From: Michael Orlitzky <mjo@gentoo.org>
To: gentoo-dev@lists.gentoo.org
Subject: Re: [gentoo-dev] GLEP81 and /home
Date: Sun, 19 Jan 2020 14:27:23 -0500 [thread overview]
Message-ID: <21efee36-dcc8-bb14-9fb9-0d6b2abf8c8d@gentoo.org> (raw)
In-Reply-To: <CAGfcS_m286yG2hS-_G56WjeN8kFkmsGgVFv78ynr0FEF+j0XtQ@mail.gmail.com>
On 1/19/20 2:02 PM, Rich Freeman wrote:
>
>> If you're sharing /home, you also have to be sharing user accounts,
>> unless you want everyone to be assigned a random set of files.
>
> I imagine that most people setting up something like this would only
> be sharing high-value UIDs (>1000 in our case). There is no need for
> postfix on your Gentoo box and postfix on your Debian box to have the
> same UID. You wouldn't be sshing from postfix on the one to postfix
> on the other and expecting to have the same home directory contents.
>
You can't do that. If you're going to mount files from one system onto
another system, using only an integer <--> username mapping as your
access control mechanism, then you'd better be damn sure that those
integers and usernames match on all systems. Otherwise I might wind up
sharing /home/mjo to rich0 because the "mjo" and "rich0" groups both
have gid 1000 locally.
> Since it is a local account, not in /home, then it would be a separate
> user even if the UID is the same (or otherwise). You'd set up amavis
> on each mail server. They might be running different distros. They
> would be using local users.
>
> Don't get me wrong, it would be cleaner if POSIX users had a scope the
> way that an OS like Windows does it, but it isn't a big deal if you
> use high-numbered UIDs for shared users, and low-numbered UIDs for
> local users.
It's a huge deal. Random users/groups can access your files if the
databases don't agree. The local/remote user distinction does not exist.
>> Everything is fine here, this all works and has worked for 20 years.
>
> Sure, it works fine if you have a single host, or do nothing to share
> your home directories, which I imagine is what 95% of Gentoo users do.
> I doubt most Gentoo users even encrypt /home, even though this has
> been standard for most of those 20 years on just about every major
> distro out there.
>
> If a user wants to put this stuff in /home we should certainly support
> that, and it would work fine if the user sets up the account properly
> before installing the package. They might get a QA warning, but that
> is the user's concern.
We've talked this to death. Barring any new evidence, /home still seems
like the best place for these, and I don't want to put them in the wrong
spot (forcing users to migrate) just to appease a QA warning from before
GLEP81 was a thing.
next prev parent reply other threads:[~2020-01-19 19:27 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-18 17:51 [gentoo-dev] GLEP81 and /home Michael Orlitzky
2020-01-18 18:10 ` Ulrich Mueller
2020-01-18 23:38 ` Michael Orlitzky
2020-01-19 0:21 ` Rich Freeman
2020-01-19 2:50 ` Michael Orlitzky
2020-01-19 11:29 ` Rich Freeman
2020-01-19 15:49 ` Michael Orlitzky
2020-01-19 17:42 ` Rich Freeman
2020-01-19 18:37 ` Michael Orlitzky
2020-01-19 19:02 ` Rich Freeman
2020-01-19 19:27 ` Michael Orlitzky [this message]
2020-01-19 19:47 ` Rich Freeman
2020-01-19 21:00 ` Michael Orlitzky
2020-01-19 22:09 ` Michael Orlitzky
2020-01-20 1:20 ` Rich Freeman
2020-01-20 1:51 ` Michael Orlitzky
2020-01-20 2:52 ` Rich Freeman
2020-01-20 3:16 ` Michael Orlitzky
2020-01-20 3:40 ` Rich Freeman
2020-01-20 3:57 ` Michael Orlitzky
2020-01-19 19:37 ` Robin H. Johnson
2020-01-19 19:19 ` Alec Warner
2020-01-19 19:28 ` Michael Orlitzky
2020-01-19 19:32 ` Alec Warner
2020-01-19 20:44 ` Michael Orlitzky
2020-01-18 19:03 ` Alec Warner
2020-01-18 20:16 ` Michael Orlitzky
2020-01-18 19:08 ` Michał Górny
2020-01-18 19:44 ` Michael Orlitzky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=21efee36-dcc8-bb14-9fb9-0d6b2abf8c8d@gentoo.org \
--to=mjo@gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox