On Thu, Jan 18, 2024 at 05:38:37AM -0000, David Chmelik wrote:
> Couldn't Debian standardize uid:gid numbers for daemons?

The thing is, Debian has tens of thousands of packages, and any one
of these packages is capable of creating new UIDs and/or GIDs if it
feels like doing so.  There is no centralized place where all of the
possible UIDs and GIDs are registered.  It's all ad hoc.

If a centralized UID/GID registry were to be created, the following
results would occur:

 * Every package that creates one would have to be updated in a
   non-trivial manner.  By its maintainer.  Thousands of separate
   maintainers.  A cat-herd of Debian developers, who do this work
   in their spare time, as they get around to it.

 * Every obscure, niche package's users and groups would have to be
   added to every Debian system.  I don't even think we *know* how
   many this would be.  Hundreds?  Thousands?  Do you want a thousand
   new system users to be created in your /etc/passwd file?  Your
   local UIDs beginning with 1000 might be overwritten.  They might
   have to be rebased to start at 3000, or 5000.  Would that be high
   enough?  Would it be future-proof?

 * Did I mention that every Debian system in existence would have to
   have ALL of its users and groups redone?  Yeah.  Just imagine that
   for a moment.  Every Debian system on the entire planet.  Every
   file system on every Debian system.  Even remote non-Debian NFS
   servers.  iSCSI servers.  Other remote file systems I'm not even
   aware of.

 * This change would have to be made by a human being running a
   conversion script as root in single-user mode, because it would
   break EVERYTHING that happens to be running at the time.  Or
   single-user mode plus NFS, iSCSI, etc.  So that you can update all
   the remote file systems.  While in single-user mode.  If such a
   thing is even possible.

This is one of those "the boat has already left the dock" situations.
If this were going to happen, it would have to have happened in the
early 1990s.  There is no feasible way to make it happen now.

Reply via email to