From: "Ludovic Courtès" <ludo@gnu.org>
To: Mark H Weaver <mhw@netris.org>
Cc: Brendan Tildesley <btild@mailbox.org>, 36508@debbugs.gnu.org
Subject: bug#36508: GDM files have incorrect owner after temporarily removing service
Date: Thu, 15 Apr 2021 22:05:36 +0200 [thread overview]
Message-ID: <878s5j8ga7.fsf@gnu.org> (raw)
In-Reply-To: <87lf9jiems.fsf@netris.org> (Mark H. Weaver's message of "Thu, 15 Apr 2021 14:30:40 -0400")
Hi Mark,
Mark H Weaver <mhw@netris.org> skribis:
> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Note that there are other places, in addition to GDM, where we
>> forcefully reset the UID/GID of the home directory (e.g., for the
>> ‘knot-resolver’ service.)
>>
>> My preferred solution to this would be to unconditionally chown -R home
>> directories upon activation (for efficiency, it would be best if we
>> could do that if and only if the home directory itself has wrong
>> ownership). Thoughts?
>
> It might be okay to do this in specific cases like /var/lib/gdm, but I'm
> very uncomfortable doing it for *all* users, because:
>
> (1) We shouldn't assume that all files within a home directory are
> supposed to be owned by that user.
>
> (2) We shouldn't assume that all files owned by a user will be within
> their home directory.
>
> (3) We shouldn't assume that all files within a home directory are
> supposed to have the same 'group'. I, for one, have sometimes had
> subdirectories of my home directory with a different 'group', to
> either restrict or grant other users access to selected files or
> directories.
>
> (4) Groups do not, in general, have home directories.
>
> (5) I consider it unsatifactory for there to be *any* window of time
> during system activation when the ownership of files is incorrect.
I agree this raises questions and we should take time to think through
it. For system accounts though, I think 1–4 do not apply.
Perhaps a first step would be to do that for system accounts?
>> Note that the ID allocation strategy in (gnu build accounts) ensures
>> UIDs/GIDs aren’t reused right away (same strategy as implemented by
>> Shadow, etc.). So if you remove “bob”, then add “alice”, “alice” won’t
>> be able to access the left-behind /home/bob because it has a different
>> UID.
To be clear, it’s doing the same as any other GNU/Linux distro.
> This mechanism is insufficient, because it only avoids the problem if
> you add "alice" at the same time that "bob" is removed. If you remove
> "bob" during one system activation, and then later add "alice", then
> "alice" might well be able to access bob's left-behind files.
>
> In the case that I personally witnessed on my Guix system, files within
> /var/lib/gdm ended up with 'colord' as their group. That's not good.
>
> Increasingly, I'm leaning toward the idea that the complete mapping from
> names to IDs should somehow be explicitly given as part of the OS
> configuration, as I advocated in <https://bugs.gnu.org/36508#26>.
>
> What do you think?
IDs as hash of the user names are interesting because that’d be
stateless (conversely, the current ID allocation strategy is stateful:
it arranges to not reuse recently-freed IDs.)
But like you write, we’d need 32-bit UIDs. In libc, ‘uid_t’
(specifically ‘__UID_T_TYPE’ in typesizes.h) is 32-bit, so it might work
rather well in user space.
It still sounds like a change with significant implications though, and
it’s hard to predict exactly how it would go or what would break. For
example, that does away with the system/non-system ranges, and wouldn’t
play well with “special” IDs like 0 and 65535.
To me, it’s a potential way out, but not a solution for the bug Brendan
reported today, nor a change we could implement in the coming
weeks/months; the time scale is probably longer.
WDYT?
Thanks,
Ludo’.
next prev parent reply other threads:[~2021-04-15 20:06 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-05 8:36 bug#36508: GDM files have incorrect owner after temporarily replacing with SDDM ison
2021-04-13 13:24 ` bug#36508: GDM files have incorrect owner after temporarily removing service Brendan Tildesley via Bug reports for GNU Guix
2021-04-13 20:51 ` Mark H Weaver
2021-04-14 4:31 ` Brendan Tildesley via Bug reports for GNU Guix
2021-04-15 18:09 ` Mark H Weaver
2021-04-14 10:32 ` Ludovic Courtès
2021-04-14 12:21 ` Brendan Tildesley via Bug reports for GNU Guix
2021-04-15 14:24 ` Ludovic Courtès
2021-04-15 18:30 ` Mark H Weaver
2021-04-15 20:05 ` Ludovic Courtès [this message]
2021-04-15 22:22 ` Mark H Weaver
2021-04-16 15:18 ` Ludovic Courtès
2021-04-17 16:16 ` Mark H Weaver
2021-04-15 23:04 ` Mark H Weaver
2021-04-16 15:14 ` Ludovic Courtès
2021-04-15 18:35 ` Mark H Weaver
2021-04-15 18:58 ` Mark H Weaver
2021-04-16 10:42 ` Maxime Devos
2021-04-17 16:28 ` Mark H Weaver
2022-09-18 12:22 ` bug#36508: [DRAFT PATCH] Stable allocation of uids, by keeping a historical mapping Maxime Devos
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=878s5j8ga7.fsf@gnu.org \
--to=ludo@gnu.org \
--cc=36508@debbugs.gnu.org \
--cc=btild@mailbox.org \
--cc=mhw@netris.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.