From: Zac Medico <zmedico@gentoo.org>
To: gentoo development <gentoo-dev@lists.gentoo.org>
Subject: [gentoo-dev] RFC: Enable FEATURES="userpriv usersandbox" by default?
Date: Mon, 28 May 2012 14:34:22 -0700 [thread overview]
Message-ID: <4FC3EF5E.90900@gentoo.org> (raw)
Hi,
In case you aren't familiar with FEATURES=userpriv, here's the
description from the make.conf(5) man page:
Allow portage to drop root privileges and compile packages as
portage:portage without a sandbox (unless usersandbox is also used).
The rationale for having the separate "usersandbox" setting, to enable
use of sys-apps/sandbox, is that people who enable userpriv sometimes
prefer to have sandbox disabled in order to slightly improve
performance. However, I would recommend to enable usersandbox by
default, for the purpose of logging sandbox violations.
Note that ebuilds can set RESTRICT="userpriv" if they require superuser
privileges during any of the src_* phases that userpriv affects.
I've been using FEATURES="userpriv usersandbox" for years, and I don't
remember experiencing any problems because of it, so I think that it
would be reasonable to have it enabled by default. Objections?
--
Thanks,
Zac
next reply other threads:[~2012-05-28 21:35 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-05-28 21:34 Zac Medico [this message]
2012-05-28 21:46 ` [gentoo-dev] RFC: Enable FEATURES="userpriv usersandbox" by default? Andreas K. Huettel
2012-05-28 21:52 ` Davide Pesavento
2012-05-28 23:17 ` Michael Weber
2012-05-28 23:56 ` [gentoo-dev] " Duncan
2012-05-29 1:09 ` [gentoo-dev] " Maxim Kammerer
2012-05-29 1:58 ` Rich Freeman
2012-05-29 8:43 ` Agostino Sarubbo
2012-05-29 8:58 ` Richard Yao
2012-05-29 9:05 ` Zac Medico
2012-05-29 14:11 ` Michał Górny
2012-05-29 14:50 ` Rich Freeman
2012-05-29 14:57 ` hasufell
2012-05-29 15:23 ` Rich Freeman
2012-05-29 16:27 ` hasufell
2012-05-29 17:08 ` Jeff Horelick
2012-05-29 19:46 ` Michael Orlitzky
2012-05-29 19:58 ` Mike Gilbert
2012-05-29 20:21 ` Michael Orlitzky
2012-05-29 20:05 ` William Hubbs
2012-05-29 21:47 ` Hilco Wijbenga
2012-05-29 22:11 ` Zac Medico
2012-05-29 23:22 ` Richard Yao
2012-05-30 0:38 ` Zac Medico
2012-05-30 0:59 ` Hilco Wijbenga
2012-05-29 19:44 ` Ralph Sennhauser
2012-05-29 22:09 ` Zac Medico
2012-05-29 20:32 ` Zac Medico
2012-07-02 19:48 ` Pacho Ramos
2012-07-02 20:01 ` Zac Medico
2012-07-02 20:36 ` vivo75
2012-07-02 20:45 ` Zac Medico
2012-07-03 7:18 ` Pacho Ramos
2012-07-03 8:02 ` Michał Górny
2013-07-21 10:53 ` Pacho Ramos
2013-07-21 18:25 ` Zac Medico
2013-07-21 18:30 ` Alex Xu
2013-07-21 18:35 ` Mike Gilbert
2012-07-03 8:11 ` vivo75
2012-07-03 13:50 ` Andreas K. Huettel
2012-07-03 13:55 ` Andreas K. Huettel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4FC3EF5E.90900@gentoo.org \
--to=zmedico@gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox