1 |
On 18 Jul 2003 01:15:00 -0400 |
2 |
Brandon Hale <brandon@××××××××××.com> wrote: |
3 |
> I propose a new USE flag for a few key services that would install the |
4 |
> package in a chroot "out of the box." This idea was inspired by a |
5 |
> conversation between Greg Fitzgerald (gregf) and myself on applying |
6 |
> ideas from OpenBSD to Gentoo. Another source of inspiration is the |
7 |
> excelent pkg_config code in the latest bind9 ebuilds. I further |
8 |
> discussed this idea w/ memebers of the gentoo-hardened team and |
9 |
> further crystalized the workings of such a flag. I would propose that |
10 |
> the ebuild include two conditional install proceedures keyed on the |
11 |
> chroot USE flag. The only possible problem I forsee is building |
12 |
> devices inside the sandbox, which could be accomplished in |
13 |
> pkg_postinstall as a last resort. I would be happy for any feedback or |
14 |
> further development of this idea. |
15 |
|
16 |
I think this is a good idea. A chroot USE flag would allow daemons to |
17 |
be chrooted transparently without users having to manually ebuild |
18 |
config. Chroot building could be done in the sandbox, and as Brandon |
19 |
mentioned, we could create the device files with pkg_postinst. These |
20 |
could be removed with pkg_postrm explicitly. |
21 |
|
22 |
Eventually I would like to see this USE flag apply to more daemons than |
23 |
just bind. I don't know which other packages in portage currently have |
24 |
chrooting options (anyone help me out here?), but I'd at least like to |
25 |
see this for ntpd and apache to start. |
26 |
|
27 |
-- |
28 |
Matt Rickard |
29 |
frogger@g.o |
30 |
|
31 |
-- |
32 |
gentoo-dev@g.o mailing list |