Public SourceMage Discussion List

[Javier Vasquez <j.e.vasquez.v AT gmail.com>]

On Tue, Jan 15, 2013 at 2:25 AM, Thomas Orgis <thomas-forum AT orgis.org> wrote:
> Am Mon, 14 Jan 2013 19:23:38 -0600
> schrieb Javier Vasquez <j.e.vasquez.v AT gmail.com>:
>
>> Is there a way to configure things so that sudo is used instead of su,
>> and only when really installing stuff, but not when downloading and
>> verifying gpgs and checksums, and compiling?
>
> There should be. Spool directory needs to be writable by anyone, or at
> least your admin user (verification protects agains local attacks ...
> if the source from spool is moved someplace secure and _then_ checked).
> Build directories, too, but that is trivial. I am not aware of this
> being possible right now, but non-root builds should be part of SMGL,
> though I admit I always have a root shell open ... knowing that one is
> supposed to do as much as normal user as possible.
>
> Hey, here we got a feature request to change something in Source Mage,
> right after dkowis' statement of stagnation! Now if only someone found
> the time to implement :-/
>
>
> Alrighty then,
>
> Thomas


Hmm, there's no support for it yet then.

I'll file a feature request...

Here it's an idea:

--------------------------
All areas where source mage stuff writes, like /var/spool, /usr/src,
/var/log, /etc/sorcery, etc, should be owned by root:<group>, where
group might be "sorcery" or "sourcemage" (wheel is too common, it's
safer to use a source mage particular one), and they should have write
permisions for such group recursively.  Then any user member of
<group> can write those areas, and there's no need for sudo to write
in such areas.

<group> still should have an entry in /etc/sudoers still, so that
there's no password required in order to run any commands, and this is
required for install phase, chroot,  castfs stuff, etc.  Well, if
wanted, password might be required, but attention must be paid on
every cast, or other command requiring sudo access then...

Cast prepends automatically everything associated to install phase,
chroot, and castfs stuff with sudo.  Notice, of course only members of
<group> will be able to get the install phase done.

Sorcery and similar commands, might not require everything to be
prepended with sudo, since everything should be writeable by members
of <group>, just some applications requiring it, which should be taken
care by the sudoers entry.
--------------------------

There might be other ways of course, just providing what comes to my mind, :-)

Any ways, I'll file the feature request then...

Thanks,

Javier.