +13,11 @@ BuildRequires: pkgconfig(libglibutil) >= 1.0.34
 BuildRequires: pkgconfig(libdbuslogserver-gio) >= 1.0.14
 Requires: libglibutil >= 1.0.34
 Requires: libdbuslogserver-gio >= 1.0.14
-Requires(post): /sbin/ldconfig
-Requires(postun): /sbin/ldconfig
+Requires: systemd
+Requires(pre): systemd
+Requires(post): systemd
+Requires(post): coreutils
+Requires(postun): systemd
 
 %description
 Provides D-Bus interfaces to NFC functionality.
@@ -52,15 +55,21 @@ ln -s ../nfcd.service %{buildroot}/%{target_wants_dir}/nfcd.service
 %check
 make -C unit test
 
+%pre
+systemctl stop nfcd ||:
+
 %post
+chown nfc:nfc %{settings_dir}/* ||:
+chmod 600 %{settings_dir}/* ||:
 systemctl daemon-reload ||:
+systemctl start nfcd ||:
 
 %postun
 systemctl daemon-reload ||:
 
 %files
 %defattr(-,root,root,-)
-%dir %{settings_dir}
+%dir %attr(700,nfc,nfc) %{settings_dir}
 %{_sbindir}/*
 %{_sysconfdir}/dbus-1/system.d/*.conf
 /%{target_wants_dir}/nfcd.service

src/nfcd.service

@@ -6,7 +6,7 @@ After=dbus.service
 [Service]
 Type=dbus
 BusName=org.sailfishos.nfc.daemon
-User=root
+User=nfc
 EnvironmentFile=-/var/lib/environment/nfcd/*.conf
 ExecStart=/usr/sbin/nfcd $NFCD_ARGS
 Restart=always