[gentoo-dev] Re: Guidelines for dangerous USE flags

[Duncan]

Sven Vermeulen posted on Tue, 22 Aug 2017 17:37:51 +0000 as excerpted:

> On Tue, Aug 22, 2017 at 01:22:51PM -0400, Michael Orlitzky wrote:
>> The net-analyzer/nrpe package has a ./configure flag:
>>
>> --enable-command-args   allows clients to specify command arguments.
>>                         *** THIS IS A SECURITY RISK! ***
>>                         Read the SECURITY file before
>>                         using this option!
>>
>> Back in nrpe-2.x, it was available via USE=command-args, but I dropped
>> it from nrpe-3.x, and a user just asked about it (bug 628596). There
>> are at least two things we could do with a dangerous flag like that:
>>
>>   1) require EXTRA_ECONF to enable it.
>>   2) hide it behind a masked USE flag.
>>
>> Both options require about the same amount of work from the user,
>> namely editing something under /etc/portage. What do y'all think is the
>> best way to proceed? Are there other examples in the tree I could
>> follow?
>
> I like the masked USE flag approach. Using EXTRA_ECONF requires a bit
> more work from the user (not much though) but is less visible afterwards
> in my opinion.
>
> Perhaps a name that implies that there is a security risk could be
> interesting, but that's a minor suggestion.

IDR which package it was on, but I remember investigating a USE flag 
called GAPING_SECURITY_HOLE or some such, on some package at some point.  
Turned out it was pretty much just that, but someone needed the feature 
it controlled on their firewalled LAN, and this flag is what the 
maintainer came up with as a solution.

> Is there a way we could somehow ensure that a USE flag is never set
> globally, but only on a per-package basis?

The only mechanism I'm aware of for that, a hack but arguably an 
effective one, is including the package name in the USE flag.

Combining all three suggestions, masked USE flag including the name of 
the package and a warning such as GAPING_SECURITY_HOLE (the ALL CAPS 
helps distinguish it too, since most USE flags are lowercase) in the 
name, say as ...

nrpe-command-args-SECURITY-HOLE
or just
nrpe-GAPING-SECURITY-HOLE

... seems to me the most effective.  Anyone that would even *think* to 
enable something like that without doing some *serious* investigation 
first, arguably shouldn't be using gentoo in the first place.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman