[gentoo-dev] [PATCH 0/9] eclass: Use UID 0 instead of root and other fixes

[gentoo-dev] [PATCH 0/9] eclass: Use UID 0 instead of root and other fixes

[Ulrich Müller]

This series of patches addresses eclasses using the "root" user name
to check for superuser privileges. Using UID or GID 0 will work in
more situations (e.g. when the superuser isn't named root).

Additionally, change string comparison to arithmetic comparision for
testing EUID. Introduce an additional sanity check preventing lockout
of the superuser in acct-user.eclass.

Bug: https://bugs.gentoo.org/595908

Haelwenn (lanodan) Monnier (1):
  fcaps.eclass: Use UID 0 instead of root

Ulrich Müller (8):
  cron.eclass: Use UID 0 instead of root
  qmail.eclass: Use UID 0 instead of root
  toolchain.eclass: Use UID 0 instead of root
  webapp.eclass: Use UID 0 instead of root
  fcaps.eclass: Use arithmetic test for UID
  user.eclass: Use arithmetic test for UID
  acct-user.eclass: Use arithmetic test for EUID
  acct-user.eclass: Refuse to lock out the superuser

 eclass/acct-user.eclass | 17 +++++++++++------
 eclass/cron.eclass      | 12 ++++++------
 eclass/fcaps.eclass     |  6 +++---
 eclass/qmail.eclass     | 12 ++++++------
 eclass/toolchain.eclass |  2 +-
 eclass/user.eclass      |  4 ++--
 eclass/webapp.eclass    |  4 ++--
 7 files changed, 31 insertions(+), 26 deletions(-)

-- 
2.35.1

[gentoo-dev] [PATCH 1/9] fcaps.eclass: Use UID 0 instead of root

[Ulrich Müller]

From: Haelwenn (lanodan) Monnier <contact@hacktivis.me>

Bug: https://bugs.gentoo.org/595908
Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 eclass/fcaps.eclass | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/eclass/fcaps.eclass b/eclass/fcaps.eclass
index 93aa7cd5928d..8ed27429c938 100644
--- a/eclass/fcaps.eclass
+++ b/eclass/fcaps.eclass
@@ -83,7 +83,7 @@ esac
 #
 # If the system is unable to set capabilities, it will use the specified user,
 # group, and mode (presumably to make the binary set*id).  The defaults there
-# are root:0 and 4711.  Otherwise, the ownership and permissions will be
+# are 0:0 and 4711.  Otherwise, the ownership and permissions will be
 # unchanged.
 fcaps() {
 	debug-print-function ${FUNCNAME} "$@"
@@ -94,7 +94,7 @@ fcaps() {
 	fi
 
 	# Process the user options first.
-	local owner='root'
+	local owner='0'
 	local group='0'
 	local mode='4711'
 	local caps_mode='711'
-- 
2.35.1

[gentoo-dev] [PATCH 2/9] cron.eclass: Use UID 0 instead of root

[Ulrich Müller]

Bug: https://bugs.gentoo.org/595908
Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 eclass/cron.eclass | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/eclass/cron.eclass b/eclass/cron.eclass
index 81f963a4f722..3198c181f21b 100644
--- a/eclass/cron.eclass
+++ b/eclass/cron.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: cron.eclass
@@ -44,12 +44,12 @@ done
 #	Both arguments are optional.  Everything after 'dir' is considered
 #   the permissions (same format as insopts).
 #
-# ex: docrondir /some/dir -m 0770 -o root -g cron
+# ex: docrondir /some/dir -m 0770 -o 0 -g cron
 #     docrondir /some/dir (uses default perms)
 #     docrondir -m0700 (uses default dir)
 docrondir() {
 	# defaults
-	local perms="-m0750 -o root -g cron" dir="/var/spool/cron/crontabs"
+	local perms="-m0750 -o 0 -g cron" dir="/var/spool/cron/crontabs"
 
 	if [[ -n $1 ]] ; then
 		case "$1" in
@@ -78,10 +78,10 @@ docrondir() {
 #
 #    Both arguments are optional.
 #
-# ex: docron -m 0700 -o root -g root ('exe' defaults to "cron")
+# ex: docron -m 0700 -o 0 -g root ('exe' defaults to "cron")
 #     docron crond -m 0110
 docron() {
-	local cron="cron" perms="-m 0750 -o root -g wheel"
+	local cron="cron" perms="-m 0750 -o 0 -g wheel"
 
 	if [[ -n $1 ]] ; then
 		case "$1" in
@@ -111,7 +111,7 @@ docron() {
 #
 #   Uses same semantics as docron.
 docrontab() {
-	local crontab="crontab" perms="-m 4750 -o root -g cron"
+	local crontab="crontab" perms="-m 4750 -o 0 -g cron"
 
 	if [[ -n $1 ]] ; then
 		case "$1" in
-- 
2.35.1

[gentoo-dev] [PATCH 3/9] qmail.eclass: Use UID 0 instead of root

[Ulrich Müller]

Bug: https://bugs.gentoo.org/595908
Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 eclass/qmail.eclass | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/eclass/qmail.eclass b/eclass/qmail.eclass
index 33157b7e7871..471f2fe7ce5e 100644
--- a/eclass/qmail.eclass
+++ b/eclass/qmail.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: qmail.eclass
@@ -133,7 +133,7 @@ qmail_base_install() {
 	# subshell to not leak the install options
 	(
 	einfo "Setting up basic directory hierarchy"
-	diropts -o root -g qmail
+	diropts -o 0 -g qmail
 	dodir "${QMAIL_HOME}"/bin
 	keepdir "${QMAIL_HOME}"/{control,users}
 	diropts -o alias -g qmail
@@ -145,7 +145,7 @@ qmail_base_install() {
 	einfo "Installing all qmail software"
 	exeinto "${QMAIL_HOME}"/bin
 
-	exeopts -o root -g qmail
+	exeopts -o 0 -g qmail
 	doexe bouncesaying condredirect config-fast datemail except forward maildir2mbox \
 		maildirmake mailsubj predate preline qbiff \
 		qmail-{inject,qmqpc,qmqpd,qmtpd,qread,qstat,smtpd,tcpok,tcpto,showctl} \
@@ -158,11 +158,11 @@ qmail_base_install() {
 
 	use pop3 && doexe qmail-pop3d
 
-	exeopts -o root -g qmail -m 711
+	exeopts -o 0 -g qmail -m 711
 	doexe qmail-{clean,getpw,local,pw2u,remote,rspawn,send} splogger
 	use pop3 && doexe qmail-popup
 
-	exeopts -o root -g qmail -m 700
+	exeopts -o 0 -g qmail -m 700
 	doexe qmail-{lspawn,newmrh,newu,start}
 
 	exeopts -o qmailq -g qmail -m 4711
@@ -262,7 +262,7 @@ qmail_supervise_install_one() {
 	dosupervise ${1}
 	# subshell to not leak the install options
 	(
-	diropts -o qmaill -g root
+	diropts -o qmaill -g 0
 	keepdir /var/log/qmail/${1}
 	)
 }
-- 
2.35.1

[gentoo-dev] [PATCH 4/9] toolchain.eclass: Use UID 0 instead of root

[Ulrich Müller]

Bug: https://bugs.gentoo.org/595908
Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 eclass/toolchain.eclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eclass/toolchain.eclass b/eclass/toolchain.eclass
index 495a305ed83e..8788e72efebb 100644
--- a/eclass/toolchain.eclass
+++ b/eclass/toolchain.eclass
@@ -1780,7 +1780,7 @@ toolchain_src_install() {
 	# Use gid of 0 because some stupid ports don't have
 	# the group 'root' set to gid 0.  Send to /dev/null
 	# for people who are testing as non-root.
-	chown -R root:0 "${D}${LIBPATH}" 2>/dev/null
+	chown -R 0:0 "${D}${LIBPATH}" 2>/dev/null
 
 	# Installing gdb pretty-printers into gdb-specific location.
 	local py gdbdir=/usr/share/gdb/auto-load${LIBPATH}
-- 
2.35.1

[gentoo-dev] [PATCH 5/9] webapp.eclass: Use UID 0 instead of root

[Ulrich Müller]

Bug: https://bugs.gentoo.org/595908
Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 eclass/webapp.eclass | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/eclass/webapp.eclass b/eclass/webapp.eclass
index 3c0dfc811ac6..1efe4e66b6a9 100644
--- a/eclass/webapp.eclass
+++ b/eclass/webapp.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: webapp.eclass
@@ -457,7 +457,7 @@ webapp_src_install() {
 	chmod -R g-s "${D}/"
 
 	keepdir "${MY_PERSISTDIR}"
-	fowners "root:0" "${MY_PERSISTDIR}"
+	fowners "0:0" "${MY_PERSISTDIR}"
 	fperms 755 "${MY_PERSISTDIR}"
 }
 
-- 
2.35.1

[gentoo-dev] [PATCH 6/9] fcaps.eclass: Use arithmetic test for UID

[Ulrich Müller]

Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 eclass/fcaps.eclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eclass/fcaps.eclass b/eclass/fcaps.eclass
index 8ed27429c938..d1860f5ac9a3 100644
--- a/eclass/fcaps.eclass
+++ b/eclass/fcaps.eclass
@@ -88,7 +88,7 @@ esac
 fcaps() {
 	debug-print-function ${FUNCNAME} "$@"
 
-	if [[ ${EUID} != 0 ]] ; then
+	if [[ ${EUID} -ne 0 ]] ; then
 		einfo "Insufficient privileges to execute ${FUNCNAME}, skipping."
 		return 0
 	fi
-- 
2.35.1

[gentoo-dev] [PATCH 7/9] user.eclass: Use arithmetic test for UID

[Ulrich Müller]

Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 eclass/user.eclass | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/eclass/user.eclass b/eclass/user.eclass
index 581704eae815..ff69be81c1ec 100644
--- a/eclass/user.eclass
+++ b/eclass/user.eclass
@@ -85,7 +85,7 @@ user_get_nologin() {
 # If -M is passed, enewuser does not create the home directory if it does not
 # exist.
 enewuser() {
-	if [[ ${EUID} != 0 ]] ; then
+	if [[ ${EUID} -ne 0 ]] ; then
 		ewarn "Insufficient privileges to execute ${FUNCNAME[0]}"
 		return 0
 	fi
@@ -240,7 +240,7 @@ enewuser() {
 # If -F is passed, enewgroup will always enforce specified GID and fail if it
 # can not be assigned.
 enewgroup() {
-	if [[ ${EUID} != 0 ]] ; then
+	if [[ ${EUID} -ne 0 ]] ; then
 		ewarn "Insufficient privileges to execute ${FUNCNAME[0]}"
 		return 0
 	fi
-- 
2.35.1

[gentoo-dev] [PATCH 8/9] acct-user.eclass: Use arithmetic test for EUID

[Ulrich Müller]

Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 eclass/acct-user.eclass | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/eclass/acct-user.eclass b/eclass/acct-user.eclass
index 70ae2434b5df..2e2e1152f9ad 100644
--- a/eclass/acct-user.eclass
+++ b/eclass/acct-user.eclass
@@ -1,4 +1,4 @@
-# Copyright 2019-2021 Gentoo Authors
+# Copyright 2019-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: acct-user.eclass
@@ -178,7 +178,7 @@ acct-user_add_deps() {
 eislocked() {
 	[[ $# -eq 1 ]] || die "usage: ${FUNCNAME} <user>"
 
-	if [[ ${EUID} != 0 ]]; then
+	if [[ ${EUID} -ne 0 ]]; then
 		einfo "Insufficient privileges to execute ${FUNCNAME[0]}"
 		return 0
 	fi
@@ -215,7 +215,7 @@ eislocked() {
 elockuser() {
 	[[ $# -eq 1 ]] || die "usage: ${FUNCNAME} <user>"
 
-	if [[ ${EUID} != 0 ]]; then
+	if [[ ${EUID} -ne 0 ]]; then
 		einfo "Insufficient privileges to execute ${FUNCNAME[0]}"
 		return 0
 	fi
@@ -258,7 +258,7 @@ elockuser() {
 eunlockuser() {
 	[[ $# -eq 1 ]] || die "usage: ${FUNCNAME} <user>"
 
-	if [[ ${EUID} != 0 ]]; then
+	if [[ ${EUID} -ne 0 ]]; then
 		einfo "Insufficient privileges to execute ${FUNCNAME[0]}"
 		return 0
 	fi
@@ -440,7 +440,7 @@ acct-user_pkg_preinst() {
 acct-user_pkg_postinst() {
 	debug-print-function ${FUNCNAME} "${@}"
 
-	if [[ ${EUID} != 0 ]]; then
+	if [[ ${EUID} -ne 0 ]]; then
 		einfo "Insufficient privileges to execute ${FUNCNAME[0]}"
 		return 0
 	fi
@@ -468,7 +468,7 @@ acct-user_pkg_postinst() {
 acct-user_pkg_prerm() {
 	debug-print-function ${FUNCNAME} "${@}"
 
-	if [[ ${EUID} != 0 ]]; then
+	if [[ ${EUID} -ne 0 ]]; then
 		einfo "Insufficient privileges to execute ${FUNCNAME[0]}"
 		return 0
 	fi
-- 
2.35.1

[gentoo-dev] [PATCH 9/9] acct-user.eclass: Refuse to lock out the superuser

[Ulrich Müller]

Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 eclass/acct-user.eclass | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/eclass/acct-user.eclass b/eclass/acct-user.eclass
index 2e2e1152f9ad..f2aaefc2ee39 100644
--- a/eclass/acct-user.eclass
+++ b/eclass/acct-user.eclass
@@ -473,6 +473,11 @@ acct-user_pkg_prerm() {
 		return 0
 	fi
 
+	if [[ ${ACCT_USER_ID} -eq 0 ]]; then
+		elog "Refusing to lock out the superuser (UID 0)"
+		return 0
+	fi
+
 	if [[ -z ${REPLACED_BY_VERSION} ]]; then
 		if [[ -z $(egetent passwd "${ACCT_USER_NAME}") ]]; then
 			ewarn "User account not found: ${ACCT_USER_NAME}"
-- 
2.35.1

Re: [gentoo-dev] [PATCH 0/9] eclass: Use UID 0 instead of root and other fixes

[Mike Gilbert]

On Sun, Mar 27, 2022 at 3:27 AM Ulrich Müller <ulm@gentoo.org> wrote:
>
> This series of patches addresses eclasses using the "root" user name
> to check for superuser privileges. Using UID or GID 0 will work in
> more situations (e.g. when the superuser isn't named root).

The series looks ok to me.