Gentoo Archives: gentoo-dev

From: Michael Orlitzky <mjo@g.o>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] [PATCH 0/2] allow acct-user home directories in /home
Date: Mon, 20 Jan 2020 23:07:18
In Reply to: Re: [gentoo-dev] [PATCH 0/2] allow acct-user home directories in /home by Alec Warner
1 On 1/20/20 5:08 PM, Alec Warner wrote:
2 >
3 > So I can describe in detail one example, but its not running Gentoo; so
4 > I'm not sure if you care in practice.
6 Yes, I'm happy to see a real example.
9 > At work we had sec=krb5 NFS v3 mounted home directories. They were
10 > mounted in /home (via the automounter.) So if these machines ran Gentoo
11 > and you went to do something like "create /home/amavisd" it would fail
12 > because the root user doesn't have the ability to make home directories
13 > in /home (uid=0 is mapped to nobody, who doesn't have +w on /home.) All
14 > home directories were created by a business application and there were
15 > specific hosts where root was not squashed (and we used sec=sys instead
16 > of krb5) and so root on the admin host would have +w on /home and not be
17 > squashed to nobody.)
18 >
19 > In practice in that enterprise environment, if we needed something like
20 > /home/web/ (which I think did exist at one point) we would create a role
21 > account in LDAP (www-data is a common user for example), assign it a
22 > uid, create the homedirectory (/home/web) and it would be owned by
23 > www-data:www-data. Then we would configure the web front ends to use
24 > www-data instead of the normal user (apache or nginx or whatever.)
26 That's all relatively normal. As I've said, a human uses the "amavis"
27 account. Yes, the install of acct-user/amavis would crash because it
28 can't create the home directory, but I contend that crashing is the best
29 thing to do.
31 When the acct-user ebuild crashes, you get to ask yourself if you want
32 his home directory to be shared among the people with authority to
33 release spam from the quarantine. I'm betting you would, and that you
34 would therefore add the account to LDAP and start over. Same deal as
35 apache/web, and you don't have to involve an overlay to do the right
36 thing. In this case, the fact that we used /home was a boon, because it
37 helped you accomplish what you were trying to accomplish by sharing
38 /home in the first place.
40 If you don't want to share the home directory... well, no harm done.
41 You'll have to override the ebuild to tell it what location to use as an
42 alternative. But I think this case is somewhat less likely, and the base
43 rate was already single digits.
45 If only good exceptions are made (with home directories that people
46 would actually want to share under /home), this approach does a little
47 good and no bad.
51 > (2) I don't think most people running Gentoo are running these
52 > environments, which is why you don't see many practical objections on
53 > the list. I think it's reasonable to avoid service account homedirs in
54 > /home not because of fancy examples like above (that maybe 10 companies
55 > in the world run) and instead just focus on this idea that "system stuff
56 > doesn't go in /home." Its somewhat arbitrary as mgorny points out
57 > earlier in the thread.
59 I was never discounting these sorts of environments. On the contrary,
60 the point I'm trying to make above appeared somewhere in the discussion
61 with rich0, but it's hard to articulate without details.
63 If it's arbitrary and we admit that, I'm fine with it. I'm moving on
64 with my life. QA can choose what kind of sauce users get on their turd
65 sandwich =P


Subject Author
Re: [gentoo-dev] [PATCH 0/2] allow acct-user home directories in /home "Robin H. Johnson" <robbat2@g.o>