[gentoo-server] portage nfs permissions

[gentoo-server] portage nfs permissions

[Chris Frederick]

Hi all,

I'm trying to set up the portage directory to be hosted over nfs. 
Everything is working great but I would like to increase the security a 
little.  I was wondering if there's an easy way to restrict 'emerge 
--sync' to only work on the server, while still letting all the nfs 
client machines download sources and emerge packages.

I was thinking of doing an 'all_squash' on the server, then changing the 
/distfiles directory to give group write to the anongid account.

I've tried this with no luck.  I keep getting an error trying to fetch 
the package.  I'm assuming it has something to do with the lock files 
that emerge uses to prevent multiple downloads of the same package source.

I've tried to google to find a working configuration like this, but so 
far I've come up empty.  Does anyone else have some ideas on how I can 
get this to work?

Thanks,

Chris Frederick
-- 
gentoo-server@lists.gentoo.org mailing list

Re: [gentoo-server] portage nfs permissions

[Kerin Millar]

2008/4/28 Chris Frederick <cdf123@cdf123.net>:

>  I was thinking of doing an 'all_squash' on the server, then changing the
> /distfiles directory to give group write to the anongid account.

Perhaps a better option is to move your distfiles to an independent
(writeable) export then define DISTDIR accordingly on the clients.

Regards,

--Kerin
-- 
gentoo-server@lists.gentoo.org mailing list

Re: [gentoo-server] portage nfs permissions

[gibbonsr-ml]

----- "Chris Frederick" <cdf123@cdf123.net> wrote:

> Hi all,
> 
> I'm trying to set up the portage directory to be hosted over nfs. 
> Everything is working great but I would like to increase the security
> a 
> little.  I was wondering if there's an easy way to restrict 'emerge 
> --sync' to only work on the server, while still letting all the nfs 
> client machines download sources and emerge packages.

I'm not sure using NFS special permissions.  But I would just create two different mount points.  One for the portage tree and make that read-only, and then another for the distfiles and make that read-write.

If you have problems mounting the in /usr/portage, and then the distfiles in /usr/portage/distfiles, then I would just move use the make.conf, and specify a different DISTDIR outside /usr/portage.
-- 
gentoo-server@lists.gentoo.org mailing list