Re: [gentoo-dev] Non-root emerges

[Ed Grimm]

On Thu, 30 Sep 2004, Chris L. Mason wrote:

> Hi all,
>
> I've checked the documentation and man pages and couldn't find what I
> was looking for.  If I've missed something, please point me in the
> right direction.
>
> I've been trying to figure out if it is possible to have all emerges
> (especially the builds) to be done as a non-root user, and have the
> process call sudo (or similar) only for the final merge.  All
> downloading, unpacking, compiling and installing to the fake target
> should be doable without root permissions.  So, you'd just need to be
> in the portage group, and be configured in sudo.
>
...
>
> This is desirable both for security reasons and just to avoid
> accidentally trashing the system because of a broken build script, for
> example.

Illusion of security only.  If someone competent wanted to attack your
system, they would not do it in the build script; they'd do it in the
resulting code.  As such, this methodology only protects against broken
build scripts.

For those that don't understand the concept, which would you think a
cracker would more likely want: one time access to your system, or
access to your system forever, whenver they wanted?

We may find out about some malicious code updates through such
protections, but that's generally due to the cracker not knowing how to
code properly.  The crackers who *do* know how to code will pass right
through your checks if you're depending upon such mechanisms to detect
them.  (Admittedly, I've only heard of one decent cracker who dared Open
Source.)  I would really prefer we find out about all the malicious
updates through code review and patch signature verification (this does,
of course, include the preference for finding out about all of them.).

Admittedly, build scripts tend to not get quite as much review as code
people realize is going to continue running on their systems, and I have
seen one or two packages that tried to install root kits in configure.
(They, incidentally, did not pass the signature verification check.  But
I was curious.)

Ed

--
gentoo-dev@g.o mailing list