On Wednesday, October 9, 2002, at 02:51 PM, James Michael DuPont wrote:
If the current user has "the appropriate access" as I believe the
previous
poster defines it, the packager can easily give the files the correct
ownership.
But really, isn't it silly to demand privileges just to write the
correct uids
to an archive? It's not like the OS forbids you to create archives
with any
contents you like. This hokus pokus is just because we want to use
the standard
tar command, isn't it?
Well if the cygwin port is ever to be taken serious in the debian
community then it needs to take security as seriously as the rest of
debian does. Don't let Microsoft negligence with security pollute the
goals and purpose of this debian project. It should aspire to be
better, not just average, then what is available now. I know one of my
reasons for choosing debian is better security.</soapbox>
I suppose I may not have a clear understanding of cygwin's permission
system... is there no uid 0 under cygwin? That is all dh_testroot is
checking for, that it is or has been fooled into believing that the
current user is uid 0. This is needed because tar also needs to be
fooled into thinking it is running as uid 0 in order to create tar
files with files in them that are owned by root or any other user/group
than the current one. That is what all of this revolves around.
Also keep in mind that one day cygwin and windows may take the user
permissions seriously. When that day comes do you want all your
packages to suddenly stop working because you tried to take shortcuts
now? I don't see how that helps anyone.
Aside, if tar under cygwin treats uid 500 as privileged and lets you
create tar archives containing files with privileged privileges, then
the thing to do would be to patch debhelper (what dh_testroot is a part
of) to check for the possibility uid 500 on cygwin as passing the root
check.
--
Paul Baker
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, 1759
GPG Key: http://homepage.mac.com/pauljbaker/public.asc
