Precedence: list
MIME-Version: 1.0
In-Reply-To: <20150528081840.44ec3532@ncopa-desktop.alpinelinux.org>
References: <CA+T2pCFTMLEuZjsYCbXVK7GEG3v0S9EvP5FkbboS+mKRK9_0yA@mail.gmail.com>
	<20150528081840.44ec3532@ncopa-desktop.alpinelinux.org>
Date: Fri, 29 May 2015 01:49:17 -0500
Message-ID: <CA+T2pCErvhyDQSvrtTV4z1NA3+91XaBhyY-R_hcMiAR92PJ3Ow@mail.gmail.com>
Subject: [alpine-devel] Re: installing build deps as non-root (WAS: 3.3 proposal: reduce
 number of SUID binaries as much as possible)
From: William Pitcock <nenolod@dereferenced.org>
To: Natanael Copa <ncopa@alpinelinux.org>
Cc: alpine-devel@lists.alpinelinux.org
Content-Type: text/plain; charset=UTF-8

On Thu, May 28, 2015 at 1:18 AM, Natanael Copa <ncopa@alpinelinux.org> wrote:
> On Tue, 26 May 2015 04:32:01 -0500
> William Pitcock <nenolod@dereferenced.org> wrote:
>
>> Hello,
>>
>> I would like to see a general reduction of SUID binaries where
>> possible.  For example, a lot of APKBUILDs have options=suid when
>> there's probably no real reason for it.
>
> This reminds me of a problem I have been thinking of.
>
> When creating/maintaining package we need temporary install the build
> time dependencies and when build is done we need uninstall them.
>
> Is there a good way to do this without relying on suid? And we
> definitively don't want run the entire build as root.
>
> We probably want build the packages in a chroot too in the future.
> Doing chroot(2) also requires root permission.
>
> We currently have a magic group 'abuild'. If you are in this group you
> are allowed to install packages. This means, you are effectively root
> if you are in this group. Are there better ways to do it?
>
> We could maybe tighten it up and forbid --allow-untrusted. Then you
> need both be in the group and install the signing key in /etc/apk/keys

Ideally, I think what we should do is perhaps use lightweight
containers for build environments.  And then what you do is bind-mount
the aports tree(s) in the right places in the container.  Then you do
the build as root inside the container instead of bother with
fakeroot, cowdancer, etc.

I'm going to probably be busy with this FOSS raid monitoring stuff
this summer so I probably won't have much time to pursue this, but
it's just an idea of how it could work.

William


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---