1 |
On Tue, May 28, 2019 at 02:21:23AM -0400, Mike Gilbert wrote: |
2 |
> On Tue, May 28, 2019 at 1:41 AM Robin H. Johnson <robbat2@g.o> wrote: |
3 |
> > |
4 |
> > On Mon, May 27, 2019 at 08:44:09PM -0400, Mike Gilbert wrote: |
5 |
> > > On Mon, May 27, 2019 at 11:45 AM William Hubbs <williamh@g.o> wrote: |
6 |
> > > > |
7 |
> > > > If a package hard codes the UID or GID when adding a user or group to |
8 |
> > > > the system and that UID/GID already exists, we should abort rather than |
9 |
> > > > changing the UID/GID. |
10 |
> > > These functions have behaved this way for a long time. |
11 |
> > Yes, I recall this breakage being raised even prior to GLEP27. |
12 |
> > |
13 |
> > Some coverage of prior work firstly. |
14 |
> > 2003/May: eid_database [1] |
15 |
> > 2004/May: GLEP27 [2] |
16 |
> > 2006/Summer: GSOC Project for GLEP27 implementation [3] |
17 |
> > Later: Creandus [4][5] |
18 |
> > |
19 |
> > [1] https://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-src/eid_database/ |
20 |
> > [2] https://www.gentoo.org/glep/glep-0027.html |
21 |
> > [3] https://github.com/creandus/creandus.github.com/blob/master/glep27-proposal.txt |
22 |
> > [4] https://github.com/creandus/ |
23 |
> > [5] http://creandus.github.io/ |
24 |
> > |
25 |
> > > What problem are you trying to solve here? |
26 |
> > Specifically: |
27 |
> > 1. Package A is emerged, and the ebuild specifies enewuser/enewgroup |
28 |
> > with -1 as the numeric input, and some user or group is created with |
29 |
> > value X. |
30 |
> > 2. Package B is emerged, and the ebuild specifies enewuser/enewgroup |
31 |
> > with a fixed UID/GID value Y && explicitly depends on having that |
32 |
> > specific value. |
33 |
> |
34 |
> Could you provide some examples of packages that require a specific |
35 |
> numeric UID/GID to function properly? That seems like a significant |
36 |
> design flaw. |
37 |
|
38 |
The example I specifically found was kubernetes security contexts -- to |
39 |
set one of these up, you need numeric uids/gids [1]. |
40 |
|
41 |
[1] https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ |
42 |
|
43 |
I agree this could be possibly seen as a flaw, but I don't know enough |
44 |
about kubernetes to know if symbolic uids/gids could be used. |
45 |
|
46 |
I am speculating here, but I'm guessing that if the pod spans |
47 |
multiple hosts, the uids/gids might need to be the same, which would |
48 |
require fixed UIDs/GIDs. |
49 |
|
50 |
> |
51 |
> > I'd like to accept WilliamH's patch as-is, and then add an additional |
52 |
> > patch that moves the range of dynamically allocated users such that it |
53 |
> > does not conflict. |
54 |
> |
55 |
> The "dynamic range" currently defaults to 101 to 999 as defined by |
56 |
> SYS_{UID,GID}_{MIN,MAX} in /etc/login.defs. It is quite likely that |
57 |
> live production systems have ids scattered throughout this range. |
58 |
> Changing enewuser/enewgroup to fail if there are "conflicts" may make |
59 |
> some ebuilds unusable on said systems. |
60 |
|
61 |
Another part of this I want to do is audit all of the packages |
62 |
requesting fixed UIDS/GIDS; they may not need to be doing so. |
63 |
|
64 |
> |
65 |
> As mgorny suggests, I suspect the static UID/GID that is sometimes |
66 |
> passed to enewuser/enewgroup is more of a preference/suggestion than a |
67 |
> requirement. |
68 |
> |
69 |
> I do not believe William's patch should be merged without some very |
70 |
> good reason for the change in behavior. |
71 |
|
72 |
Consider this situation: |
73 |
|
74 |
in package-a.ebuild: |
75 |
enewuser usera 300 ... |
76 |
enewgroup groupa 300 ... |
77 |
|
78 |
in package-b.ebuild: |
79 |
enewuser userb 300 ... |
80 |
enewgroup groupb 300 ... |
81 |
|
82 |
Ok, cool, if I need a security context for package b, the uid/gid is 300 |
83 |
correct? Yes, unless package a gets installed on some host where package |
84 |
b is without me knowing about it. |
85 |
|
86 |
I see no way around this other than to make uids/gids fixed when |
87 |
packages request specific ones. |
88 |
|
89 |
|
90 |
William |