On Mon, May 27, 2019 at 08:44:09PM -0400, Mike Gilbert wrote: > On Mon, May 27, 2019 at 11:45 AM William Hubbs <[email protected]> wrote: > > > > If a package hard codes the UID or GID when adding a user or group to > > the system and that UID/GID already exists, we should abort rather than > > changing the UID/GID. > These functions have behaved this way for a long time. Yes, I recall this breakage being raised even prior to GLEP27.
Some coverage of prior work firstly. 2003/May: eid_database [1] 2004/May: GLEP27 [2] 2006/Summer: GSOC Project for GLEP27 implementation [3] Later: Creandus [4][5] [1] https://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-src/eid_database/ [2] https://www.gentoo.org/glep/glep-0027.html [3] https://github.com/creandus/creandus.github.com/blob/master/glep27-proposal.txt [4] https://github.com/creandus/ [5] http://creandus.github.io/ > What problem are you trying to solve here? Specifically: 1. Package A is emerged, and the ebuild specifies enewuser/enewgroup with -1 as the numeric input, and some user or group is created with value X. 2. Package B is emerged, and the ebuild specifies enewuser/enewgroup with a fixed UID/GID value Y && explicitly depends on having that specific value. If X == Y, then the actual outcome is that B gets dynamic allocation of the UID/GID values, rather than the intended fixed values, and can break. It also goes against the intent of passing a fixed value in the first place! Debian's solution [6][7] here is to have separate numeric ranges for statically assigned values vs dynamically assigned values, so that they will never conflict. This does still run into trouble for some cases where multiple systems want the same user/group to have the same numeric value, typically where something is being shared (user databases, files). I used to know RedHat's solution as well, but I can't remember any details of it at the moment. I'd like to accept WilliamH's patch as-is, and then add an additional patch that moves the range of dynamically allocated users such that it does not conflict. [6] https://www.debian.org/doc/debian-policy/ch-opersys.html#introduction [7] https://salsa.debian.org/debian/base-passwd -- Robin Hugh Johnson Gentoo Linux: Dev, Infra Lead, Foundation Treasurer E-Mail : [email protected] GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85 GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136
signature.asc
Description: PGP signature
