Re: [gentoo-dev] Re: portage reliance on GNU objcopy ownership perseverance behavior in strip

[Fangrui Song]

On 2021-02-09, Michael Orlitzky wrote:
>On Tue, 2021-02-09 at 17:53 -0800, Fāng-ruì Sòng wrote:
>> (I replied via https://groups.google.com/g/linux.gentoo.dev/c/WG-OLQe3yng
>> "Reply all" (which only replied to the list AFAICT) but I did not
>> subscribe to gentoo-dev via the official
>> https://www.gentoo.org/get-involved/mailing-lists/ so my reply is
>> missing)
>>
>
>Apologies for hijacking your post with a tangential question, but you
>reminded me to ask: how did you notice this problem? Ultimately all
>system executables (in $PATH) should be owned by (and writable only by)
>root anyway; otherwise you get silly security vulnerabilities like "cat
>~/virus > /usr/bin/foo" as a regular user.
>

Context: both `strip a` and `llvm-strip a` create a temporary file.
`strip a` does additional chown(2) (instead of fchown!) with a long list
of hardening-style checks. Due to how the code is organized, passing a
file description around can be difficult for binutils.

Jian Cai reported the problem that `sudo llvm-strip a` does not restore
the original filename. I played with `strip a` and `strip a -o b` a bit
and noticed that chown(2) is only called in these cases:

* (under root) strip a
* (under root) strip a -o a

not in these cases:

* strip a -o b
* strip a -o ./a

---

 From my side, I want llvm-objcopy/llvm-strip to have simple and consistent rules,
smaller platform differences. Why does strip need to behave differently
with or without root permission, when the target file has one hard link
or more, on Linux than on other OSes?

The driven reason is that distributions require such `strip a` behavior.
Arch Linux has moved away. If Gentoo Linux can move away, llvm-objcopy
can keep its current simpler behavior.

---

I think Arch Linux did this:

```
fakeroot
# create an executable owned by bin
strip exe    # still owned by bin
tar cf package.tar exe  # record the owner 
exit

tar xf package.tar -C somewhere
```