[EMAIL PROTECTED] wrote:
-- Should we allow untrusted users access to the 'mock' group?
This has been a concern of mine as well. However, I think the solution
is not to harden mockhelper, but to change the role of mockhelper.
At the moment, mock runs as a mortal user and uses mockhelper to execute
a limited number of shell commands as root. What I'd like to do is have
mock-helper (possibly renamed) run mock.py (and only mock.py) as root,
letting mock.py take actions directly without having to filter back
through mockhelper.
Consider that mock.py is in a much better position to make decisions
about whether operations are sane or not. Giving users access to run
mock.py as root could be much safer than giving them access to run a
number of more general purpose tools.
--
Fedora-buildsys-list mailing list
Fedora-buildsys-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-buildsys-list
