Re: [gentoo-alt] prefix-portage as root

[Fabian Groffen]

On 28-02-2008 11:42:01 +0100, Michael Weiser wrote:
> On Wed, Feb 27, 2008 at 06:19:39PM -0600, Jeremy wrote:
>
> >> I'm afraid not, because when installing as user michael dosbin can't
> >> chown a file to root:amanda and chmod it 1750. I'd have to fix
> >> permissions manually all the time.
>
> > Support for serveice scripts or daemons that run as root are not currently
> > supported. See bug #196294 if you would like to contribute. the baselayout
> > version in prefix is really old and needs alot of work.
>
> Since Mac OS X now consistently uses launchd, which is hugely different
> from sysvinit/inetd, I expected and accepted that. I'm looking for
> root-safeness.
>
> I'll have a go this evening at:
>
> - compiling as root and seeing if the resulting permissions are sensible
> - compiling as root and looking into preventing files outside of
>   $EPREFIX being overwritten

Prefix does an "best effort" approach on platforms where sandbox does
not run (almost all, since on Linux it isn't too groovy either).  This
means that if the package does not install anything outside of DESTDIR,
then the files are checked to be installed inside ${EPREFIX}.  I think
everyone with commit access to the tree compiles/installs the packages
as non-root user, meaning that if a package installs outside DESTROOT
they should have catched that by permission denied errors.  That said, I
think the tree is safe in that regard.  I can't tell anything about
other overlays though.

There is a Google Summer of Code idea out to have sandbox be ported to
more OSes, with Darwin one of them.  Maybe someone is interested in
doing that, it would be a great thing to have, IMO.

> I realised that fink doesn't do the second part either, so it's not that
> much of a showstopper if prefix-portage doesn't do it. But it'd sure be
> nice to have.
>
> I also realised that sandbox might be Linux-specific and therefore take
> a lot of effort to port to Mac OS X. A first step might be for emerge to
> refuse placing files outside of $EPREFIX. This wouldn't catch broken
> make install scripts overwriting /bin/bash but would catch broken
> ebuilds compiling for /bin/bash instead of $EPREFIX/bin/bash.

I don't understand how this catches these cases you describe last.  For
that I actually found only one solution: install Prefix on vanilla
FreeBSD.  When I did that I fixed several problems we overlooked where
/bin/bash, or /usr/bin/perl was used.  (FreeBSD doesn't come with
either.)

> How might FEATURES="userpriv" help here, d'you think?

I have no clue.

The biggest problem you're going to run into is that in "root-mode"
(privileged), Prefix will currently act as if it is "unprivileged", so
don't create any users, or chmod to any users other than the running
user itself.
This is a known limitation, that we obviously look for a solution for.
Another Google Summer of Code project?


-- 
Fabian Groffen
Gentoo on a different level
-- 
gentoo-alt@l.g.o mailing list