Gentoo Archives: gentoo-dev

From: Gregory Woodbury <redwolfe@×××××.com>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] Requirements for UID/GID management
Date: Fri, 27 Jan 2017 19:45:46
Message-Id: CAJoOjx_YUmJOH-3UWcbw5eibM0BEspkB5+baTbgavcQEusXbXw@mail.gmail.com
In Reply to: Re: [gentoo-dev] Requirements for UID/GID management by Rich Freeman
1 On Fri, Jan 27, 2017 at 1:52 PM, Rich Freeman <rich0@g.o> wrote:
2
3 > On Fri, Jan 27, 2017 at 12:54 PM, Michael Orlitzky <mjo@g.o> wrote:
4 > >
5 > > You don't really have to care what UID/GID is assigned, because each
6 > > user/group will only be created once and referenced by name (as $PN). By
7 > > default, we could pick the first available UID in most packages.
8 >
9 > I might be not following correctly, but due to how filesystems/etc
10 > work it is probably desirable to have consistent UID/GIDs as much as
11 > reasonably possible. Things like NFS, chroots, containers, and so on
12 > can be a bit simpler if these are consistent, because they involve one
13 > system having visibility into a filesystem hosted on another, and
14 > usually in these cases the UID/GID is what is kept constant, not the
15 > name. (IMO UID/GID namespace is one of those areas where
16 > Linux/POSIX/etc has some weaknesses.)
17 >
18 > This doesn't really seem like a problem though. Just have a table
19 > somewhere (wiki?) to track who is using what UID/GID and encode those
20 > defaults into the ebuild that creates those users.--
21 >
22
23 There should be a division of the system managed UID space:
24 1) constant/consistent UID/GID for major things (portage, etc.)
25 2) variable space for per package groups/users that generally don't care
26 about consistency
27
28 A quick look at /etc/passwd shows that many of the system UIDs are
29 under 250 (portage) and a few scattered above 400. GIDs are similar,
30 though some are "fixed" and some are assigned going down from 999.
31
32 Some eclasses may need to be scrutinized for what behavior they are using.
33
34 --
35 G.Wolfe Woodbury
36 redwolfe@×××××.com