Re: [gentoo-dev] suggestion portage ebuild system file modification rights and protection

[Paul de Vrieze]

On Monday 08 September 2003 04:08, Jan Krueger wrote:
>
> Thats true for many open-source project. Some of them just try to get
> organized more efficiently and succeed in doing so.
> So, maybe there is a more appropriate organization model for gentoo?

As one of the people responsible for the gentoo orginisation I can say that we 
are working on reorganizing gentoo. But gentoo as an organisation with over 
150 developers and even more contributors is not exactly like a speedboat 
that can make sharp turns. It is more like an ocean liner that needs a long 
time to make a turn. Changes will be comming, and we try to implement them as 
fast as possible, but we are talking about changing mindsets and operation of 
people. Such things take time, lots of time. Further most people involved 
with gentoo are doing this voluntarilly. We cannot put all our available time 
into gentoo. We have jobs and other responsibilities too.

>
> I say:
> portage must respect my system inegrity!

There is no 100% safe way for system integrity. The sandbox certainly is not a 
perfect solution. One could use staticly compiled binaries to circumvent them 
or mounts or whatever. If a package wants to do evil portage cannot stop it 
at all. Nor does it aim to, or should it aim to. For those systems that have 
that much security concerns one musth use quaranteening and things like 
selinux or the like together with something like tripwire. Those technologies 
are much better suited to the job than portage which would become 
unmaintainable if it would need to include many tricks and workarounds for 
specific hacks (as there is no universal way to block attacks)

>
> > So we should never be able to tweak config files et al in an ebuild?
>
> an ebuild may freely modify its own config files.
> modification of config files not belonging to the ebuild should be done via
> an already suggested, secure abstraction, lets say a function like:
>  changeconf phph.ini "line to add to phpini"
> portage could then intercept, respecting the suggested CONFIG_EXCLUDE or
> other user settings, or, if no user setting is the way, go to apply the
> change. This way it would be impossible for the ebuild to wipe php.ini.
> Also the user, via CONFIG_EXCLUDE, may completely switch of editing of
> php.ini by ebuilds. On the other hand, if the user doesnt care, the ebuild
> is free to add this line to php.ini.
>

What in those cases where not updating a configuration file (esp. one that is 
not supposed to be edited by humans at all) would result in a bug, or even 
worse a security issue. Yes, I believe that that could happen.

Paul

-- 
Paul de Vrieze
Gentoo Developer
Mail: pauldv@g.o
Homepage: http://www.devrieze.net