Re: [gentoo-dev] how to handle sensitive files when generating binary packages

[Mike Frysinger]

On Wednesday 20 June 2007, Petteri Räty wrote:
> Mike Frysinger kirjoitti:
> > On Wednesday 20 June 2007, Marius Mauch wrote:
> >> Mike Frysinger <vapier@g.o> wrote:
> >>> mayhaps we need a new function to be run in src_install() to label
> >>> files as "sensitive" ... so baselayout would do:
> >>> esosensitive /etc/{fstab,group,passwd,shadow}
> >>> and then we expand the format of CONTENTS in the vdb:
> >>> priv /etc/fstab <hash> <mtime>
> >>
> >> And what would be phase 2 of that? Just having a new filetype
> >> in CONTENTS doesn't accomplish anything by itself ...
> >
> > updating any tool that creates binary packages from the live $ROOT of
> > course silly billy
> >
> > current behavior:
> > # quickpkg baselayout
> >  * Building package for sys-apps/baselayout-1.12.10-r4
> >  * Packages now in '/usr/portage/pacakges':
> >  * sys-apps/baselayout-1.12.10-r4: 307K
> >
> > proposed new behavior (exact output here is not part of the discussion so
> > dont nit pick it):
> > # quickpkg baselayout
> >  * Building package for sys-apps/baselayout-1.12.10-r4
> >  *  Skipping sensitive file: /etc/passwd
> >  *  Skipping sensitive file: /etc/shadow
> >  *  Skipping sensitive file: /etc/group
> >  * Packages now in '/usr/portage/pacakges':
> >  * sys-apps/baselayout-1.12.10-r4: 307K
> > # quickpkg --iamsensitive baselayout
> >  * Building package for sys-apps/baselayout-1.12.10-r4
> >  *  Including sensitive file: /etc/passwd
> >  *  Including sensitive file: /etc/shadow
> >  *  Including sensitive file: /etc/group
> >  * Packages now in '/usr/portage/pacakges':
> >  * sys-apps/baselayout-1.12.10-r4: 307K
>
> It would probably be prudent to have pristine versions of the files
> installed on the system (optional) so that you can actually create
> binary packages with all the files.

being able to generate binary packages that actually reflect the live $ROOT is 
desirable
-mike