Re: Guidance on solving the username namespacing problem

2020-01-20 Thread Sean Whitton
Hello, On Sun 05 Jan 2020 at 11:33PM +01, Philipp Kern wrote: > I'd also propose the following hunk as I was myself confused where this > list was maintained - base-passwd is mentioned in 0-99 but not > explicitly in the on demand part. As policy seems to defer to that > package as the list, it

Re: Guidance on solving the username namespacing problem

2020-01-14 Thread Lennart Poettering
On Di, 14.01.20 15:55, Michael Biebl (bi...@debian.org) wrote: > Lennart, Zbyszek, > > what's your take on this? > > For some more background, see > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=905817 > and the recent discussion at >

Re: Guidance on solving the username namespacing problem

2020-01-14 Thread Michael Biebl
Lennart, Zbyszek, what's your take on this? For some more background, see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=905817 and the recent discussion at https://lists.debian.org/debian-policy/2020/01/msg00013.html Thanks, Michael Am 14.01.20 um 11:13 schrieb Philipp Kern: > On

Re: Guidance on solving the username namespacing problem

2020-01-14 Thread Philipp Kern
On 2020-01-05 23:33, Philipp Kern wrote: And then the following (in spirit) to base-passwd to make the systemd allocation explicit: --- a/README +++ b/README @@ -32,6 +32,9 @@ registry of allocations. Reserved uids: uid | name | description

Re: Guidance on solving the username namespacing problem

2020-01-05 Thread Philipp Kern
Thanks again, Russ, Colin and Simon! On 1/5/2020 7:25 PM, Russ Allbery wrote: > 9.2.1 feels like the right spot to me. I think that's close to 9.2.2. We > could also reiterate that guidance in 9.2.2. > >>> --- a/policy/ch-opersys.rst >>> +++ b/policy/ch-opersys.rst >>> @@ -228,13 +228,16 @@

Re: Guidance on solving the username namespacing problem

2020-01-05 Thread Russ Allbery
Colin Watson writes: > As Simon said, EF00-FFEF = 61184-65519 covers more than just netplan > (https://salsa.debian.org/debian/base-passwd/blob/master/README), and > several of the IDs allocated there in the vaguely recent past are hard > to change (their rationales included "needs to be the

Re: Guidance on solving the username namespacing problem

2020-01-05 Thread Colin Watson
[I haven't been following the rest of this discussion. Thanks for the CC - let me know if I'm egregiously missing anything.] On Sun, Jan 05, 2020 at 10:25:37AM -0800, Russ Allbery wrote: > Philipp Kern writes: > > It looks like the range must be contiguous, as it is compiled in[1]. > > What are

Re: Guidance on solving the username namespacing problem

2020-01-05 Thread Russ Allbery
Philipp Kern writes: > I fear that we might need a local policy hook for migrations. If we end > up renaming users that are actively referenced elsewhere, there might be > cleanup tasks that need to be performed in lockstep. > At the same time I'd strongly suggest that we do not go the way of >

Re: Guidance on solving the username namespacing problem

2020-01-05 Thread Simon McVittie
On Sun, 05 Jan 2020 at 17:16:58 +0100, Philipp Kern wrote: > On 1/4/2020 5:08 PM, Simon McVittie wrote: > > It's also worth noting that the 61184-65519 uid range used for DynamicUser > > by default collides with the rarely-used 6-64999 uid range for system > > users that are "globally

Re: Guidance on solving the username namespacing problem

2020-01-05 Thread Philipp Kern
Hey, thanks, Sam, Simon and Russ! That was all very helpful! Much appreciated! [Adding the systemd maintainers to the Cc for Simon's question below.] On 1/4/2020 5:08 PM, Simon McVittie wrote: > On Sat, 04 Jan 2020 at 13:52:51 +0100, Philipp Kern wrote: >> now that we are talking again about

Re: Guidance on solving the username namespacing problem

2020-01-04 Thread Russ Allbery
Philipp Kern writes: > OpenBSD rather successfully standardized on the underscore prefix to > eliminate this conflict altogether. I would like that we recommend the > same thing. I agree. > The main question that has been raised was how to manage the migration. I agree with this too. I'm

Re: Guidance on solving the username namespacing problem

2020-01-04 Thread Simon McVittie
On Sat, 04 Jan 2020 at 13:52:51 +0100, Philipp Kern wrote: > now that we are talking again about standardizing user creation using > sysusers, I wonder if you could give me any guidance on how to attack > the Debian system user namespacing problem. It's a good reminder, but I think the naming

Re: Guidance on solving the username namespacing problem

2020-01-04 Thread Sam Hartman
> "Philipp" == Philipp Kern writes: Philipp> I tried to raise this issue in [2] a year ago, but I think I don't know Philipp> how to even start drafting a policy snippet about this. Would it be Philipp> sufficient to just mandate "In order to avoid collisions with accounts

Re: Guidance on solving the username namespacing problem

2020-01-04 Thread Philipp Kern
(And then my broken keyboard driver caused this to be sent prematurely. But alas, it's out now.) On 1/4/2020 1:52 PM, Philipp Kern wrote: > [Please cc me on replies as I am not currently subscribed to the list.] > > now that we are talking again about standardizing user creation using >

Guidance on solving the username namespacing problem

2020-01-04 Thread Philipp Kern
[Please cc me on replies as I am not currently subscribed to the list.] Hi, now that we are talking again about standardizing user creation using sysusers, I wonder if you could give me any guidance on how to attack the Debian system user namespacing problem. There are some well-known usernames