I'm working on improving the packaging for BackupPC, one of the issues is that it uses a lot of non-standard permission to prevent user access to potentially sensitive content.

Currently, for the web interface to work the apache user needs to be added to the backuppc group so that /etc/BackupPC/apache.users can be read for the password protected login.

Would it be a good idea to do this in %pre/post?

usermod -a -G backuppc apache

Or perhaps use setfacl?

There's several steps the end user has to do but I'd like to automate as much as possible.

Thanks,
Richard