Re: [gentoo-dev] suggestion portage ebuild system file modification rights and protection

[Jon Portnoy]

On Mon, Sep 08, 2003 at 01:32:45AM +0000, Jan Krueger wrote:
> On Sunday 07 September 2003 20:35, Jon Portnoy wrote:
> > What, that any situation involving installing software is going to have
> > security holes? That's the nature of software installation.
>
> The gift of portage is a new quality of automated software installation
> system, easy to use, never seen before. This is good.
>
> However by being a full automated software installation system portage has a
> very high responsibilty for the integrity of the system it is run on.
>
> The discussion should have shown you, that the current portage can not bear
> this responsibility.
>
> This thread showed and will continue to show:
> ebuilds can overwrite any system file
> ebuilds can wipe your box
> ebuilds are affecting system integrity
> ebuilds lack quality
>
> Some of you think this can be addressed by:
> qa
> signing ebuilds and files
>
> I say:
> this is not sufficient.

You haven't explained why it's not sufficient.

>
> Again examples from the actual tree, so you can try yourself:
> 1. emerge ezmlm and emerge ezmlm-idx
> providing slightly different funtionality they will overwrite each other
> (instead of blocking each other)
>

Bug. Is it filed?

> 2. emerge heartbeat (sys-cluster/heartbeat-1.0.3-r1, marked x86, so considered
> stable)
> If your emerge was successfull (it will be as long as you dont have snmp
> installed), try to get it running! You wont! Then take a look at
> bugs.gentoo.org since when important fixes are available.
>
> This two examples clearly show what the current qa is worth. (Well i respect
> it very much, but its not perfect and never will be, thats qa, qa you for
> sure know from other software/hardware products you use and used before, you
> know the deficencies of qa then)
> I am pretty sure you can post examples from the tree yourself.

So we don't have enough manpower. I know that. The problem is finding 
good developers, people who're trustworthy and have a history of good 
contributions without a history of conflict.

>
> And to me its clear why it is like that (at least on reason):
> If you compare the number of ebuilds to the number of CVS committers than you
> will see, that it is impossible for each CVS-commiter to make a valuable
> statement of the quality of the software and/or ebuild he/she is going to
> commit. There are to many ebuilds.
>
> (i see this as an organizational deficiency of gentoo)
> So it is probable that faulty ebuilds hit the tree. They are there actually.
>
> Conclusion for me:
> I expect faulty ebuilds. they are there.  (you will never wipe them out until
> you change the organization of gentoo development to a more apropriate model,
> and even then, you can only reduce the amount of faulty ebuilds. ebuilds are
> software, software has bugs.)
>
> and therefore:
> i hold portage responsible to protect my system from faulty ebuilds as much as
> it can.
> if not portage, who else? there is just me left, but then, i dont need
> portage.
>
> I made several suggestions how portage can be improved to protect the system
> it is run on.
> -prevent ebuilds from modifying the life filesystem


So basically you're saying portage shouldn't install software.

> -allow the actual package install process only to add files to the filesystem
> or to only modify/remove files that belong to an revision of the same ebuild
> (qa would benefit from this suggestions too.)

So we should never be able to tweak config files et al in an ebuild?

> This would result in:
> -enforced package integrity
> -wiping my box from within the ebuild is no longer possible
> Please implement the suggestions.

What suggestions? As far as I can see, you haven't really suggested 
anything useful. I, on the other hand, have repeatedly told you how we 
can prevent these problems with solutions like GPG signing. You say 
that's not enough - and go on to make no real suggestions other than 
"this should be fixed!"

Try being specific.

>
> Do you understand me?

If you start getting patronizing with me, I'm going to apply an 
excellent patch that'll fix the entire issue - the procmailrc sort. I 
don't have time or patience for it.

>
> If still not, i will remind you of former times, when bootblock virii have
> been very successfull. Why do you think they have been successfull and are no
> longer?
> Answer: Because it was possible to modify the bootblock.
>
> It is possible for an ebuild to wipe your box.
>
> So doesnt this scare you now?
>
> Jan

No. It's also possible for a truck full of propane to run into 
my house. That doesn't encourage me to put up a concrete wall all around 
my house.

-- 
Jon Portnoy
avenj/irc.freenode.net

--
gentoo-dev@g.o mailing list