Re: [gentoo-dev] Of death and prerm

[Michał Górny]

W dniu śro, 30.08.2017 o godzinie 09∶15 -0400, użytkownik Michael
Orlitzky napisał:
> On 08/30/2017 05:25 AM, Michał Górny wrote:
> >
> > This package does not belong in Gentoo. We do packaging, not some ugly
> > malware that prevents users from uninstalling itself. Every package must
> > be uninstallable. Even if it destroys my system, developers have no
> > right to prevent valid uninstall action from proceeding.
> >
>
> So you're saying I should have it "sleep 2983702947523704" in prerm?
>
> =)
>
> I've been working on the user packages GLEP that I started and then
> forgot about sometime at the beginning of the year. I'm trying to finish
> up the reference implementation.
>
> When it comes to removing users, everyone's suggestions were along the
> same lines:
>
>   1a. If you try to uninstall a user package, it should die(), because
>       calling userdel can be a security risk if the user still owns
>       files.
>
>   1b. Same as 1a, with an I_KNOW_WHAT_I_AM_DOING override.
>
>   2. We can scan the file system to see if the user owns anything, and
>      if he doesn't, call userdel. If he does, warn the user, and die().
>
>   3. During upgrades, the existing user will be left in place. But If a
>      user package tries to switch it's UID in a new version, check to
>      make sure that the old UID doesn't own any files, maybe die(), etc.
>
>
> But all of them involve being able to die() out of a removal action.
> It's not refusing to uninstall the system user -- that's already the
> status quo -- it's just refusing to remove the /package/ given that we
> can't actually remove the system user. Trying to keep the system and the
> PM in agreement (with an override).
>
> Anyway, I was trying to implement (1b), so that's how I found myself
> asking this question. Since I'm providing an I_KNOW_WHAT_IM_DOING
> override, you still have the ability to shoot yourself in the foot, but
> for all of this to work I'd still need a way to stop an uninstallation.

For a start, I should point out that -- unless I'm mistaken -- there is
no guarantee that Portage will remove packages dependency-wise. That is,
your 'user package' may actually be removed before packages that
requested the user being created, and which installed files owned by
that user.

That put aside, I think the 'usual Gentoo way' of solving the problem
you're hitting is to actually print an ewarn that the 'user has not been
removed because...' with explicit instructions how to remove it after
fixing the cause.

-- 
Best regards,
Michał Górny