Re: [gentoo-dev] Creating multiple "installations" on the same host

[Paul de Vrieze]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wednesday 24 March 2004 15:44, Paul Smith wrote:
> This isn't what I'm looking for, actually.  I want to be able to build
> an install area with complete freedom from my "real" desktop.  I want
> to build with completely different versions of all sorts of tools than
> the ones on my "real" system, without having to install them on my
> real system.

This is exactly what chroot does. There is not really a way to avoid it 
either as there are many packages which rely on certain locations for 
certain files. In many cases it is possible to say those files exist in 
$ROOT but then it would not work if that root would become the real 
root.

> Then, if people wanted a 100% divorced install they could set
> BUILDROOT==ROOT==something besides "/".  As a result, nothing on the
> "real" system (well, except for things like sh and python to run the
> Portage tools themselves--which is OK) would be used.
>
> This is how we use Portage actually: we first create a "host" image
> which contains all the build tools (cross compilers, build system,
> Portage itself, etc.)  Then we use that "host" image to generate the
> other images.  In this way the entire environment can be created with
> no special privileges or access, and without impacting the contents of
> the "real" system at all.
>
>
> The other change I would like to see is a way to avoid the requirement
> for root access.  These extra "images" I'm creating don't need to be
> installed as root, because I'm creating them in my own area.  Not only
> that, but if there's a personal BUILDROOT then even _THAT_ doesn't
> require root access; it could also be an image I've built myself.

We need root access for being able to give packages the right 
permissions. There might possibly be a way around it for creating binary 
packages, but that would probably require either some LD_PRELOAD magic 
(like sandbox) or custom kernel modules to record the owners of files.

What you might try is user mode linux. What I understand from it it is 
possible to run it as a normal user.

> In that past when dealing with permissions I've had good results using
> an idea taken from UNIX's sticky bit: instead of requiring the user to
> configure some account you just use the owner of the upper directory
> and apply that to the contents.  In this situation, we would find the
> owner of the ROOT and/or BUILDROOT directories and use that as the
> required owner instead of hardcoding "root" in Portage.  Obviously a
> little bit of logic has to enter in here: if the owner of either ROOT
> or BUILDROOT is root then you must be root; if the owner of neither of
> them is root then they must be the same.  Another safety measure might
> be that if either was "/", then you have to be root (just in case
> someone accidentally chowns their "/" directory).  For example.

Some files in the apache package are owned by the apache user. There are 
many other packages with non-default owned files. That is essential for 
the security, and it is not possible without big changes to those 
ebuilds to actually use them when install is not performed as root.

> I'm willing to supply patches for these things if it seems like
> something people are interested in.

Before you do, try to build a full system with what you have. I think you 
will meet many of the above problems.

Paul

- -- 
Paul de Vrieze
Gentoo Developer
Mail: pauldv@g.o
Homepage: http://www.devrieze.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAYaU/bKx5DBjWFdsRAmchAJ9IdqJJQkcNDIlTNUvih6S4wYJoqQCdE5UY
wgC+FwTUU0hqopG1jIQujlw=
=Z3dY
-----END PGP SIGNATURE-----

--
gentoo-dev@g.o mailing list