public inbox for gentoo-dev@lists.gentoo.org
 help / color / mirror / Atom feed
From: Michael Orlitzky <mjo@gentoo.org>
To: gentoo-dev@lists.gentoo.org
Subject: Re: [gentoo-dev] GLEP81 and /home
Date: Sun, 19 Jan 2020 14:27:23 -0500	[thread overview]
Message-ID: <21efee36-dcc8-bb14-9fb9-0d6b2abf8c8d@gentoo.org> (raw)
In-Reply-To: <CAGfcS_m286yG2hS-_G56WjeN8kFkmsGgVFv78ynr0FEF+j0XtQ@mail.gmail.com>

On 1/19/20 2:02 PM, Rich Freeman wrote:
> 
>> If you're sharing /home, you also have to be sharing user accounts,
>> unless you want everyone to be assigned a random set of files.
> 
> I imagine that most people setting up something like this would only
> be sharing high-value UIDs (>1000 in our case).  There is no need for
> postfix on your Gentoo box and postfix on your Debian box to have the
> same UID.  You wouldn't be sshing from postfix on the one to postfix
> on the other and expecting to have the same home directory contents.
> 

You can't do that. If you're going to mount files from one system onto
another system, using only an integer <--> username mapping as your
access control mechanism, then you'd better be damn sure that those
integers and usernames match on all systems. Otherwise I might wind up
sharing /home/mjo to rich0 because the "mjo" and "rich0" groups both
have gid 1000 locally.


> Since it is a local account, not in /home, then it would be a separate
> user even if the UID is the same (or otherwise).  You'd set up amavis
> on each mail server.  They might be running different distros.  They
> would be using local users.
> 
> Don't get me wrong, it would be cleaner if POSIX users had a scope the
> way that an OS like Windows does it, but it isn't a big deal if you
> use high-numbered UIDs for shared users, and low-numbered UIDs for
> local users.

It's a huge deal. Random users/groups can access your files if the
databases don't agree. The local/remote user distinction does not exist.


>> Everything is fine here, this all works and has worked for 20 years.
> 
> Sure, it works fine if you have a single host, or do nothing to share
> your home directories, which I imagine is what 95% of Gentoo users do.
> I doubt most Gentoo users even encrypt /home, even though this has
> been standard for most of those 20 years on just about every major
> distro out there.
> 
> If a user wants to put this stuff in /home we should certainly support
> that, and it would work fine if the user sets up the account properly
> before installing the package.  They might get a QA warning, but that
> is the user's concern.

We've talked this to death. Barring any new evidence, /home still seems
like the best place for these, and I don't want to put them in the wrong
spot (forcing users to migrate) just to appease a QA warning from before
GLEP81 was a thing.


  reply	other threads:[~2020-01-19 19:27 UTC|newest]

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-18 17:51 [gentoo-dev] GLEP81 and /home Michael Orlitzky
2020-01-18 18:10 ` Ulrich Mueller
2020-01-18 23:38   ` Michael Orlitzky
2020-01-19  0:21     ` Rich Freeman
2020-01-19  2:50       ` Michael Orlitzky
2020-01-19 11:29         ` Rich Freeman
2020-01-19 15:49           ` Michael Orlitzky
2020-01-19 17:42             ` Rich Freeman
2020-01-19 18:37               ` Michael Orlitzky
2020-01-19 19:02                 ` Rich Freeman
2020-01-19 19:27                   ` Michael Orlitzky [this message]
2020-01-19 19:47                     ` Rich Freeman
2020-01-19 21:00                       ` Michael Orlitzky
2020-01-19 22:09                         ` Michael Orlitzky
2020-01-20  1:20                         ` Rich Freeman
2020-01-20  1:51                           ` Michael Orlitzky
2020-01-20  2:52                             ` Rich Freeman
2020-01-20  3:16                               ` Michael Orlitzky
2020-01-20  3:40                                 ` Rich Freeman
2020-01-20  3:57                                   ` Michael Orlitzky
2020-01-19 19:37             ` Robin H. Johnson
2020-01-19 19:19         ` Alec Warner
2020-01-19 19:28           ` Michael Orlitzky
2020-01-19 19:32             ` Alec Warner
2020-01-19 20:44               ` Michael Orlitzky
2020-01-18 19:03 ` Alec Warner
2020-01-18 20:16   ` Michael Orlitzky
2020-01-18 19:08 ` Michał Górny
2020-01-18 19:44   ` Michael Orlitzky

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=21efee36-dcc8-bb14-9fb9-0d6b2abf8c8d@gentoo.org \
    --to=mjo@gentoo.org \
    --cc=gentoo-dev@lists.gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox