Re: [gentoo-dev] chroot USE flag?

[Matt Rickard <frogger@gentoo.org>]

On 18 Jul 2003 01:15:00 -0400
Brandon Hale <brandon@comp-u-tek.com> wrote:
> I propose a new USE flag for a few key services that would install the
> package in a chroot "out of the box." This idea was inspired by a
> conversation between Greg Fitzgerald (gregf) and myself on applying
> ideas from OpenBSD to Gentoo. Another source of inspiration is the
> excelent pkg_config code in the latest bind9 ebuilds. I further
> discussed this idea w/ memebers of the gentoo-hardened team and
> further crystalized the workings of such a flag. I would propose that
> the ebuild include two conditional install proceedures keyed on the
> chroot USE flag. The only possible problem I forsee is building
> devices inside the sandbox, which could be accomplished in
> pkg_postinstall as a last resort. I would be happy for any feedback or
> further development of this idea.

I think this is a good idea.  A chroot USE flag would allow daemons to
be chrooted transparently without users having to manually ebuild
config.  Chroot building could be done in the sandbox, and as Brandon
mentioned, we could create the device files with pkg_postinst.  These
could be removed with pkg_postrm explicitly.

Eventually I would like to see this USE flag apply to more daemons than
just bind.  I don't know which other packages in portage currently have
chrooting options (anyone help me out here?), but I'd at least like to
see this for ntpd and apache to start.

--
Matt Rickard
frogger@gentoo.org

--
gentoo-dev@gentoo.org mailing list