Re: [gentoo-user] User eix-sync permissions problem

["Walter Dnes" <waltdnes@waltdnes.org>]

On Tue, Feb 11, 2014 at 12:28:43AM +0000, Kerin Millar wrote
> On 10/02/2014 23:57, Walter Dnes wrote:
> >
> >    What's the point, if you still have to run as root (or su or sudo) for
> > the emerge update process?
> 
> It's the principle of least privilege. Is there any specific reason for 
> portage to fork and exec rsync as root? Is rsync sandboxed? Should rsync 
> have unfettered read/write access to all mounted filesystems? Can it be 
> guaranteed that rsync hasn't been compromised? Can it be guaranteed that 
> PORTAGE_RSYNC_OPTS will contain safe options at all times?
> 
> The answer to all of these questions is "no". Basically, the combination 
> of usersync and non-root ownership of PORTDIR hardens the process in a 
> sensible way while conferring no disadvantage.

  If /usr/portage is owned by portage:portage, then wouldn't a user
(member of portage) be able to do mischief by tweaking ebuilds?  E.g.
modify an ebuild to point to a tarball located on a usb stick, at
http://127.0.0.1/media/sdc1/my_tarball.tgz.  This would allow a local
user to supply code that gets built and then installed in /usr/bin, or
/sbin, etc.

-- 
Walter Dnes <waltdnes@waltdnes.org>
I don't run "desktop environments"; I run useful applications