[gentoo-dev] GLEP81 and /home

[Michael Orlitzky]

We forbid packages from installing to /home for good reason: for most of
history, users (and their home directories) were outside the purview of
the package manager. But with GLEP81, that's changed: the package
manager is now in charge of creating each system user's home directory
and of giving it the correct permissions and ownership.

Is the policy against installing to /home still consistent?

For example: the mail-filter/amavisd-new daemon needs a user, typically
called "amavis". The daemon also needs a working directory that it can
write to. The obvious choice for a working directory is /var/lib/amavis,
but there's a catch: spamassassin, razor, pyzor, et cetera (which are
all used by amavis) store their configuration in the current user's home
directory, and not in some daemon-specific location. So "amavis" needs a
home directory, because that's where much of the configuration for
amavisd goes.

Where do we put amavis's home directory?

  1 /var/lib/amavis is a bad idea, because it conflicts with the working
    directory (we don't want the two packages to get out of sync, nor do
    we want to keep them in-sync manually).

  2 /var/lib/amavis/home was my next choice, because logically it puts
    the amavisd configuration in a subdirectory of the place where all
    of the other amavis stuff goes, and because it doesn't have the
    same issue that (1) does.

    But there's a problem: if we create /var/lib/amavis/home before
    amavisd-new is installed (as happens when you emerge amavisd-new),
    then /var/lib/amavis winds up root:root and the installation of
    amavisd-new doesn't change that. So now amavisd-new doesn't work,
    because it can't write to its working directory.

    This is a combination of an implementation detail and the fact that
    the PMS doesn't cover directories; but ultimately, it just doesn't
    work reliably.

  3 /home/amavis also seems fine to me, except for the fact that it's a
    QA violation to install there.

Note that we could always set system users' home directories to
/home/whatever. It has only become a QA violation with GLEP81 because
the eclass calls keepdir on the user's home directory.

Should option (3) be viable, or do I go back to the drawing board?