Re: [gentoo-dev] how to handle sensitive files when generating binary packages

[Mike Frysinger <vapier@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 1473 bytes --]

On Wednesday 20 June 2007, Marius Mauch wrote:
> Mike Frysinger <vapier@gentoo.org> wrote:
> > mayhaps we need a new function to be run in src_install() to label
> > files as "sensitive" ... so baselayout would do:
> > esosensitive /etc/{fstab,group,passwd,shadow}
> > and then we expand the format of CONTENTS in the vdb:
> > priv /etc/fstab <hash> <mtime>
>
> And what would be phase 2 of that? Just having a new filetype
> in CONTENTS doesn't accomplish anything by itself ...

updating any tool that creates binary packages from the live $ROOT of course 
silly billy

current behavior:
# quickpkg baselayout
 * Building package for sys-apps/baselayout-1.12.10-r4
 * Packages now in '/usr/portage/pacakges':
 * sys-apps/baselayout-1.12.10-r4: 307K

proposed new behavior (exact output here is not part of the discussion so dont 
nit pick it):
# quickpkg baselayout
 * Building package for sys-apps/baselayout-1.12.10-r4
 *  Skipping sensitive file: /etc/passwd
 *  Skipping sensitive file: /etc/shadow
 *  Skipping sensitive file: /etc/group
 * Packages now in '/usr/portage/pacakges':
 * sys-apps/baselayout-1.12.10-r4: 307K
# quickpkg --iamsensitive baselayout
 * Building package for sys-apps/baselayout-1.12.10-r4
 *  Including sensitive file: /etc/passwd
 *  Including sensitive file: /etc/shadow
 *  Including sensitive file: /etc/group
 * Packages now in '/usr/portage/pacakges':
 * sys-apps/baselayout-1.12.10-r4: 307K
-mike

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 827 bytes --]