Public SourceMage Discussion List

[Sukneet Basuta <sukneet AT gmail.com>]

On Tue, Jan 15, 2013 at 3:25 AM, Thomas Orgis <thomas-forum AT orgis.org> wrote:
> There should be. Spool directory needs to be writable by anyone, or at
> least your admin user (verification protects agains local attacks ...
> if the source from spool is moved someplace secure and _then_ checked).
> Build directories, too, but that is trivial. I am not aware of this
> being possible right now, but non-root builds should be part of SMGL,
> though I admit I always have a root shell open ... knowing that one is
> supposed to do as much as normal user as possible.

Changing Dirs isn't a problem. That is already possible (see
/etc/sorcery/local/config for which variables to set).
What I *assume* needs to be done is just pipe the install functions to
sudo or su. However, this will be extremely annoying (assuming you
haven't allowed password-less sudo access) since you'll have to enter
your password everytime before INSTALL. So if you are casting 50
spells, you'll have to enter your password 50 times. Storing your
password would be a security concern, so that's not an option. If we
were to install everything at the end (i.e. create an archive of the
installed files and then do something like resurrect at the end) then
it may be plausible, but then we run into the issue of spells being
cast at the same time of its dependencies.

Of course there are other issues of using tmps, castfs, building some
spells, etc as a non-root user.

Anyway, if you really want to do this and allow password-less sudo
access, it shouldn't be too hard to modify your local sorcery to do
it. Just remember to not update sorcery without a backup of your
modifications first. I've made that mistake a few times.