drop permissions.

root/etc/config/minidlna

@@ -1,6 +1,6 @@
 config minidlna config
 	option 'enabled' '0'
-	option user 'root'
+	option user 'nobody'
 	option port '8200'
 	option interface 'eth0,wlan0,p2p0'
 	option friendly_name 'OpenWrt DLNA Server'

root/etc/config/transmission

@@ -2,8 +2,8 @@ config transmission config
 	option enabled 0
 	option config_dir '/tmp/transmission'
 	option config_overwrite '1'
-	option user 'root'
-	option group 'root'
+	option user 'nas'
+	option group 'media_rw'
 	option mem_percentage 20
 	option nice 10
 	option web_home ''

root/etc/group

@@ -7,7 +7,7 @@ audio:x:29:
 www-data:x:33:
 ftp:x:55:
 users:x:100:
-network:x:101:
 nogroup:x:65534:
 dnsmasq:x:453:dnsmasq
-media_rw:x:1023:ftp,admin,root
+media_rw:x:1023:ftp,nas
+inet:x:3003:network,nas,nobody

root/etc/init.d/minidlna

@@ -87,13 +87,14 @@ start() {
 	[ "$enabled" -gt 0 ] || return 1
 
 	minidlna_create_config config || return 1
-	
+
 	config_get db_dir config 'db_dir' '/var/run/minidlna'
 	config_get log_dir config 'log_dir' '/var/log/minidlna'
-	config_get user config 'user' 'root'
+	config_get user config 'user' 'nobody'
 
 	mkdir -m 0755 -p "$db_dir" "$log_dir"
 	chown -R "$user" "$db_dir" "$log_dir"
+	chmod 644 "$MINIDLNA_CONFIG_FILE"
 
 	service_start /usr/bin/minidlna -f "$MINIDLNA_CONFIG_FILE"
 }

root/etc/init.d/transmission

@@ -73,9 +73,18 @@ transmission() {
 	config_file="$config_dir/settings.json"
 	[ -d $config_dir ] || {
 		mkdir -p $config_dir
-		chmod 0755 $config_dir
 		touch $config_file
-		[ -z "$user" ] || chown -R "$user:$group" $config_dir
+	}
+
+	[ -d $download_dir ] || {
+		mkdir -p $download_dir
+	}
+
+	chmod 0755 $config_dir
+	chmod 0755 $download_dir
+	[ -z "$user" ] || {
+		chown -R "$user:$group" $config_dir
+		chown "$user:$group" $download_dir
 	}
 
 	[ "$config_overwrite" == 0 ] || {

root/etc/passwd

@@ -1,7 +1,8 @@
 root:x:0:0:root:/root:/bin/ash
 daemon:*:1:1:daemon:/var:/bin/false
 ftp:*:55:55:ftp:/var/ftp:/bin/false
-network:*:101:101:network:/var:/bin/false
-admin:x:1000:100:WebGUI administrator:/home/admin:/bin/bash
-nobody:*:1023:1023:nobody:/var:/bin/false
 dnsmasq:x:453:453:dnsmasq:/var/run/dnsmasq:/bin/false
+admin:x:1000:100:WebGUI administrator:/home/admin:/bin/bash
+nobody:*:1023:3003:media_rw:/var:/bin/false
+network:*:3003:3003:network:/var:/bin/false
+nas:*:1101:1023:NAS Service:/var:/bin/false

root/etc/shadow

@@ -4,4 +4,5 @@ ftp:*:0:0:99999:7:::
 network:*:0:0:99999:7:::
 nobody:*:0:0:99999:7:::
 dnsmasq:x:0:0:99999:7:::
+nas:*:0:0:99999:7:::
 admin:$1$p6kold1K$NneBQ42bMPpNBPZEC7It9.:16904:0:99999:7:::