agl-session: remove agl-driver user from applaunchd group

Previously agl-driver user was part of applaunchd group for D-Bus activation
to work woth the correct access rights. Now that D-Bus activation has been
removed from applaunchd, agl-driver user no longer needs to be in the same
group with applaunchd.

Bug-AGL: SPEC-4801

Change-Id: Ia473b391432d8c797cd38c0841f7fe655dcdb8e6
Signed-off-by: Denys Dmytriyenko <denys@konsulko.com>
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/28930
Reviewed-by: Scott Murray <scott.murray@konsulko.com>
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
Tested-by: Jenkins Job builder account
ci-image-build: Jenkins Job builder account
ci-image-boot-test: Jenkins Job builder account

diff --git a/meta-app-framework/recipes-config/agl-session/agl-session_0.1.bb b/meta-app-framework/recipes-config/agl-session/agl-session_0.1.bb
index 067f2a6..de31f99 100644 (file)
--- a/meta-app-framework/recipes-config/agl-session/agl-session_0.1.bb
+++ b/meta-app-framework/recipes-config/agl-session/agl-session_0.1.bb
@@ -19,10 +19,9 @@ GROUPADD_PARAM:${PN} = "\
        -g 1001 agl-driver ; \
        -g 1003 applaunchd ; \
 "
-# agl-driver user needs to be part of applaunchd group for D-Bus activation to still work
-# should be removed after everything is converted to gRPC for enhanced security
+
 USERADD_PARAM:${PN} = "\
-  -g 1001 -u 1001 -G video,display,pipewire,applaunchd -o -d /home/agl-driver -m -K PASS_MAX_DAYS=-1 agl-driver ; \
+  -g 1001 -u 1001 -G video,display,pipewire -o -d /home/agl-driver -m -K PASS_MAX_DAYS=-1 agl-driver ; \
   -g 1003 -u 1003 -o -d / -K PASS_MAX_DAYS=-1 applaunchd ; \
 "