Gentoo Archives: gentoo-dev

From: Bruno <bonbons67@××××××××.lu>
To: gentoo-dev@l.g.o
Cc: ciaran.mccreesh@××××××××××.com, Alon Bar-Lev <alonbl@g.o>, Mike Frysinger <vapier@g.o>
Subject: Re: [gentoo-dev] [SECURITY] Minimizing the suid usage
Date: Thu, 01 Jan 2009 12:23:33
Message-Id: 20090101132327.5ccc0413@neptune.home
In Reply to: Re: [gentoo-dev] [SECURITY] Minimizing the suid usage by Ciaran McCreesh
1 On Tue, 05 August 2008 Ciaran McCreesh wrote:
2 > On Tue, 5 Aug 2008 10:51:09 +0200 Bruno Prémont wrote:
3 > > Has any progress happened since March for adding support for
4 > > FILE_CAPABILITIES?
5 >
6 > Well, Alon still hasn't backed up his claim that Portage supports
7 > capabilities... Fairly important to establish that before anything
8 > else...
9 >
10 In case the package manager has trouble with attributes (or the target
11 filesystem does not support them) a way to keep the system running
12 would be to apply the capabilities during src_install and have the
13 eclass check during pkg_postinst, eventually retrying and finally
14 falling back to suid at that point.
15 Even binpkg would be handled that way.
16
17 For this to work the eclass would have to remember the list of files
18 from src_install until pkg_postinst so that it can do all the work once
19 again (with a single call from the ebuild).
20
21 Bruno