Peter Hjalmarsson posted on Fri, 11 Dec 2009 23:46:07 +0100 as excerpted:
> fre 2009-12-11 klockan 12:11 -0800 skrev Zac Medico:
>> Should we enable FEATURES=userpriv by default? If we do that then do we
>> also need to support RESTRICT=userpriv? Maybe RESTRICT=userpriv should
>> not be supported on the grounds that it is never justified? What about
>> prefix support (in EAPI 3), which often doesn't have root privileges?
>
> That would be problematic for hardened, as they set the permission for
> /usr/src/* to root only.
Wouldn't setting it as its own user, say kernelcomp, and su/sudoing to
that before dealing with the kernel sources, be better? Kernel docs have
long said don't compile sources as root, tho obviously for installing
them you normally need to be root.
FWIW, my (non-gentoo-related) kernel scripts use a non-root user, tho
it's my normal admin user (not my user user) that has blanket sudo
without password permission, but it could be a dedicated one just as
easily. I'd expect hardened to be even more particular about compiling
as root, tho I see why general access isn't allowed. But dedicated user
seems good.
Even if that's done, however, it'll take some time to update and test.
But it could be made the default before that, and hardened could set its
own default elsewise.
--
Duncan - List replies preferred. No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master." Richard Stallman
