The geoipupdate service currently unnecessarily runs the command as root. It would be nice to add a dedicated geoipupdate user to the package and switch the service to using it. I currently make these changes locally but it would be nice to have it in the official package.

The package needs to add a geoipupdate system user/group with /var/lib/GeoIP as the home directory and the usual /usr/bin/nologin shell.

Change ownership/permissions of package files (with geoipupdate replaced with the appropriate uid/gid):

chown root:geoipupdate etc/GeoIP.conf
chmod 640 etc/GeoIP.conf
chown geoipupdate:geoipupdate -R var/lib/GeoIP

This allows it to read the configuration file via the geoipupdate group and allows it to write to the GeoIP databases in /var/lib/GeoIP.

The service could have the usual systemd hardening applied but it's not particularly important compared to simply using a dedicated system user/group.