How to choose system user ID for custom packages (RedHat & compatible)?

Question

How should I choose the proper uid (or gid) for system users being created in a custom .rpm package?

The user will be used to run a daemon non-root.

I think it's not acceptabe to let adduser choose the next ID by omitting --uid because this could create a conflict with fixed uids of official packages. Further, this could lead to different IDs across multiple systems, making further administration harder.

Are there ranges of unused and unreserved uids that can be used (as far as they're not reused in the local environment)? Is there a algorithm to generate a uid/gid?

This question applies to RedHat EL 6+, CentOS 6+ and Fedora. The package's .srpm or .spec should get published.

Answer 1

The RHEL6 migration guide documents that there's a list for statically-assigned UIDs in /usr/share/doc/setup-*/uidgid, which currently goes up to roughly 200, and dynamic system users count downwards from 499.

I read that as "use adduser -r in this case and certainly don't worry if you stay above 300; you won't collide unless you have hundreds of system users".

Answer 2

Letting adduser choose a user ID is the right way to do it. This won't conflict with official packages because automatically-assigned UIDs and statically-assigned UIDs are in different ranges. Yes, this does lead to different user IDs across systems; there's no easy way to do that because you'd have to tell the whole world (every system administrator and package writer) “don't use this user ID, it's mine”.

Specifically, use adduser -r so that the user will be created in the range reserved for automatically-assigned system accounts. This way, the UID will not conflict with other dynamically-allocated UIDs (because adduser picks one that doesn't already exist) nor with statically-allocated UIDs or UIDs of flesh-and-blood users (because they're in different ranges).

For more information, see the Fedora packaging guide.