1 |
Hi, |
2 |
|
3 |
in some environments you have to rename "root" to something else, just |
4 |
to be compliant to a (maybe dumb) security policy. This might be the |
5 |
case for PCI, and as far as I remember, it is necessary (not just |
6 |
"recommended") for a BSI Grundschutz certification (meaning something |
7 |
like "basic security protection") [1]. Unfortunately I didn't find the |
8 |
exact link. |
9 |
This might prevent or make usage of gentoo more complicated in those |
10 |
environments, but is only a problem for a small fraction of our user base. |
11 |
|
12 |
Best regards, |
13 |
|
14 |
Craig |
15 |
|
16 |
|
17 |
[1] |
18 |
https://www.bsi.bund.de/cln_183/ContentBSI/EN/Publications/Bsi_standards/standards.html |
19 |
|
20 |
30.04.2010 20:07, Michał Górny wrote: |
21 |
> Hello, |
22 |
> |
23 |
> I would like to put an emphasis on the fact that many eclasses |
24 |
> and ebuilds in gx86 are relying on an assumption that the superuser |
25 |
> account is always supposed to be named 'root'. |
26 |
> |
27 |
> In fact, no such constraint exists. Although most users will never even |
28 |
> think of changing the superuser account name, it is perfectly legit |
29 |
> to do so, and to use any name for that account. Moreover, it is |
30 |
> perfectly legit to name an unprivileged user 'root' too. |
31 |
> |
32 |
> Thus, the above assumption is clearly incorrect and may result in many |
33 |
> issues with ebuilds using it. These range from builds failing because |
34 |
> of chown 'invalid user' error to packages being installed with |
35 |
> incorrect file ownership. |
36 |
> |
37 |
> From what I've heard already, similar problem has hit Gentoo/*BSD users |
38 |
> already, with superuser group not being named 'root'. Although some |
39 |
> files were fixed to properly use numeric GID in the specific case, |
40 |
> no UID-related changes were done. |
41 |
> |
42 |
> Moreover, not all developers agree with the case being an issue, |
43 |
> and they even refuse patches clearly fixing it [1]. Thus, I guess that |
44 |
> a clear policy regarding referencing the superuser account should be |
45 |
> enforced. |
46 |
> |
47 |
> In my opinion, that policy should clearly indicate that the numeric |
48 |
> UID/GID should be always used for referencing the superuser account |
49 |
> as they are fixed unlike the names. |
50 |
> |
51 |
> [1] http://bugs.gentoo.org/show_bug.cgi?id=315779 |
52 |
> |