Add the _syspatch user/group: an unprivileged user for syspatch(8) used to fetch

and verify patches.
discussed with deraadt@ rpe@
ok deraadt@

src/etc/group

@@ -76,6 +76,7 @@ _vmd:*:107:
 _tftp_proxy:*:108:
 _ftp_proxy:*:109:
 _sndiop:*:110:
+_syspatch:*:112:
 dialer:*:117:
 nogroup:*:32766:
 nobody:*:32767:

src/etc/mail/aliases

@@ -1,5 +1,5 @@
 #
-#	$OpenBSD: aliases,v 1.62 2016/12/27 12:41:40 jca Exp $
+#	$OpenBSD: aliases,v 1.63 2017/01/19 06:48:50 ajacoutot Exp $
 #
 #  Aliases in this file will NOT be expanded in the header from
 #  Mail, but WILL be visible over networks or from /usr/libexec/mail.local.
@@ -77,6 +77,7 @@ nobody:	/dev/null
 _tftp_proxy: /dev/null
 _ftp_proxy: /dev/null
 _sndiop: /dev/null
+_syspatch: /dev/null
 sshd:   /dev/null
 
 # Well-known aliases -- these should be filled in!

src/etc/master.passwd

@@ -59,4 +59,5 @@ _vmd:*:107:107::0:0:VM Daemon:/var/empty:/sbin/nologin
 _tftp_proxy:*:108:108::0:0:tftp proxy daemon:/nonexistent:/sbin/nologin
 _ftp_proxy:*:109:109::0:0:ftp proxy daemon:/nonexistent:/sbin/nologin
 _sndiop:*:110:110::0:0:sndio privileged user:/var/empty:/sbin/nologin
+_syspatch:*:112:112::0:0:syspatch unprivileged user:/var/empty:/sbin/nologin
 nobody:*:32767:32767::0:0:Unprivileged user:/nonexistent:/sbin/nologin