| 1 |
On 07/21/2013 03:53 AM, Pacho Ramos wrote: |
| 2 |
> El mar, 03-07-2012 a las 10:02 +0200, Michał Górny escribió: |
| 3 |
>> On Mon, 02 Jul 2012 13:45:26 -0700 |
| 4 |
>> Zac Medico <zmedico@g.o> wrote: |
| 5 |
>> |
| 6 |
>>> On 07/02/2012 01:36 PM, vivo75@×××××.com wrote: |
| 7 |
>>>> Il 02/07/2012 22:01, Zac Medico ha scritto: |
| 8 |
>>>>> On 07/02/2012 12:48 PM, Pacho Ramos wrote: |
| 9 |
>>>>>> El lun, 28-05-2012 a las 14:34 -0700, Zac Medico escribió: |
| 10 |
>>>>>>> Hi, |
| 11 |
>>>>>>> |
| 12 |
>>>>>>> In case you aren't familiar with FEATURES=userpriv, here's the |
| 13 |
>>>>>>> description from the make.conf(5) man page: |
| 14 |
>>>>>>> |
| 15 |
>>>>>>> Allow portage to drop root privileges and compile packages as |
| 16 |
>>>>>>> portage:portage without a sandbox (unless usersandbox is also |
| 17 |
>>>>>>> used). |
| 18 |
>>>>>>> |
| 19 |
>>>>>>> The rationale for having the separate "usersandbox" setting, to |
| 20 |
>>>>>>> enable use of sys-apps/sandbox, is that people who enable |
| 21 |
>>>>>>> userpriv sometimes prefer to have sandbox disabled in order to |
| 22 |
>>>>>>> slightly improve performance. However, I would recommend to |
| 23 |
>>>>>>> enable usersandbox by default, for the purpose of logging |
| 24 |
>>>>>>> sandbox violations. |
| 25 |
>>>>>>> |
| 26 |
>>>>>>> Note that ebuilds can set RESTRICT="userpriv" if they require |
| 27 |
>>>>>>> superuser privileges during any of the src_* phases that |
| 28 |
>>>>>>> userpriv affects. |
| 29 |
>>>>>>> |
| 30 |
>>>>>>> I've been using FEATURES="userpriv usersandbox" for years, and I |
| 31 |
>>>>>>> don't remember experiencing any problems because of it, so I |
| 32 |
>>>>>>> think that it would be reasonable to have it enabled by default. |
| 33 |
>>>>>>> Objections? |
| 34 |
>>>>>> Looks like non important problems arised and, then, these could |
| 35 |
>>>>>> probably be enabled by default, no? :) |
| 36 |
>>>>> I'm not sure about the best way to handle migration for directories |
| 37 |
>>>>> inside $DISTDIR that are used by live ebuilds, since src_unpack |
| 38 |
>>>>> will run with different privileges when userpriv is enabled. |
| 39 |
>>>> tell the user to chown/remove the files/directories if and when |
| 40 |
>>>> needed, |
| 41 |
>>> |
| 42 |
>>> How should we tell them? Elog message, news item, or both? |
| 43 |
>> |
| 44 |
>> I think this deserves a news item anyway. |
| 45 |
>> |
| 46 |
>>>> unless there is a very good reason (try) to automate it. |
| 47 |
>>> |
| 48 |
>>> I guess something like this might work in pkg_postinst of the portage |
| 49 |
>>> ebuild: |
| 50 |
>>> |
| 51 |
>>> find "$DISTDIR" -maxdepth 1 -type d -uid 0 | xargs chown -R |
| 52 |
>>> portage:portage |
| 53 |
>> |
| 54 |
>> find "$DISTDIR" -maxdepth 1 -type d -uid 0 -exec \ |
| 55 |
>> chown -R portage:portage {} + |
| 56 |
>> |
| 57 |
>>> I would only trigger something like this once, when upgrading from a |
| 58 |
>>> version that doesn't have userpriv enabled by default. |
| 59 |
>> |
| 60 |
>> This will work only for users who actually keep those in DISTDIR. Some |
| 61 |
>> of them actually redefine E*_STORE_DIR to a more sane location. But |
| 62 |
>> that's probably irrelevant. |
| 63 |
>> |
| 64 |
> |
| 65 |
> Then, is there any other blocker? (apart of the needing of add a news |
| 66 |
> item) |
| 67 |
> |
| 68 |
> Thanks :) |
| 69 |
> |
| 70 |
|
| 71 |
I can't think of anything else. I've filed this bug: |
| 72 |
|
| 73 |
https://bugs.gentoo.org/show_bug.cgi?id=477664 |
| 74 |
|
| 75 |
-- |
| 76 |
Thanks, |
| 77 |
Zac |
Archives