| 1 |
On 18 Jul 2003 01:15:00 -0400 |
| 2 |
Brandon Hale <brandon@××××××××××.com> wrote: |
| 3 |
> I propose a new USE flag for a few key services that would install the |
| 4 |
> package in a chroot "out of the box." This idea was inspired by a |
| 5 |
> conversation between Greg Fitzgerald (gregf) and myself on applying |
| 6 |
> ideas from OpenBSD to Gentoo. Another source of inspiration is the |
| 7 |
> excelent pkg_config code in the latest bind9 ebuilds. I further |
| 8 |
> discussed this idea w/ memebers of the gentoo-hardened team and |
| 9 |
> further crystalized the workings of such a flag. I would propose that |
| 10 |
> the ebuild include two conditional install proceedures keyed on the |
| 11 |
> chroot USE flag. The only possible problem I forsee is building |
| 12 |
> devices inside the sandbox, which could be accomplished in |
| 13 |
> pkg_postinstall as a last resort. I would be happy for any feedback or |
| 14 |
> further development of this idea. |
| 15 |
|
| 16 |
I think this is a good idea. A chroot USE flag would allow daemons to |
| 17 |
be chrooted transparently without users having to manually ebuild |
| 18 |
config. Chroot building could be done in the sandbox, and as Brandon |
| 19 |
mentioned, we could create the device files with pkg_postinst. These |
| 20 |
could be removed with pkg_postrm explicitly. |
| 21 |
|
| 22 |
Eventually I would like to see this USE flag apply to more daemons than |
| 23 |
just bind. I don't know which other packages in portage currently have |
| 24 |
chrooting options (anyone help me out here?), but I'd at least like to |
| 25 |
see this for ntpd and apache to start. |
| 26 |
|
| 27 |
-- |
| 28 |
Matt Rickard |
| 29 |
frogger@g.o |
| 30 |
|
| 31 |
-- |
| 32 |
gentoo-dev@g.o mailing list |
Archives