DH_SYSUSER(1)

✨ DH_SYSUSER ✨

okay bestie, gather round, because this is dh_sysuser from section 1 of the User Contributed Perl Documentation, and it's literally the moment your package gets its own little system user to run as. slay.

---

🌸 NAME 🌸

dh_sysuser — manage system users required for package operation 💅

---

🦋 SYNOPSIS 🦋

dh_sysuser [debhelper options] [username options] ...

---

👑 DESCRIPTION 👑

so dh_sysuser is the cooler, more chill alternative to the way more popular dh_installsysusers addon. it's a debhelper addon that gives you a simple way to create system users that your package needs to actually function — like, say, running a service with dropped privileges. main character energy for a user account, honestly.

compared to dh_installsysusers, dh_sysuser injects a different dependency that plays nice with alternative init systems, non-linux ports, or systems that don't have init at all (initless, iconic). packages built with dh_sysuser will still work totally fine under systemd — the only tradeoff is one extra dependency (sysuser-helper). ngl, worth it.

🚨 real talk: do NOT use dh_sysuser when the upstream source already ships a sysusers.d conf file that's installed in /usr/lib/sysusers.d/. for those cases, please use dh_installsysusers. no cap.

the actual user creation is delegated to a systemd-sysusers provider, with a fallback to the minsysusers(8) utility for systems where a systemd-sysuser provider just isn't available. we love a backup plan 🫶

• the primary group of the new user is created with the same name as the user. the new user will not be a member of any other group except the primary one. periodt.
• new users get their /etc/shadow password field set to '!', which makes it impossible to log in. bye felicia 🔒
• by default, new users have their shell set to /usr/sbin/nologin. it's still possible to get a new user's shell with su -s though, so don't worry.
• the default home directory is set to /. if you pick a different home, the home directory is created (see below), and its permissions are adjusted according to the SYS_DIR_MODE variable in /etc/adduser.conf. by default, this results in the mode 0755 for the home directory. files from /etc/skel are NOT copied. 🙈

⚠️ WARNING: the data stored in a new user's home directory is world-readable. if you (as package maintainer) need full control over home directory permissions, please file a bug.

• it's possible to override the default setting for the user's home and shell, add a GECOS comment, and set the user's UID. please see sysusers.d(5) format. go off 💜

dh_sysuser looks for a debian/package.minsysusers file, and if one exists, it installs it as /usr/lib/sysusers.d/package.conf. then it adds a postinstall snippet code to make sure the user gets created at package postinstall. the debian/package.minsysusers file is expected to follow the sysusers.d(5) conf file specification. iykyk.

💀 CRUFT OF SYSTEM USERS 💀

creating a system user (or any user, fr) is easy. safely removing one is hard. 😭

former versions of this package used to remove users on purge when the home was set to /nonexistent or was empty. but plot twist: a user may be allowed to write files outside their home, and since UIDs are reusable, that's lowkey a security risk. so with the current version of this package, users are never removed automatically. it is what it is.

---

🎀 EXAMPLES 🎀

with the following debian/package.minsysusers control file, you get respectively:

u     foo     -  "foo user"   /nonexistent      -
g     bar     -
m    baz  gname

• a system user foo with a gecos comment "foo user" and home set to /nonexistent — and the foo group will also be created
• a system group bar
• add gname group as a supplementary group of baz user

three for one, we love to see it ✨

---

🌈 SEE ALSO 🌈

• useradd(8)
• groupadd(8)
• usermod(8)

---

okay that's the whole page, you're officially educated 🎓💖 this was perl v5.40.1, dated 2026-01-16, and that's the tea. go create some users bestie, and remember: the vibe is immutable, the UIDs are not. 🦋