From jw137282@sac.sfbay.sun.com Tue Jul 21 16:41:04 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6LNf4IZ006565 for ; Tue, 21 Jul 2009 16:41:04 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6LNf3Gk023733; Tue, 21 Jul 2009 17:41:04 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500501OGECD00@nwk-avmta-2.sfbay.sun.com>; Tue, 21 Jul 2009 16:41:02 -0700 (PDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500MMLOGEXO50@nwk-avmta-2.sfbay.sun.com>; Tue, 21 Jul 2009 16:41:02 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6LNf2Qe004547; Tue, 21 Jul 2009 16:41:02 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6LNf1qG006560; Tue, 21 Jul 2009 16:41:01 -0700 (PDT) Received: (from jw137282@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n6LNf0jG006556; Tue, 21 Jul 2009 16:41:00 -0700 (PDT) Date: Tue, 21 Jul 2009 16:41:00 -0700 (PDT) From: James Walker Subject: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] To: PSARC-ext@sun.com Cc: U.V.Ravindra@sun.com Message-id: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 3516 I'm sponsoring this familiarity case for U.V. Ravindra. The requested release binding is minor. The man pages have been posted in the materials directory. Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI This information is Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: fakeroot 1.2. Name of Document Author/Supplier: Author: U.V. Ravindra 1.3 Date of This Document: 21 July, 2009 4. Technical Description Summary ======= This case proposes to deliver the package containing the fakeroot software tool. Fakeroot[1] is a tool that provides an environment wherein an ordinary user can run a command so that it appears to have root privileges for file access. This can be useful particularly in situations where an ordinary user must manipulate files that would otherwise require root privileges, for example, to create packages or archives containing files owned by root. The mechanism adopted by fakeroot(1) is to replace the file manipulation library interfaces with its own versions that then simulate the effect the native library functions would have had had they been run by the root user. The fakeroot-supplied functions exist in a library (libfakeroot.so) which is loaded via LD_PRELOAD. List of 'Faked' Functions ------------------------- open, fopen, freopen, openat, lstat, stat, fstat, fstatat, lstat64, stat64, fstat64, fstatat64, chown, lchown, fchown, fchownat, chmod, fchmod, mknod, mkdir, unlink, unlinkat, rmdir, remove, rename, renameat, getuid, getgid, geteuid, getegid, setuid, setgid, seteuid, setegid, setreuid, setregid In addition, a daemon process, faked(1), runs; when a process running under fakeroot attempts to change the ownership of a file, faked(1) remembers the new 'fake' owner. If the same fakeroot process subsquently queries for the file owner, the 'fake' owner being tracked by faked(1) is reported. The faked(1) daemon automatically exits when the fakeroot process exits. fakeroot(1) does not alter the actual file permissions or ownership in any way, shape or form, nor is there any escalation of privileges of the user or process invoking fakeroot(1). For greater detail, please also refer to the fakeroot(1) man page in the accompanying materials for greater detail. fakeroot-1.11 will be integrated into the SFW consolidation as a consequence of this proposal, and will be installed as SUNWfakeroot. This proposal requests minor release binding. Dependencies ============ SUNWlibms Math & Microtasking Libraries (Usr) Interfaces ========== Exported Interfaces Classification Comment =================== ============== =================== SUNWfakeroot Uncommitted Package /usr/bin/fakeroot Uncommitted Command /usr/bin/faked Uncommitted Daemon Imported Interfaces Classification Comment =================== ============== =========================== SUNWlibms Committed Math & Microtasking Libraries (Usr) Other Files =========== Project Private =============== /usr/lib/libfakeroot.so.0 Library /usr/lib/libfakeroot.so Symbolic link /usr/lib/64/libfakeroot.so.0 library (64bit) /usr/lib/64/libfakeroot.so Symbolic link (64bit) * 64 = {sparcv9 | amd64} Reference Documentation ======================= [1] http://fakeroot.alioth.debian.org/ [2] http://packages.qa.debian.org/f/fakeroot.html 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: SFW 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From danek.duvall@sun.com Tue Jul 21 16:48:55 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6LNmtsH006845 for ; Tue, 21 Jul 2009 16:48:55 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6LNmqXa004737 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 21 Jul 2009 16:48:55 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500N07OTI2Y00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 17:48:54 -0600 (MDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN5009NBOTIWZ70@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 17:48:54 -0600 (MDT) Received: from smelly.SFBay.Sun.COM (smelly.SFBay.Sun.COM [129.146.228.142]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6LNmrZr010108; Tue, 21 Jul 2009 16:48:53 -0700 (PDT) Received: from smelly.SFBay.Sun.COM (smelly [127.0.0.1]) by smelly.SFBay.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n6LNmrGA005997; Tue, 21 Jul 2009 16:48:53 -0700 (PDT) Received: (from dduvall@localhost) by smelly.SFBay.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n6LNmrH9005996; Tue, 21 Jul 2009 16:48:53 -0700 (PDT) Date: Tue, 21 Jul 2009 16:48:53 -0700 From: Danek Duvall Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> To: James Walker Cc: PSARC-ext@sun.com, U.V.Ravindra@sun.com Message-id: <20090721234853.GM23953@smelly.SFBay.Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> User-Agent: Mutt/1.5.20 (2009-06-23) Status: RO Content-Length: 971 On Tue, Jul 21, 2009 at 04:41:00PM -0700, James Walker wrote: > Exported Interfaces Classification Comment > =================== ============== =================== > SUNWfakeroot Uncommitted Package > > /usr/bin/fakeroot Uncommitted Command > /usr/bin/faked Uncommitted Daemon Is there any point in running the daemon by hand, or should that be a Private interface, stuck off in /usr/lib? > Imported Interfaces Classification Comment > =================== ============== =========================== > SUNWlibms Committed Math & Microtasking Libraries (Usr) What math functions does this use? > Project Private > =============== > /usr/lib/libfakeroot.so.0 Library > /usr/lib/libfakeroot.so Symbolic link > /usr/lib/64/libfakeroot.so.0 library (64bit) > /usr/lib/64/libfakeroot.so Symbolic link (64bit) If these are project private, why have compilation symlinks? Has any thought been given to having fake elevated privileges, or fake role assumption? Danek From gdamore@sun.com Tue Jul 21 16:53:50 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6LNrorK006911 for ; Tue, 21 Jul 2009 16:53:50 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6LNrnVa006205 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 21 Jul 2009 16:53:50 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500C03P1PU300@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.Com); Tue, 21 Jul 2009 16:53:49 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500M62P1P5A50@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.Com); Tue, 21 Jul 2009 16:53:49 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6LNrnJ3000682 for ; Tue, 21 Jul 2009 16:53:49 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN500K00OTL5P00@fe-sfbay-10.sun.com> for PSARC-ext@Sun.Com (ORCPT PSARC-ext@Sun.Com); Tue, 21 Jul 2009 16:53:49 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN500E7MP1OTUD0@fe-sfbay-10.sun.com>; Tue, 21 Jul 2009 16:53:48 -0700 (PDT) Date: Tue, 21 Jul 2009 16:53:48 -0700 From: "Garrett D'Amore" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> Sender: Garrett.Damore@sun.com To: James Walker Cc: PSARC-ext@sun.com, U.V.Ravindra@sun.com Message-id: <4A66550C.7000203@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 4266 I don't understand the point of this. Why is this kind of emulation helpful? Is this just to create honeypot? Or am I missing something. Some additional information is also missing ... what privileges does the faked run under? Who inserts the LD_PRELOAD into the environment? Is this done using fakeroot(1) to execute the program? It would be nice to have man pages handy without having to download the source code to extract them. Also, some of your exported interfaces are not declared with stability levels. - Garrett James Walker wrote: > I'm sponsoring this familiarity case for U.V. Ravindra. The requested > release binding is minor. The man pages have been posted in the > materials directory. > > Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI > This information is Copyright 2009 Sun Microsystems > 1. Introduction > 1.1. Project/Component Working Name: > fakeroot > 1.2. Name of Document Author/Supplier: > Author: U.V. Ravindra > 1.3 Date of This Document: > 21 July, 2009 > 4. Technical Description > > Summary > ======= > > This case proposes to deliver the package containing the fakeroot software > tool. Fakeroot[1] is a tool that provides an environment wherein an > ordinary user can run a command so that it appears to have root privileges > for file access. This can be useful particularly in situations where > an ordinary user must manipulate files that would otherwise require > root privileges, for example, to create packages or archives containing > files owned by root. > > The mechanism adopted by fakeroot(1) is to replace the file manipulation > library interfaces with its own versions that then simulate the effect > the native library functions would have had had they been run by the root > user. The fakeroot-supplied functions exist in a library (libfakeroot.so) > which is loaded via LD_PRELOAD. > > List of 'Faked' Functions > ------------------------- > open, fopen, freopen, openat, lstat, stat, fstat, fstatat, lstat64, stat64, > fstat64, fstatat64, chown, lchown, fchown, fchownat, chmod, fchmod, > mknod, mkdir, unlink, unlinkat, rmdir, remove, rename, renameat, > getuid, getgid, geteuid, getegid, setuid, setgid, seteuid, setegid, > setreuid, setregid > > In addition, a daemon process, faked(1), runs; when a process running > under fakeroot attempts to change the ownership of a file, faked(1) > remembers the new 'fake' owner. If the same fakeroot process subsquently > queries for the file owner, the 'fake' owner being tracked by faked(1) > is reported. The faked(1) daemon automatically exits when the fakeroot > process exits. > > fakeroot(1) does not alter the actual file permissions > or ownership in any way, shape or form, nor is there any escalation > of privileges of the user or process invoking fakeroot(1). For greater > detail, please also refer to the fakeroot(1) man page in the accompanying > materials for greater detail. > > fakeroot-1.11 will be integrated into the SFW consolidation as a > consequence of this proposal, and will be installed as SUNWfakeroot. > > This proposal requests minor release binding. > > > Dependencies > ============ > > SUNWlibms Math & Microtasking Libraries (Usr) > > > Interfaces > ========== > > Exported Interfaces Classification Comment > =================== ============== =================== > SUNWfakeroot Uncommitted Package > > /usr/bin/fakeroot Uncommitted Command > /usr/bin/faked Uncommitted Daemon > > Imported Interfaces Classification Comment > =================== ============== =========================== > SUNWlibms Committed Math & Microtasking Libraries (Usr) > > Other Files > =========== > > Project Private > =============== > /usr/lib/libfakeroot.so.0 Library > /usr/lib/libfakeroot.so Symbolic link > /usr/lib/64/libfakeroot.so.0 library (64bit) > /usr/lib/64/libfakeroot.so Symbolic link (64bit) > > * 64 = {sparcv9 | amd64} > > Reference Documentation > ======================= > [1] http://fakeroot.alioth.debian.org/ > [2] http://packages.qa.debian.org/f/fakeroot.html > > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > SFW > 6.5. ARC review type: FastTrack > 6.6. ARC Exposure: open > > From James.Walker@sun.com Tue Jul 21 17:04:41 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M04efl007702 for ; Tue, 21 Jul 2009 17:04:40 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M04YTn023193 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 01:04:39 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500F01PJQ1000@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.Com); Tue, 21 Jul 2009 17:04:38 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500MMDPJP5570@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.Com); Tue, 21 Jul 2009 17:04:37 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6M04b5X001009 for ; Wed, 22 Jul 2009 00:04:37 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN500L00PB3KO00@mail-amer.sun.com> for PSARC-ext@Sun.Com (ORCPT PSARC-ext@Sun.Com); Tue, 21 Jul 2009 18:04:37 -0600 (MDT) Received: from [172.20.25.153] ([unknown] [172.20.25.153]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN5001FZPJOBL00@mail-amer.sun.com>; Tue, 21 Jul 2009 18:04:37 -0600 (MDT) Date: Tue, 21 Jul 2009 18:23:07 -0600 From: Jim Walker Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A66550C.7000203@sun.com> Sender: James.Walker@sun.com To: "Garrett D'Amore" Cc: James Walker , PSARC-ext@sun.com, U.V.Ravindra@sun.com Reply-to: James.Walker@sun.com Message-id: <4A665BEB.5070509@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080728) Status: RO Content-Length: 859 Garrett D'Amore wrote: > I don't understand the point of this. Why is this kind of emulation > helpful? Is this just to create honeypot? Or am I missing something. You may want to look at this more slowly. > Some additional information is also missing ... what privileges does the > faked run under? Who inserts the LD_PRELOAD into the environment? Is > this done using fakeroot(1) to execute the program? User. Yes. > It would be nice to have man pages handy without having to download the > source code to extract them. The man pages are posted in the materials directory. > Also, some of your exported interfaces are not declared with stability > levels. What exported interfaces are you referencing? The 'Faked' functions are not exported. Cheers, Jim -- Jim Walker, http://blogs.sun.com/jwalker Sun Microsystems, Broomfield, Colorado From Nicolas.Williams@sun.com Tue Jul 21 17:15:28 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M0FR6h007771 for ; Tue, 21 Jul 2009 17:15:28 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M0FEDZ029578; Wed, 22 Jul 2009 01:15:24 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500H05Q1NB000@nwk-avmta-1.sfbay.Sun.COM>; Tue, 21 Jul 2009 17:15:23 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500M13Q1N5390@nwk-avmta-1.sfbay.Sun.COM>; Tue, 21 Jul 2009 17:15:23 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n6M0CUoj002611; Tue, 21 Jul 2009 19:12:30 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n6M0CUDt002610; Tue, 21 Jul 2009 19:12:30 -0500 (CDT) Date: Tue, 21 Jul 2009 19:12:30 -0500 From: Nicolas Williams Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A66550C.7000203@sun.com> To: "Garrett D'Amore" Cc: James Walker , PSARC-ext@sun.com, U.V.Ravindra@sun.com Message-id: <20090722001230.GZ1020@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 301 On Tue, Jul 21, 2009 at 04:53:48PM -0700, Garrett D'Amore wrote: > I don't understand the point of this. Why is this kind of emulation > helpful? Is this just to create honeypot? Or am I missing something. No. Remember when ON had to be built as UID 0? It's for that sort of purpose. Nico -- From James.McPherson@sun.com Tue Jul 21 17:21:57 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M0LuqH007825 for ; Tue, 21 Jul 2009 17:21:57 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M0Ljhx003794 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 01:21:56 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500303QCJKI00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 18:21:55 -0600 (MDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500916QCIWW90@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 18:21:55 -0600 (MDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6M0LrO3000532 for ; Wed, 22 Jul 2009 00:21:53 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN500300QAN2T00@mail-apac.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 08:21:53 +0800 (SGT) Received: from blinder ([unknown] [220.157.71.44]) by mail-apac.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN5001UYQCG6C90@mail-apac.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 08:21:53 +0800 (SGT) Date: Wed, 22 Jul 2009 10:21:49 +1000 From: "James C. McPherson" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <20090722001230.GZ1020@Sun.COM> Sender: James.McPherson@sun.com To: Nicolas Williams Cc: PSARC-ext@sun.com Message-id: <20090722102149.00007dd9@blinder> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Claws Mail 3.7.0 (GTK+ 2.16.1; i386-pc-solaris2.11) Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <20090722001230.GZ1020@Sun.COM> Status: RO Content-Length: 725 On Tue, 21 Jul 2009 19:12:30 -0500 Nicolas Williams wrote: > On Tue, Jul 21, 2009 at 04:53:48PM -0700, Garrett D'Amore wrote: > > I don't understand the point of this. Why is this kind of emulation > > helpful? Is this just to create honeypot? Or am I missing something. > > No. Remember when ON had to be built as UID 0? It's for that sort of > purpose. ... something that I'm working hard to fully remove. Requiring a build as uid 0 has long since past its use-by date. James C. McPherson -- Senior Kernel Software Engineer, Solaris Sun Microsystems http://blogs.sun.com/jmcp http://www.jmcp.homeunix.com/blog Kernel Conference Australia - http://au.sun.com/sunnews/events/2009/kernel From gdamore@sun.com Tue Jul 21 17:31:02 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M0V1JP007872 for ; Tue, 21 Jul 2009 17:31:02 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M0Uink009136 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 01:31:01 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500803QRN5V00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 17:30:59 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500M5PQRMX190@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 17:30:58 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6M0UwHF011600 for ; Tue, 21 Jul 2009 17:30:58 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN500600QR7JQ00@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 17:30:58 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN500IP5QRMZ5D0@fe-sfbay-09.sun.com>; Tue, 21 Jul 2009 17:30:58 -0700 (PDT) Date: Tue, 21 Jul 2009 17:30:57 -0700 From: "Garrett D'Amore" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A665BEB.5070509@sun.com> Sender: Garrett.Damore@sun.com To: James.Walker@sun.com Cc: James Walker , PSARC-ext@sun.com, U.V.Ravindra@sun.com Message-id: <4A665DC1.5020103@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <4A665BEB.5070509@sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 728 Ah, there was materials posted in the case directory. You didn't indicate that. I suppose I should have checked there first. There are still some security concerns though, as fakeroot seems to use TCP sockets for communication with faked. I'd like this to be more explicitly spelled out. One can imagine subverting this channel to alter the package contents (I'm not sure how you'd use this -- to change ownership of a file... could it do more worse things than that?) What is the stability of the save files? The --cleanup makes references to semaphores, but I don't see information about how those are used/created? How is faked started? Automatically by fakeroot, or via some other scheme? -- Garrett From gdamore@sun.com Tue Jul 21 17:33:20 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M0XJ9t007907 for ; Tue, 21 Jul 2009 17:33:20 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M0XHDM011011 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 01:33:19 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500K01QVIYJ00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 17:33:18 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500MOVQVH51A0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 17:33:17 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6M0XHg9011710 for ; Tue, 21 Jul 2009 17:33:17 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN500600QR7JQ00@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 17:33:17 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN500IEOQVCZ5E0@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 17:33:13 -0700 (PDT) Date: Tue, 21 Jul 2009 17:33:12 -0700 From: "Garrett D'Amore" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <20090722102149.00007dd9@blinder> Sender: Garrett.Damore@sun.com To: "James C. McPherson" Cc: Nicolas Williams , PSARC-ext@sun.com Message-id: <4A665E48.2040505@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <20090722001230.GZ1020@Sun.COM> <20090722102149.00007dd9@blinder> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 1285 James C. McPherson wrote: > On Tue, 21 Jul 2009 19:12:30 -0500 > Nicolas Williams wrote: > > >> On Tue, Jul 21, 2009 at 04:53:48PM -0700, Garrett D'Amore wrote: >> >>> I don't understand the point of this. Why is this kind of emulation >>> helpful? Is this just to create honeypot? Or am I missing something. >>> >> No. Remember when ON had to be built as UID 0? It's for that sort of >> purpose. >> > > ... something that I'm working hard to fully remove. Requiring a > build as uid 0 has long since past its use-by date. > With smarter archiving tools, we wouldn't need it. (Actually, I regularly build as not-root, but there are some checks that are not performed as a result -- namely matching the proto and packaging ownerships. But of course, if you don't need root, then you don't need those checks either! :-) The other thing is that one could imagine giving folks their own zones (sparse root probably!) to do this, which would allow root to be used "safely". - Garrett > > James C. McPherson > -- > Senior Kernel Software Engineer, Solaris > Sun Microsystems > http://blogs.sun.com/jmcp http://www.jmcp.homeunix.com/blog > Kernel Conference Australia - http://au.sun.com/sunnews/events/2009/kernel > From James.Walker@sun.com Tue Jul 21 18:21:35 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M1LZR9010259 for ; Tue, 21 Jul 2009 18:21:35 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6M1LYA8008022 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 21 Jul 2009 18:21:35 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500A0BT3Y6700@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 19:21:34 -0600 (MDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN5009O9T3XXAB0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 19:21:33 -0600 (MDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6M1LXWh027621 for ; Wed, 22 Jul 2009 01:21:33 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN500D00T2A0R00@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 19:21:33 -0600 (MDT) Received: from [172.20.25.153] ([unknown] [172.20.25.153]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN5002QTT3WXR30@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 19:21:32 -0600 (MDT) Date: Tue, 21 Jul 2009 19:40:03 -0600 From: Jim Walker Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A665E48.2040505@sun.com> Sender: James.Walker@sun.com To: "Garrett D'Amore" Cc: PSARC-ext@sun.com Reply-to: James.Walker@sun.com Message-id: <4A666DF3.20404@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <20090722001230.GZ1020@Sun.COM> <20090722102149.00007dd9@blinder> <4A665E48.2040505@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080728) Status: RO Content-Length: 387 Garrett D'Amore wrote: > > The other thing is that one could imagine giving folks their own zones > (sparse root probably!) to do this, which would allow root to be used > "safely". We provide development zones in the test farm for this purpose. It's been available for some time now, and we plan to expand this using crossbow. Cheers, Jim From U.V.Ravindra@sun.com Tue Jul 21 18:50:19 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M1oJSH010473 for ; Tue, 21 Jul 2009 18:50:19 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6M1oIVg018011; Tue, 21 Jul 2009 18:50:18 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500E03UFUAF00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 21 Jul 2009 18:50:18 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500C95UFUO310@nwk-avmta-1.sfbay.Sun.COM>; Tue, 21 Jul 2009 18:50:18 -0700 (PDT) Received: from [129.146.224.74] (upamaka.SFBay.Sun.COM [129.146.224.74]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6M1oHuK979363; Tue, 21 Jul 2009 18:50:17 -0700 (PDT) Date: Tue, 21 Jul 2009 18:50:25 -0700 From: "U.V. Ravindra" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A665DC1.5020103@sun.com> To: "Garrett D'Amore" Cc: James.Walker@sun.com, James Walker , PSARC-ext@sun.com Reply-to: U.V.Ravindra@sun.com Message-id: <4A667061.8010404@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <4A665BEB.5070509@sun.com> <4A665DC1.5020103@sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1b3pre) Gecko/20090224 Thunderbird/3.0b2 Status: RO Content-Length: 2452 Garrett D'Amore wrote at Tue Jul 21 2009 17:30:57 GMT-0700 (PDT): > Ah, there was materials posted in the case directory. You didn't > indicate that. I suppose I should have checked there first. > > There are still some security concerns though, as fakeroot seems to use > TCP sockets for communication with faked. I'd like this to be more > explicitly spelled out. The version of fakeroot targeted by this case does not communicate over TCP. fakeroot can be built to use TCP sockets or System V IPC. System V IPC is the default, and that's the one we are seeking to integrate. > One can imagine subverting this channel to alter > the package contents (I'm not sure how you'd use this -- to change > ownership of a file... could it do more worse things than that?) A fakeroot'ed process runs under the userid which initiates the fakeroot session. It cannot really do anything the user couldn't do some other way. In other words, no specific security violations are made possible by fakeroot. For example, consider a user who doesn't have permissions to create a block device using mknod. This user can run mknod under fakeroot, and the operation will "succeed." But, no sooner than the fakeroot session ends, than the actual reality becomes evident -- what was created is just a regular (empty) file; it's just being 'fakely' reported to the user as a block special file. > What is the stability of the save files? They are not considered stable. The save files are only useful if the user wants to preserve the 'fake' appearances from one session to the next. To use the mknod example from above, if the user exited the fakeroot session without storing to a save file, all the fake information will be lost. The next time the user starts a fakeroot session, the 'mknod'ed file will be reported only as a regular file. On the other hand if the session were to be saved and reloaded in the new session, it will be reported as a block special file. The files can be removed or edited outside of the fakeroot session. If this is done, some or all information in them can be lost. > The --cleanup makes references to semaphores, but I don't see > information about how those are used/created? How is faked started? > Automatically by fakeroot, or via some other scheme? It's started automatically by fakeroot. It can be invoked by the user directly, but that won't be of any use unless there's a fakeroot at the other end. -Ravindra. From bart.smaalders@sun.com Tue Jul 21 18:54:35 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M1sYfB010764 for ; Tue, 21 Jul 2009 18:54:35 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n6M1sPPB013904; Wed, 22 Jul 2009 09:54:30 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500F03UMR5100@nwk-avmta-1.sfbay.Sun.COM>; Tue, 21 Jul 2009 18:54:27 -0700 (PDT) Received: from zion.sfbay.sun.com ([129.146.17.75]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500C3QUMRO320@nwk-avmta-1.sfbay.Sun.COM>; Tue, 21 Jul 2009 18:54:27 -0700 (PDT) Received: from [129.146.228.109] (cyber.SFBay.Sun.COM [129.146.228.109]) by zion.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6M1rx8Z008710; Wed, 22 Jul 2009 01:53:59 +0000 (GMT) Date: Tue, 21 Jul 2009 18:52:22 -0700 From: Bart Smaalders Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A665E48.2040505@sun.com> To: "Garrett D'Amore" Cc: "James C. McPherson" , Nicolas Williams , PSARC-ext@sun.com Message-id: <4A6670D6.9010809@Sun.COM> Organization: Sun Microsystems MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <20090722001230.GZ1020@Sun.COM> <20090722102149.00007dd9@blinder> <4A665E48.2040505@sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090623) Status: RO Content-Length: 1349 Garrett D'Amore wrote: > James C. McPherson wrote: >> On Tue, 21 Jul 2009 19:12:30 -0500 >> Nicolas Williams wrote: >> >> >>> On Tue, Jul 21, 2009 at 04:53:48PM -0700, Garrett D'Amore wrote: >>> >>>> I don't understand the point of this. Why is this kind of emulation >>>> helpful? Is this just to create honeypot? Or am I missing something. >>>> >>> No. Remember when ON had to be built as UID 0? It's for that sort of >>> purpose. >>> >> >> ... something that I'm working hard to fully remove. Requiring a >> build as uid 0 has long since past its use-by date. >> > > With smarter archiving tools, we wouldn't need it. (Actually, I > regularly build as not-root, but there are some checks that are not > performed as a result -- namely matching the proto and packaging > ownerships. But of course, if you don't need root, then you don't need > those checks either! :-) But this is of course very silly; requiring permissions to be match between Makefile and pkgdef is just a waste of time. First normal form, please; keeping the same info in two places (in different forms, no less) is asking for trouble. - Bart -- Bart Smaalders Solaris Kernel Performance barts@cyber.eng.sun.com http://blogs.sun.com/barts "You will contribute more with mercurial than with thunderbird." From U.V.Ravindra@sun.com Tue Jul 21 19:19:41 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M2JetS011103 for ; Tue, 21 Jul 2009 19:19:41 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M2JUIV018983; Wed, 22 Jul 2009 03:19:38 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500K03VSOL900@nwk-avmta-1.sfbay.Sun.COM>; Tue, 21 Jul 2009 19:19:36 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500CZXVSOO640@nwk-avmta-1.sfbay.Sun.COM>; Tue, 21 Jul 2009 19:19:36 -0700 (PDT) Received: from [129.146.224.74] (upamaka.SFBay.Sun.COM [129.146.224.74]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6M2Jaji981432; Tue, 21 Jul 2009 19:19:36 -0700 (PDT) Date: Tue, 21 Jul 2009 19:19:44 -0700 From: "U.V. Ravindra" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <20090721234853.GM23953@smelly.SFBay.Sun.COM> To: Danek Duvall Cc: James Walker , PSARC-ext@sun.com Reply-to: U.V.Ravindra@sun.com Message-id: <4A667740.6010000@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <20090721234853.GM23953@smelly.SFBay.Sun.COM> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1b3pre) Gecko/20090224 Thunderbird/3.0b2 Status: RO Content-Length: 2114 Danek Duvall wrote at Tue Jul 21 2009 16:48:53 GMT-0700 (PDT): > On Tue, Jul 21, 2009 at 04:41:00PM -0700, James Walker wrote: > >> Exported Interfaces Classification Comment >> =================== ============== =================== >> SUNWfakeroot Uncommitted Package >> >> /usr/bin/fakeroot Uncommitted Command >> /usr/bin/faked Uncommitted Daemon > > Is there any point in running the daemon by hand, or should that be a > Private interface, stuck off in /usr/lib? The daemon can be run by hand, but it would be pointless. Running faked is only useful if there's a fakeroot at the other end telling it what to fake. >> Imported Interfaces Classification Comment >> =================== ============== =========================== >> SUNWlibms Committed Math& Microtasking Libraries (Usr) > > What math functions does this use? None, really. >> Project Private >> =============== >> /usr/lib/libfakeroot.so.0 Library >> /usr/lib/libfakeroot.so Symbolic link >> /usr/lib/64/libfakeroot.so.0 library (64bit) >> /usr/lib/64/libfakeroot.so Symbolic link (64bit) > > If these are project private, why have compilation symlinks? fakeroot ld_preloads libfakeroot.so to achieve its desired end. Presumably this is for future "expansion"; should there be another version of the library in a future release, say, libfakeroot.so.1, fakeroot can continue to ld_preload libfakeroot.so as it does now. > Has any thought been given to having fake elevated privileges, or fake role > assumption? Apologies: I am a bit unsure as to the meaning of the question. If you are asking whether fakeroot can cause privilege escalation or allow the user to assume roles s/he is not allowed to assume, then the answer is it cannot. If, OTOH, your question is whether fakeroot can give the impression of privilege escalation, then yes, that's what it is basically designed for. When a user runs (a command under) fakeroot, s/he is fakely reported (to the command) as being root. So, the command thinks the user has all privileges. There's also some text about this included in the proposal and the manual pages. -Ravindra. From gdamore@sun.com Tue Jul 21 19:43:46 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M2hjFV011196 for ; Tue, 21 Jul 2009 19:43:46 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M2hZMA003097 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 03:43:45 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500J0DWWUMM00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 20:43:42 -0600 (MDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500HZIWWTDU00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 20:43:42 -0600 (MDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6M2hffc016644 for ; Tue, 21 Jul 2009 19:43:41 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN500C00WKHQP00@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 19:43:41 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN5006POWWTSDE0@fe-sfbay-09.sun.com>; Tue, 21 Jul 2009 19:43:41 -0700 (PDT) Date: Tue, 21 Jul 2009 19:43:41 -0700 From: "Garrett D'Amore" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A667061.8010404@sun.com> Sender: Garrett.Damore@sun.com To: U.V.Ravindra@sun.com Cc: James.Walker@sun.com, James Walker , PSARC-ext@sun.com Message-id: <4A667CDD.2040707@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <4A665BEB.5070509@sun.com> <4A665DC1.5020103@sun.com> <4A667061.8010404@sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 3230 U.V. Ravindra wrote: > Garrett D'Amore wrote at Tue Jul 21 2009 17:30:57 GMT-0700 (PDT): >> Ah, there was materials posted in the case directory. You didn't >> indicate that. I suppose I should have checked there first. >> >> There are still some security concerns though, as fakeroot seems to use >> TCP sockets for communication with faked. I'd like this to be more >> explicitly spelled out. > > The version of fakeroot targeted by this case does not communicate > over TCP. fakeroot can be built to use TCP sockets or System V IPC. > System V IPC is the default, and that's the one we are seeking to > integrate. > >> One can imagine subverting this channel to alter >> the package contents (I'm not sure how you'd use this -- to change >> ownership of a file... could it do more worse things than that?) > > A fakeroot'ed process runs under the userid which initiates > the fakeroot session. It cannot really do anything the user > couldn't do some other way. In other words, no specific > security violations are made possible by fakeroot. > > For example, consider a user who doesn't have permissions to > create a block device using mknod. This user can run mknod > under fakeroot, and the operation will "succeed." But, no > sooner than the fakeroot session ends, than the actual reality > becomes evident -- what was created is just a regular (empty) > file; it's just being 'fakely' reported to the user as a > block special file. My point is that if there was a TCP session that was subverted, you could arrange to alter the UID that was stored in the archive by changing the UID reported to the archiver. Its a goofy attack vector, and irrelevant since I think System V IPC is pretty much immune to this. > >> What is the stability of the save files? > > They are not considered stable. > > The save files are only useful if the user wants to preserve > the 'fake' appearances from one session to the next. To use > the mknod example from above, if the user exited the fakeroot > session without storing to a save file, all the fake information > will be lost. The next time the user starts a fakeroot session, > the 'mknod'ed file will be reported only as a regular file. > On the other hand if the session were to be saved and reloaded > in the new session, it will be reported as a block special file. > > The files can be removed or edited outside of the fakeroot > session. If this is done, some or all information in them > can be lost. Understood. And I'm happy with that. Lets put the save files as a Volatile interface, or even Not-An-Interface, then. Agree? > >> The --cleanup makes references to semaphores, but I don't see >> information about how those are used/created? How is faked started? >> Automatically by fakeroot, or via some other scheme? > > It's started automatically by fakeroot. It can be invoked by > the user directly, but that won't be of any use unless there's > a fakeroot at the other end. Okay. Probably the man page should have stated that... if it did I missed it. But then I missed so much other material in the case review up front, I am hesitant to make any other claims about the case materials and put yet more egg on my face. :-) - Garrett From gdamore@sun.com Tue Jul 21 19:44:10 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M2iATG011212 for ; Tue, 21 Jul 2009 19:44:10 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6M2iACc024166 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 21 Jul 2009 19:44:10 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500209WXLR000@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 19:44:09 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500CBXWXKO690@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 19:44:08 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6M2i8R7016662 for ; Tue, 21 Jul 2009 19:44:08 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN500F00WXK6Y00@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 19:44:08 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN5006SLWXKSDE0@fe-sfbay-09.sun.com>; Tue, 21 Jul 2009 19:44:08 -0700 (PDT) Date: Tue, 21 Jul 2009 19:44:08 -0700 From: "Garrett D'Amore" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A6670D6.9010809@Sun.COM> Sender: Garrett.Damore@sun.com To: Bart Smaalders Cc: "James C. McPherson" , Nicolas Williams , PSARC-ext@sun.com Message-id: <4A667CF8.5050209@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <20090722001230.GZ1020@Sun.COM> <20090722102149.00007dd9@blinder> <4A665E48.2040505@sun.com> <4A6670D6.9010809@Sun.COM> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 1293 Bart Smaalders wrote: > Garrett D'Amore wrote: >> James C. McPherson wrote: >>> On Tue, 21 Jul 2009 19:12:30 -0500 >>> Nicolas Williams wrote: >>> >>> >>>> On Tue, Jul 21, 2009 at 04:53:48PM -0700, Garrett D'Amore wrote: >>>> >>>>> I don't understand the point of this. Why is this kind of >>>>> emulation helpful? Is this just to create honeypot? Or am I >>>>> missing something. >>>>> >>>> No. Remember when ON had to be built as UID 0? It's for that sort of >>>> purpose. >>>> >>> >>> ... something that I'm working hard to fully remove. Requiring a >>> build as uid 0 has long since past its use-by date. >>> >> >> With smarter archiving tools, we wouldn't need it. (Actually, I >> regularly build as not-root, but there are some checks that are not >> performed as a result -- namely matching the proto and packaging >> ownerships. But of course, if you don't need root, then you don't >> need those checks either! :-) > > But this is of course very silly; requiring permissions to be match > between Makefile and pkgdef is just a waste of time. First normal form, > please; keeping the same info in two places (in different forms, no > less) is asking for trouble. Agree whole-heartedly! - Garrett > > - Bart > > > > > From gdamore@sun.com Tue Jul 21 19:53:58 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M2rwPR011258 for ; Tue, 21 Jul 2009 19:53:58 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6M2rvuq009938 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 21 Jul 2009 19:53:58 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500K03XDXRH00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 20:53:57 -0600 (MDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500HLQXDXDU10@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 20:53:57 -0600 (MDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6M2rv8r016901 for ; Tue, 21 Jul 2009 19:53:57 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN500D00XCUWJ00@fe-sfbay-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 19:53:57 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN500FICXDWIFA0@fe-sfbay-10.sun.com>; Tue, 21 Jul 2009 19:53:57 -0700 (PDT) Date: Tue, 21 Jul 2009 19:53:56 -0700 From: "Garrett D'Amore" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A667CF8.5050209@sun.com> Sender: Garrett.Damore@sun.com To: Bart Smaalders Cc: "James C. McPherson" , Nicolas Williams , PSARC-ext@sun.com Message-id: <4A667F44.2080705@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <20090722001230.GZ1020@Sun.COM> <20090722102149.00007dd9@blinder> <4A665E48.2040505@sun.com> <4A6670D6.9010809@Sun.COM> <4A667CF8.5050209@sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 732 So, now having gone over this, I'm ready to give this case a +1 conditional on the following changes: 1) The faked daemon should be Project Private, since it isn't meant to be called by end-users. (It probably doesn't need a man page for it, either.) It should live in usr/lib or somesuch, as a result. 2) The save files should be Volatile. 3) The man pages and on-line help should remove references to TCP sockets, since that functionality is not being supported (i.e. the support is not compiled into the binary). These changes may have implications for upstream, but actually I think they are beneficial for other OS' not just Solaris. If the project team agrees, please say so, and accept my +1. :-) - Garrett From danek.duvall@Sun.COM Tue Jul 21 19:58:09 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M2w8Re011627 for ; Tue, 21 Jul 2009 19:58:08 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6M2w8OO011095 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 21 Jul 2009 19:58:08 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500I0FXKWWE00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 19:58:08 -0700 (PDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500HDFXKVM510@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 19:58:07 -0700 (PDT) Received: from smelly.SFBay.Sun.COM (smelly.SFBay.Sun.COM [129.146.228.142]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M2w78T059490; Tue, 21 Jul 2009 19:58:07 -0700 (PDT) Received: from smelly.SFBay.Sun.COM (smelly [127.0.0.1]) by smelly.SFBay.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n6M2w7eH006749; Tue, 21 Jul 2009 19:58:07 -0700 (PDT) Received: (from dduvall@localhost) by smelly.SFBay.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n6M2w7Um006748; Tue, 21 Jul 2009 19:58:07 -0700 (PDT) Date: Tue, 21 Jul 2009 19:58:07 -0700 From: Danek Duvall Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A667740.6010000@sun.com> To: "U.V. Ravindra" Cc: James Walker , PSARC-ext@Sun.COM Message-id: <20090722025807.GF27041@smelly.SFBay.Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <20090721234853.GM23953@smelly.SFBay.Sun.COM> <4A667740.6010000@sun.com> User-Agent: Mutt/1.5.20 (2009-06-23) Status: RO Content-Length: 2507 On Tue, Jul 21, 2009 at 07:19:44PM -0700, U.V. Ravindra wrote: > The daemon can be run by hand, but it would be pointless. > Running faked is only useful if there's a fakeroot at the > other end telling it what to fake. Let's not put Private executables in /usr/bin. > >>Imported Interfaces Classification Comment > >>=================== ============== =========================== > >>SUNWlibms Committed Math& Microtasking Libraries (Usr) > > > >What math functions does this use? > > None, really. So why have you declared these libraries as imported interfaces? > >>Project Private > >>=============== > >>/usr/lib/libfakeroot.so.0 Library > >>/usr/lib/libfakeroot.so Symbolic link > >>/usr/lib/64/libfakeroot.so.0 library (64bit) > >>/usr/lib/64/libfakeroot.so Symbolic link (64bit) > > > >If these are project private, why have compilation symlinks? > > fakeroot ld_preloads libfakeroot.so to achieve its desired end. > Presumably this is for future "expansion"; should there be another > version of the library in a future release, say, libfakeroot.so.1, > fakeroot can continue to ld_preload libfakeroot.so as it does now. That only makes sense if there's more than one thing on the system that would use the library. Which there can't be, because you're marking the libraries Project Private. If only fakeroot will ever use this library, then it can make all the changes it likes in it, regardless of compatibility, since the command and the library ship as a unit. But if it decided to move to .so.1 for whatever reason, then the command would just change to reflect that. So there's little point in doing versioning. You should probably deliver the .so.0 versions, and remove the .so symlinks, though I'll bet it's easier to do it the other way around (i.e., you won't have to patch the script). > >Has any thought been given to having fake elevated privileges, or fake > >role assumption? > > Apologies: I am a bit unsure as to the meaning of the question. Right now, it simulates the raising of all privileges. I'm asking about whether it can simulate the raising of some subset of all privileges -- say, file_dac_write, but not sys_mount. That could help you debug a privilege-aware program. Similarly for assuming a role. I'm not suggesting you should add this functionality if it's not currently there, but as part of the whole "own it like a puppy" mantra, if these are desirable things, it would be worth exploring the implementation with the upstream folks. Danek From danek.duvall@sun.com Tue Jul 21 20:00:37 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M30a2X011707 for ; Tue, 21 Jul 2009 20:00:37 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M30RQ6012656; Wed, 22 Jul 2009 04:00:34 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500L09XOYSK00@brm-avmta-1.central.sun.com>; Tue, 21 Jul 2009 21:00:34 -0600 (MDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500H8CXOXDW20@brm-avmta-1.central.sun.com>; Tue, 21 Jul 2009 21:00:33 -0600 (MDT) Received: from smelly.SFBay.Sun.COM (smelly.SFBay.Sun.COM [129.146.228.142]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M30Wti034596; Tue, 21 Jul 2009 20:00:32 -0700 (PDT) Received: from smelly.SFBay.Sun.COM (smelly [127.0.0.1]) by smelly.SFBay.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n6M30WGa006766; Tue, 21 Jul 2009 20:00:32 -0700 (PDT) Received: (from dduvall@localhost) by smelly.SFBay.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n6M30Wxr006765; Tue, 21 Jul 2009 20:00:32 -0700 (PDT) Date: Tue, 21 Jul 2009 20:00:32 -0700 From: Danek Duvall Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A667CDD.2040707@sun.com> To: "Garrett D'Amore" Cc: U.V.Ravindra@sun.com, James.Walker@sun.com, PSARC-ext@sun.com Message-id: <20090722030032.GG27041@smelly.SFBay.Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <4A665BEB.5070509@sun.com> <4A665DC1.5020103@sun.com> <4A667061.8010404@sun.com> <4A667CDD.2040707@sun.com> User-Agent: Mutt/1.5.20 (2009-06-23) Status: RO Content-Length: 361 On Tue, Jul 21, 2009 at 07:43:41PM -0700, Garrett D'Amore wrote: > Understood. And I'm happy with that. Lets put the save files as a > Volatile interface, or even Not-An-Interface, then. Agree? They sound Project Private to me -- worth documenting, but not necessarily compatible between versions of fakeroot. Sort of like ZFS streams in that way. Danek From gdamore@sun.com Tue Jul 21 20:36:28 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M3aSqI014770 for ; Tue, 21 Jul 2009 20:36:28 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M3aO0e004877 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 04:36:27 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN500D05ZCQTN00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 20:36:26 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN500CDLZCQO3E0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 20:36:26 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6M3aQqL011310 for ; Tue, 21 Jul 2009 20:36:26 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN500A00Z0DWS00@fe-sfbay-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 20:36:26 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN500AAZZCPPV10@fe-sfbay-10.sun.com>; Tue, 21 Jul 2009 20:36:25 -0700 (PDT) Date: Tue, 21 Jul 2009 20:36:25 -0700 From: "Garrett D'Amore" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <20090722030032.GG27041@smelly.SFBay.Sun.COM> Sender: Garrett.Damore@sun.com To: Danek Duvall Cc: U.V.Ravindra@sun.com, James.Walker@sun.com, PSARC-ext@sun.com Message-id: <4A668939.5000202@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <4A665BEB.5070509@sun.com> <4A665DC1.5020103@sun.com> <4A667061.8010404@sun.com> <4A667CDD.2040707@sun.com> <20090722030032.GG27041@smelly.SFBay.Sun.COM> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 557 Danek Duvall wrote: > On Tue, Jul 21, 2009 at 07:43:41PM -0700, Garrett D'Amore wrote: > > >> Understood. And I'm happy with that. Lets put the save files as a >> Volatile interface, or even Not-An-Interface, then. Agree? >> > > They sound Project Private to me -- worth documenting, but not necessarily > compatible between versions of fakeroot. Sort of like ZFS streams in that > way. > Okay. I wasn't sure about the semantics... the contents can be project private, but their existence is something higher? - Garrett > Danek > From Darren.Reed@Sun.COM Tue Jul 21 21:57:39 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M4vcnj016282 for ; Tue, 21 Jul 2009 21:57:39 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M4vb1W017527 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 05:57:38 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN600401341NA00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 21:57:37 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600HJ6340M980@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 21 Jul 2009 21:57:37 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6M4vaIl003366 for ; Wed, 22 Jul 2009 04:57:36 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN6007002YCW600@fe-emea-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 05:57:24 +0100 (BST) Received: from [129.146.106.55] ([unknown] [129.146.106.55]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN6009TY33M7T40@fe-emea-09.sun.com>; Wed, 22 Jul 2009 05:57:24 +0100 (BST) Date: Tue, 21 Jul 2009 21:57:54 -0700 From: Darren Reed Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> Sender: Darren.Reed@Sun.COM To: U.V.Ravindra@Sun.COM Cc: James Walker , PSARC-ext@Sun.COM Message-id: <4A669C52.5070203@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.21 (X11/20090608) Status: RO Content-Length: 905 On 21/07/09 04:41 PM, James Walker wrote: > ... > List of 'Faked' Functions > ------------------------- > open, fopen, freopen, openat, lstat, stat, fstat, fstatat, lstat64, stat64, > fstat64, fstatat64, chown, lchown, fchown, fchownat, chmod, fchmod, > mknod, mkdir, unlink, unlinkat, rmdir, remove, rename, renameat, > getuid, getgid, geteuid, getegid, setuid, setgid, seteuid, setegid, > setreuid, setregid How aware of the filesystem underneath is fakeroot? Is it limited to tmpfs/UFS/ZFS? For example... If I execute chown(2) from within a fakeroot'd program that is trying to change the ownership of a file on a CD, will fakeroot make it appear as if it worked? Can I make it appear as if I can rename files on a CD? etc. ... the man page gives me no indication of whether or not it respects filesystem properties (which not even root can over ride unless the filesystem is remounted.) Darren From Nicolas.Williams@sun.com Tue Jul 21 22:23:32 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M5NWTe016754 for ; Tue, 21 Jul 2009 22:23:32 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6M5NVOv007410; Tue, 21 Jul 2009 22:23:31 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN600H034B6GI00@brm-avmta-1.central.sun.com>; Tue, 21 Jul 2009 23:23:30 -0600 (MDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600HP74B6DZA0@brm-avmta-1.central.sun.com>; Tue, 21 Jul 2009 23:23:30 -0600 (MDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n6M5Kcxw002780; Wed, 22 Jul 2009 00:20:38 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n6M5KcNp002779; Wed, 22 Jul 2009 00:20:38 -0500 (CDT) Date: Wed, 22 Jul 2009 00:20:38 -0500 From: Nicolas Williams Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <20090722102149.00007dd9@blinder> To: "James C. McPherson" Cc: PSARC-ext@sun.com Message-id: <20090722052038.GB1020@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <20090722001230.GZ1020@Sun.COM> <20090722102149.00007dd9@blinder> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 875 On Wed, Jul 22, 2009 at 10:21:49AM +1000, James C. McPherson wrote: > On Tue, 21 Jul 2009 19:12:30 -0500 > Nicolas Williams wrote: > > > On Tue, Jul 21, 2009 at 04:53:48PM -0700, Garrett D'Amore wrote: > > > I don't understand the point of this. Why is this kind of emulation > > > helpful? Is this just to create honeypot? Or am I missing something. > > > > No. Remember when ON had to be built as UID 0? It's for that sort of > > purpose. > > ... something that I'm working hard to fully remove. Requiring a > build as uid 0 has long since past its use-by date. ON is not the only thing of its kind in the world. fakeroot, and a number of similar LD_PRELOAD-based tools are useful. Since all they do is LD_PRELOAD an object (or pair of them, 32- and 64-bit), there's nothing really very controversial about them as a group. Nico -- From danek.duvall@sun.com Tue Jul 21 22:25:43 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M5PhM0016799 for ; Tue, 21 Jul 2009 22:25:43 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6M5PhZ2028443; Tue, 21 Jul 2009 22:25:43 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN6006014EURR00@nwk-avmta-2.sfbay.sun.com>; Tue, 21 Jul 2009 22:25:43 -0700 (PDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600HON4EUM4A0@nwk-avmta-2.sfbay.sun.com>; Tue, 21 Jul 2009 22:25:42 -0700 (PDT) Received: from smelly.SFBay.Sun.COM (smelly.SFBay.Sun.COM [129.146.228.142]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M5PgGf054779; Tue, 21 Jul 2009 22:25:42 -0700 (PDT) Received: from smelly.SFBay.Sun.COM (smelly [127.0.0.1]) by smelly.SFBay.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n6M5Pg4K007073; Tue, 21 Jul 2009 22:25:42 -0700 (PDT) Received: (from dduvall@localhost) by smelly.SFBay.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n6M5PgqD007072; Tue, 21 Jul 2009 22:25:42 -0700 (PDT) Date: Tue, 21 Jul 2009 22:25:42 -0700 From: Danek Duvall Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A668939.5000202@sun.com> To: "Garrett D'Amore" Cc: U.V.Ravindra@sun.com, James.Walker@sun.com, PSARC-ext@sun.com Message-id: <20090722052542.GH27041@smelly.SFBay.Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <4A665BEB.5070509@sun.com> <4A665DC1.5020103@sun.com> <4A667061.8010404@sun.com> <4A667CDD.2040707@sun.com> <20090722030032.GG27041@smelly.SFBay.Sun.COM> <4A668939.5000202@sun.com> User-Agent: Mutt/1.5.20 (2009-06-23) Status: RO Content-Length: 930 On Tue, Jul 21, 2009 at 08:36:25PM -0700, Garrett D'Amore wrote: > Danek Duvall wrote: > >On Tue, Jul 21, 2009 at 07:43:41PM -0700, Garrett D'Amore wrote: > > > >>Understood. And I'm happy with that. Lets put the save files as a > >>Volatile interface, or even Not-An-Interface, then. Agree? > > > >They sound Project Private to me -- worth documenting, but not necessarily > >compatible between versions of fakeroot. Sort of like ZFS streams in that > >way. > > Okay. I wasn't sure about the semantics... the contents can be > project private, but their existence is something higher? The save files themselves are created on behalf of the user at a user-given location. I wouldn't consider their existence or anything about their location an interface. The only Public interface involved are the -s and -i options, which presumably fall under the generic "Uncommitted" classification that fakeroot itself does. Danek From u.v.ravindra@sun.com Tue Jul 21 22:45:31 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M5jVco016892 for ; Tue, 21 Jul 2009 22:45:31 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6M5jSsd011194; Wed, 22 Jul 2009 06:45:28 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN600H035BPE000@nwk-avmta-1.sfbay.Sun.COM>; Tue, 21 Jul 2009 22:45:25 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600FSL5BORI70@nwk-avmta-1.sfbay.Sun.COM>; Tue, 21 Jul 2009 22:45:24 -0700 (PDT) Received: from mahogany.local (punchin-client-10-7-250-69.SFBay.Sun.COM [10.7.250.69]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6M5jNH5996314; Tue, 21 Jul 2009 22:45:23 -0700 (PDT) Date: Tue, 21 Jul 2009 22:45:25 -0700 From: "U.V. Ravindra" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A669C52.5070203@Sun.COM> To: Darren Reed Cc: James Walker , PSARC-ext@sun.com Reply-to: u.v.ravindra@sun.com Message-id: <4A66A775.9060102@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A669C52.5070203@Sun.COM> User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9.1b3pre) Gecko/20090223 Thunderbird/3.0b2 Status: RO Content-Length: 1297 Darren Reed wrote on Tue Jul 21 2009 21:57:54 GMT-0700 (PDT) : > On 21/07/09 04:41 PM, James Walker wrote: >> ... >> List of 'Faked' Functions >> ------------------------- >> open, fopen, freopen, openat, lstat, stat, fstat, fstatat, lstat64, >> stat64, >> fstat64, fstatat64, chown, lchown, fchown, fchownat, chmod, fchmod, >> mknod, mkdir, unlink, unlinkat, rmdir, remove, rename, renameat, >> getuid, getgid, geteuid, getegid, setuid, setgid, seteuid, setegid, >> setreuid, setregid > > How aware of the filesystem underneath is fakeroot? > Is it limited to tmpfs/UFS/ZFS? > > For example... > > If I execute chown(2) from within a fakeroot'd program that > is trying to change the ownership of a file on a CD, > will fakeroot make it appear as if it worked? > Can I make it appear as if I can rename files on a CD? > etc. I don't think so. I didn't test the cdrom case, but I tried to chown a file on NFS which root didn't have permissions to chown. The fakeroot'ed process failed to chown with the same error the real root process failed with. I assume the same will be true for files on a CD. -Ravindra. > ... the man page gives me no indication of whether or not it > respects filesystem properties (which not even root can > over ride unless the filesystem is remounted.) > > Darren From u.v.ravindra@sun.com Tue Jul 21 22:55:31 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6M5tV1u017311 for ; Tue, 21 Jul 2009 22:55:31 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6M5tSa7006023; Tue, 21 Jul 2009 22:55:30 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN600L0F5SH1K00@brm-avmta-1.central.sun.com>; Tue, 21 Jul 2009 23:55:29 -0600 (MDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600H105SGDWD0@brm-avmta-1.central.sun.com>; Tue, 21 Jul 2009 23:55:28 -0600 (MDT) Received: from mahogany.local (punchin-client-10-7-250-69.SFBay.Sun.COM [10.7.250.69]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6M5tR4T996759; Tue, 21 Jul 2009 22:55:28 -0700 (PDT) Date: Tue, 21 Jul 2009 22:55:29 -0700 From: "U.V. Ravindra" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A667CDD.2040707@sun.com> To: "Garrett D'Amore" Cc: James.Walker@sun.com, James Walker , PSARC-ext@sun.com Reply-to: u.v.ravindra@sun.com Message-id: <4A66A9D1.8060701@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <4A665BEB.5070509@sun.com> <4A665DC1.5020103@sun.com> <4A667061.8010404@sun.com> <4A667CDD.2040707@sun.com> User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9.1b3pre) Gecko/20090223 Thunderbird/3.0b2 Status: RO Content-Length: 1937 Garrett D'Amore wrote on Tue Jul 21 2009 19:43:41 GMT-0700 (PDT) : > U.V. Ravindra wrote: >> >>> What is the stability of the save files? >> >> They are not considered stable. >> >> The save files are only useful if the user wants to preserve >> the 'fake' appearances from one session to the next. To use >> the mknod example from above, if the user exited the fakeroot >> session without storing to a save file, all the fake information >> will be lost. The next time the user starts a fakeroot session, >> the 'mknod'ed file will be reported only as a regular file. >> On the other hand if the session were to be saved and reloaded >> in the new session, it will be reported as a block special file. >> >> The files can be removed or edited outside of the fakeroot >> session. If this is done, some or all information in them >> can be lost. > > Understood. And I'm happy with that. Lets put the save files as a > Volatile interface, or even Not-An-Interface, then. Agree? Agree. I'll mark them Volatile. >>> The --cleanup makes references to semaphores, but I don't see >>> information about how those are used/created? How is faked started? >>> Automatically by fakeroot, or via some other scheme? >> >> It's started automatically by fakeroot. It can be invoked by >> the user directly, but that won't be of any use unless there's >> a fakeroot at the other end. > > Okay. Probably the man page should have stated that... if it did I > missed it. But then I missed so much other material in the case review > up front, I am hesitant to make any other claims about the case > materials and put yet more egg on my face. :-) The man page doesn't say this. In fact, the man pages are woefully inadequate, but I refrained from "patching" them too much for fear of diverging the documentation too far from the one that came with the F/OSS tarball. If this information is deemed mandatory for the man page, I can add it. -Ravindra. From Joerg.Schilling9ab33xy531fokus.fraunhofer.de@bounce.antispameurope.com Wed Jul 22 05:18:31 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MCIUXJ000081 for ; Wed, 22 Jul 2009 05:18:31 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6MCITiJ038703 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 06:18:30 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN60030XNIT5900@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 05:18:29 -0700 (PDT) Received: from sca-ea-mail-3.sun.com ([192.18.43.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600BH3NIRAO90@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 05:18:28 -0700 (PDT) Received: from relay43i.sun.com ([192.5.209.74]) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6MC9oGu010144 for ; Wed, 22 Jul 2009 12:18:27 +0000 (GMT) Received: from mms49es.mms.us.syntegra.com ([160.41.221.232] [160.41.221.232]) by relay43i.sun.com with ESMTP id BT-MMP-621178 for PSARC-ext@sun.com; Wed, 22 Jul 2009 12:18:26 +0000 (Z) Received: from relay43i.sun.com (relay43i.sun.com [192.5.209.74]) by mms49es.mms.us.syntegra.com with ESMTP id BT-MMP-11219353 for PSARC-ext@sun.com; Wed, 22 Jul 2009 12:17:02 +0000 (Z) Received: from relay03-haj2.antispameurope.com ([83.246.65.53] [83.246.65.53]) by relay4i.sun.com with ESMTP id BT-MMP-9672767 for PSARC-ext@sun.com; Wed, 22 Jul 2009 12:17:02 +0000 (Z) Received: by relay03-haj2.antispameurope.com (ASE-Secure-MTA, from userid 1000) id D74A763C0CB; Wed, 22 Jul 2009 14:16:31 +0200 (CEST) Received: from pluto.fokus.fraunhofer.de (pluto.fokus.fraunhofer.de [195.37.77.164]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by relay03-haj2.antispameurope.com (ASE-Secure-MTA) with ESMTP id 393F663C0BC; Wed, 22 Jul 2009 14:16:31 +0200 (CEST) Received: from EXCHSRV.fokus.fraunhofer.de (bohr.fokus.fraunhofer.de [10.147.9.231]) by pluto.fokus.fraunhofer.de (8.14.2/8.14.2) with SMTP id n6MCGUpB011623; Wed, 22 Jul 2009 14:16:30 +0200 (MEST) Received: from rigel ([10.147.65.195]) by EXCHSRV.fokus.fraunhofer.de with Microsoft SMTPSVC(6.0.3790.3959); Wed, 22 Jul 2009 14:16:30 +0200 Date: Wed, 22 Jul 2009 14:16:21 +0200 From: Joerg.Schilling@fokus.fraunhofer.de (Joerg Schilling) Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <20090721234853.GM23953@smelly.SFBay.Sun.COM> Sender: Joerg.Schilling9ab33xy531fokus.fraunhofer.de@bounce.antispameurope.com To: jw137282@sac.sfbay.sun.com, danek.duvall@sun.com Cc: U.V.Ravindra@sun.com, PSARC-ext@sun.com Message-id: <4a670315.K2iCyr1s+vFA0sr8%Joerg.Schilling@fokus.fraunhofer.de> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 8BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 3.478sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <20090721234853.GM23953@smelly.SFBay.Sun.COM> User-Agent: nail 11.22 3/20/05 X-OriginalArrivalTime: 22 Jul 2009 12:16:30.0405 (UTC) FILETIME=[3EA16F50:01CA0AC6] Status: RO Content-Length: 855 Danek Duvall wrote: > On Tue, Jul 21, 2009 at 04:41:00PM -0700, James Walker wrote: > > > Exported Interfaces Classification Comment > > =================== ============== =================== > > SUNWfakeroot Uncommitted Package > > > > /usr/bin/fakeroot Uncommitted Command > > /usr/bin/faked Uncommitted Daemon > > Is there any point in running the daemon by hand, or should that be a > Private interface, stuck off in /usr/lib? "fakeroot" is a shell script that starts "faked", I believe faked should therefore be in /usr/lib/ Jörg -- EMail:joerg@schily.isdn.cs.tu-berlin.de (home) Jörg Schilling D-13353 Berlin js@cs.tu-berlin.de (uni) joerg.schilling@fokus.fraunhofer.de (work) Blog: http://schily.blogspot.com/ URL: http://cdrecord.berlios.de/private/ ftp://ftp.berlios.de/pub/schily From Joerg.Schilling9ab33xy531fokus.fraunhofer.de@bounce.antispameurope.com Wed Jul 22 05:37:39 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MCbcdv000383 for ; Wed, 22 Jul 2009 05:37:39 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6MCbbOa047044 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 06:37:38 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN600E0JOEP3000@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 05:37:37 -0700 (PDT) Received: from sca-ea-mail-3.sun.com ([192.18.43.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600850OEPXT40@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 05:37:37 -0700 (PDT) Received: from relay41i.sun.com ([192.5.209.70]) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6MCWZBC015685 for ; Wed, 22 Jul 2009 12:37:36 +0000 (GMT) Received: from mms48es.mms.us.syntegra.com ([160.41.221.230] [160.41.221.230]) by relay41i.sun.com with ESMTP id BT-MMP-599998 for PSARC-ext@sun.com; Wed, 22 Jul 2009 12:37:36 +0000 (Z) Received: from relay43i.sun.com (relay43i.sun.com [192.5.209.74]) by mms48es.mms.us.syntegra.com with ESMTP id BT-MMP-11211664 for PSARC-ext@sun.com; Wed, 22 Jul 2009 12:37:30 +0000 (Z) Received: from relay01-haj2.antispameurope.com ([83.246.65.51] [83.246.65.51]) by relay4i.sun.com with ESMTP id BT-MMP-9706384 for PSARC-ext@sun.com; Wed, 22 Jul 2009 12:37:30 +0000 (Z) Received: by relay01-haj2.antispameurope.com (ASE-Secure-MTA, from userid 1000) id 47E2E160031; Wed, 22 Jul 2009 14:37:29 +0200 (CEST) Received: from pluto.fokus.fraunhofer.de (pluto.fokus.fraunhofer.de [195.37.77.164]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by relay01-haj2.antispameurope.com (ASE-Secure-MTA) with ESMTP id 83F0516002B; Wed, 22 Jul 2009 14:37:28 +0200 (CEST) Received: from EXCHSRV.fokus.fraunhofer.de (bohr.fokus.fraunhofer.de [10.147.9.231]) by pluto.fokus.fraunhofer.de (8.14.2/8.14.2) with SMTP id n6MCbRVI012088; Wed, 22 Jul 2009 14:37:27 +0200 (MEST) Received: from rigel ([10.147.65.195]) by EXCHSRV.fokus.fraunhofer.de with Microsoft SMTPSVC(6.0.3790.3959); Wed, 22 Jul 2009 14:37:26 +0200 Date: Wed, 22 Jul 2009 14:37:18 +0200 From: Joerg.Schilling@fokus.fraunhofer.de (Joerg Schilling) Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A66550C.7000203@sun.com> Sender: Joerg.Schilling9ab33xy531fokus.fraunhofer.de@bounce.antispameurope.com To: jw137282@sac.sfbay.sun.com, gdamore@sun.com Cc: U.V.Ravindra@sun.com, PSARC-ext@sun.com Message-id: <4a6707fe.QJSzIkTVvu7mpI2j%Joerg.Schilling@fokus.fraunhofer.de> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 8BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 3.276sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> User-Agent: nail 11.22 3/20/05 X-OriginalArrivalTime: 22 Jul 2009 12:37:26.0984 (UTC) FILETIME=[2B9C2C80:01CA0AC9] Status: RO Content-Length: 588 "Garrett D'Amore" wrote: > I don't understand the point of this. Why is this kind of emulation > helpful? Is this just to create honeypot? Or am I missing something. It is needed in order to deal with the inconvenient design of package creation tools such as pkgmk. Jörg -- EMail:joerg@schily.isdn.cs.tu-berlin.de (home) Jörg Schilling D-13353 Berlin js@cs.tu-berlin.de (uni) joerg.schilling@fokus.fraunhofer.de (work) Blog: http://schily.blogspot.com/ URL: http://cdrecord.berlios.de/private/ ftp://ftp.berlios.de/pub/schily From Joerg.Schilling9ab33xy531fokus.fraunhofer.de@bounce.antispameurope.com Wed Jul 22 05:46:42 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MCkfna000510 for ; Wed, 22 Jul 2009 05:46:42 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6MCkeT1005183 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 05:46:41 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN600J0NOTR2Q00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 06:46:39 -0600 (MDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600FSCOTRUV10@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 06:46:39 -0600 (MDT) Received: from relay42i.sun.com ([192.5.209.72]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6MCRPXP015780 for ; Wed, 22 Jul 2009 12:46:38 +0000 (GMT) Received: from mmp42es.mmp.us.syntegra.com ([160.41.221.11] [160.41.221.11]) by relay42i.sun.com with ESMTP id BT-MMP-624247 for PSARC-ext@sun.com; Wed, 22 Jul 2009 12:46:38 +0000 (Z) Received: from relay42i.sun.com (relay42i.sun.com [192.5.209.72]) by mmp42es.mmp.us.syntegra.com with ESMTP id BT-MMP-13519494 for PSARC-ext@sun.com; Wed, 22 Jul 2009 12:46:33 +0000 (Z) Received: from relay02-haj2.antispameurope.com ([83.246.65.52] [83.246.65.52]) by relay4i.sun.com with ESMTP id BT-MMP-14639606 for PSARC-ext@sun.com; Wed, 22 Jul 2009 12:46:33 +0000 (Z) Received: by relay02-haj2.antispameurope.com (ASE-Secure-MTA, from userid 1000) id 07DEF6F051C; Wed, 22 Jul 2009 14:46:01 +0200 (CEST) Received: from pluto.fokus.fraunhofer.de (pluto.fokus.fraunhofer.de [195.37.77.164]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by relay02-haj2.antispameurope.com (ASE-Secure-MTA) with ESMTP id 8E11E6F043A; Wed, 22 Jul 2009 14:46:01 +0200 (CEST) Received: from EXCHSRV.fokus.fraunhofer.de (bohr.fokus.fraunhofer.de [10.147.9.231]) by pluto.fokus.fraunhofer.de (8.14.2/8.14.2) with SMTP id n6MCk1cW012276; Wed, 22 Jul 2009 14:46:01 +0200 (MEST) Received: from rigel ([10.147.65.195]) by EXCHSRV.fokus.fraunhofer.de with Microsoft SMTPSVC(6.0.3790.3959); Wed, 22 Jul 2009 14:46:02 +0200 Date: Wed, 22 Jul 2009 14:45:53 +0200 From: Joerg.Schilling@fokus.fraunhofer.de (Joerg Schilling) Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A665E48.2040505@sun.com> Sender: Joerg.Schilling9ab33xy531fokus.fraunhofer.de@bounce.antispameurope.com To: James.McPherson@sun.com, gdamore@sun.com Cc: PSARC-ext@sun.com Message-id: <4a670a01.5iKIU2E5sNTBGOGn%Joerg.Schilling@fokus.fraunhofer.de> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 8BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 3.069sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <4A66550C.7000203@sun.com> <20090722001230.GZ1020@Sun.COM> <20090722102149.00007dd9@blinder> <4A665E48.2040505@sun.com> User-Agent: nail 11.22 3/20/05 X-OriginalArrivalTime: 22 Jul 2009 12:46:02.0106 (UTC) FILETIME=[5EA58DA0:01CA0ACA] Status: RO Content-Length: 841 "Garrett D'Amore" wrote: > > ... something that I'm working hard to fully remove. Requiring a > > build as uid 0 has long since past its use-by date. > > > > With smarter archiving tools, we wouldn't need it. (Actually, I Star is e.g. able to read a file with a similar syntax as the "prototype" file from SVr4 packages. If you would pass the "f" and "d" type lines with the first two columns removed into star -c pkglist=name -Hcpio > out star would take user/group and permissin from the prototype information. Jörg -- EMail:joerg@schily.isdn.cs.tu-berlin.de (home) Jörg Schilling D-13353 Berlin js@cs.tu-berlin.de (uni) joerg.schilling@fokus.fraunhofer.de (work) Blog: http://schily.blogspot.com/ URL: http://cdrecord.berlios.de/private/ ftp://ftp.berlios.de/pub/schily From carlsonj@workingcode.com Wed Jul 22 08:03:30 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MF3TdE001149 for ; Wed, 22 Jul 2009 08:03:29 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6MF3QAE060925; Wed, 22 Jul 2009 09:03:28 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN600B05V5M3500@nwk-avmta-1.sfbay.Sun.COM>; Wed, 22 Jul 2009 08:03:22 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN6000N7V5L4A90@nwk-avmta-1.sfbay.Sun.COM>; Wed, 22 Jul 2009 08:03:22 -0700 (PDT) Received: from relay42i.sun.com ([192.5.209.72]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6MEvBnv008873; Wed, 22 Jul 2009 15:03:21 +0000 (GMT) Received: from mms49es.mms.us.syntegra.com ([160.41.221.232] [160.41.221.232]) by relay42i.sun.com with ESMTP id BT-MMP-641628; Wed, 22 Jul 2009 15:03:20 +0000 (Z) Received: from relay43i.sun.com (relay43i.sun.com [192.5.209.74]) by mms49es.mms.us.syntegra.com with ESMTP id BT-MMP-11477149; Wed, 22 Jul 2009 15:02:40 +0000 (Z) Received: from carlson.workingcode.com ([75.150.68.97] [75.150.68.97]) by relay4i.sun.com with ESMTP id BT-MMP-9951458; Wed, 22 Jul 2009 15:02:40 +0000 (Z) Received: from [10.50.24.188] (gate.abinitio.com [65.170.40.132]) (authenticated bits=0) by carlson.workingcode.com (8.14.2+Sun/8.14.3) with ESMTP id n6MF2Sn7027018 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 22 Jul 2009 11:02:29 -0400 (EDT) Date: Wed, 22 Jul 2009 11:02:28 -0400 From: James Carlson Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A667740.6010000@sun.com> To: U.V.Ravindra@sun.com Cc: Danek Duvall , PSARC-ext@sun.com, James Walker Message-id: <4A672A04.5040709@workingcode.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-DCC-x.dcc-servers-Metrics: carlson 104; Body=4 Fuz1=4 Fuz2=4 X-Antispam: No, score=-0.2/5.0, scanned in 0.132sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <20090721234853.GM23953@smelly.SFBay.Sun.COM> <4A667740.6010000@sun.com> User-Agent: Thunderbird 2.0.0.22 (X11/20090605) Status: RO Content-Length: 1906 U.V. Ravindra wrote: > Danek Duvall wrote at Tue Jul 21 2009 16:48:53 GMT-0700 (PDT): >> Has any thought been given to having fake elevated privileges, or fake >> role >> assumption? > > Apologies: I am a bit unsure as to the meaning of the question. > > If you are asking whether fakeroot can cause privilege escalation > or allow the user to assume roles s/he is not allowed to assume, > then the answer is it cannot. > > If, OTOH, your question is whether fakeroot can give the impression > of privilege escalation, then yes, that's what it is basically > designed for. When a user runs (a command under) fakeroot, s/he > is fakely reported (to the command) as being root. So, the command > thinks the user has all privileges. I think the question was whether "fakeroot" could provide the application with an environment in which the application 'thought' that it had some set of privileges, even though it didn't. It's a logical extension of "fakeroot" into the Solaris architecture. Because of Least Privilege, there's not really the "all powerful root" on Solaris as there is on other platforms. The current "fakeroot" emulates that old-school all-powerful root by creating an environment for the application where it appears as though all privileges were granted. But the question is whether "fakeroot" could be extended to make it appear as though some specified set of privileges were set. It'd be an interesting idea for testing, but I think it'd actually be counter-productive to do this. The problem is that the actual privilege enforcement (and thus the effects of each privilege bit) are hard-coded into the kernel itself. There's no good way to replicate that logic out into a user-space wrapper so that the code somehow 'knows' whether a given system call should have succeeded give a privilege set. -- James Carlson 42.703N 71.076W From Darren.Moffat@sun.com Wed Jul 22 08:19:18 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MFJHBT005715 for ; Wed, 22 Jul 2009 08:19:18 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n6MFJFv8012202 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 23:19:16 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN600A0LVW4QF00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 09:19:16 -0600 (MDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600FBZVVXV4B0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 09:19:15 -0600 (MDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6MFJ88L010961 for ; Wed, 22 Jul 2009 15:19:08 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN600500UNMCW00@fe-emea-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 16:18:54 +0100 (BST) Received: from [129.156.173.199] ([unknown] [129.156.173.199]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN60022PVVFFO00@fe-emea-10.sun.com>; Wed, 22 Jul 2009 16:18:52 +0100 (BST) Date: Wed, 22 Jul 2009 16:18:51 +0100 From: Darren J Moffat Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A672A04.5040709@workingcode.com> Sender: Darren.Moffat@sun.com To: James Carlson Cc: U.V.Ravindra@sun.com, Danek Duvall , PSARC-ext@sun.com, James Walker Message-id: <4A672DDB.6070508@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <20090721234853.GM23953@smelly.SFBay.Sun.COM> <4A667740.6010000@sun.com> <4A672A04.5040709@workingcode.com> User-Agent: Thunderbird 2.0.0.18 (X11/20090127) Status: RO Content-Length: 1324 James Carlson wrote: > It'd be an interesting idea for testing, but I think it'd actually be > counter-productive to do this. The problem is that the actual privilege > enforcement (and thus the effects of each privilege bit) are hard-coded > into the kernel itself. There's no good way to replicate that logic out > into a user-space wrapper so that the code somehow 'knows' whether a > given system call should have succeeded give a privilege set. Also for privilege debugging it shouldn't be necessary. This is what the "Privilege Debug Mode" is for see ppriv(1). For the cases where that isn't sufficient or accurate then the Sun Blueprint "Privilege Debugging in the Solaris 10 Operating System"[1] is useful. [1] http://www.sun.com/blueprints/0206/819-5507.pdf Not that I'm biased by being a co-author on the above blueprint, but I think that is a better way of dealing with privilege debugging that attempting to do a "fakeroot" for privileges which by its very nature of being upstream will rot and be wrong. It will also be even more of an issue if/when FMAC makes its way into OpenSolaris distributions. Having said all that I have no problem with fakeroot being delivered. I would have possible issues if I see OpenSolaris originated projects wanting to depend on fakeroot. -- Darren J Moffat From Scott.Rotondo@sun.com Wed Jul 22 08:21:33 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MFLW96005733 for ; Wed, 22 Jul 2009 08:21:33 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n6MFLGtG012992 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 23:21:32 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN600A11VZVZ800@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 09:21:31 -0600 (MDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600FCTVZVV5C0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 09:21:31 -0600 (MDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6MFLVJR008491 for ; Wed, 22 Jul 2009 15:21:31 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN600500VNGU300@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 09:21:31 -0600 (MDT) Received: from viaggio.local ([unknown] [69.226.231.187]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN600GPUVZJEJD0@mail-amer.sun.com>; Wed, 22 Jul 2009 09:21:19 -0600 (MDT) Date: Wed, 22 Jul 2009 08:21:22 -0700 From: Scott Rotondo Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A672A04.5040709@workingcode.com> Sender: Scott.Rotondo@sun.com To: James Carlson Cc: U.V.Ravindra@sun.com, Danek Duvall , PSARC-ext@sun.com, James Walker Message-id: <4A672E72.4080305@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <20090721234853.GM23953@smelly.SFBay.Sun.COM> <4A667740.6010000@sun.com> <4A672A04.5040709@workingcode.com> User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) Status: RO Content-Length: 1185 James Carlson wrote: > I think the question was whether "fakeroot" could provide the > application with an environment in which the application 'thought' that > it had some set of privileges, even though it didn't. > > It's a logical extension of "fakeroot" into the Solaris architecture. > Because of Least Privilege, there's not really the "all powerful root" > on Solaris as there is on other platforms. The current "fakeroot" > emulates that old-school all-powerful root by creating an environment > for the application where it appears as though all privileges were granted. Actually, if I understood the man page correctly, it sounds like fakeroot today emulates a subset of the traditional root powers. It's approximately equivalent to a process with various file_* privileges. Something like "fakefileprivs" might be a more accurate name, but it's too cumbersome. :-) Of course, the set of privileges it emulates is fixed. Danek was asking whether it could/should be extended to allow the set to be specified. Scott -- Scott Rotondo Principal Engineer, Solaris Security Technologies President, Trusted Computing Group Phone/FAX: +1 408 850 3655 (Internal x68278) From gdamore@sun.com Wed Jul 22 08:23:53 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MFNqFC005774 for ; Wed, 22 Jul 2009 08:23:53 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6MFNkF1028220 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 16:23:51 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN600B0BW3O7U00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 09:23:48 -0600 (MDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600FNHW3NUZC0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 09:23:47 -0600 (MDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6MFNl4D011867 for ; Wed, 22 Jul 2009 08:23:47 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN600000VR0IF00@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 08:23:47 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN6008I8W3MFD00@fe-sfbay-09.sun.com>; Wed, 22 Jul 2009 08:23:46 -0700 (PDT) Date: Wed, 22 Jul 2009 08:23:46 -0700 From: "Garrett D'Amore" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A672DDB.6070508@Sun.COM> Sender: Garrett.Damore@sun.com To: Darren J Moffat Cc: James Carlson , U.V.Ravindra@sun.com, Danek Duvall , PSARC-ext@sun.com, James Walker Message-id: <4A672F02.5080703@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <20090721234853.GM23953@smelly.SFBay.Sun.COM> <4A667740.6010000@sun.com> <4A672A04.5040709@workingcode.com> <4A672DDB.6070508@Sun.COM> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 1465 Darren J Moffat wrote: > James Carlson wrote: >> It'd be an interesting idea for testing, but I think it'd actually be >> counter-productive to do this. The problem is that the actual privilege >> enforcement (and thus the effects of each privilege bit) are hard-coded >> into the kernel itself. There's no good way to replicate that logic out >> into a user-space wrapper so that the code somehow 'knows' whether a >> given system call should have succeeded give a privilege set. > > Also for privilege debugging it shouldn't be necessary. This is what > the "Privilege Debug Mode" is for see ppriv(1). For the cases where > that isn't sufficient or accurate then the Sun Blueprint > "Privilege Debugging in the Solaris 10 Operating System"[1] is useful. > > [1] http://www.sun.com/blueprints/0206/819-5507.pdf > > Not that I'm biased by being a co-author on the above blueprint, but I > think that is a better way of dealing with privilege debugging that > attempting to do a "fakeroot" for privileges which by its very nature > of being upstream will rot and be wrong. > > It will also be even more of an issue if/when FMAC makes its way into > OpenSolaris distributions. > > Having said all that I have no problem with fakeroot being delivered. > I would have possible issues if I see OpenSolaris originated projects > wanting to depend on fakeroot. Agreed. Do you want to derail the case to generate an opinion to this effect? - Garrett From Darren.Moffat@Sun.COM Wed Jul 22 08:31:03 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MFV3M5005808 for ; Wed, 22 Jul 2009 08:31:03 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6MFUuh4005471 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 08:31:03 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN600B0PWFPYJ00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 09:31:01 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN600F8YWFJV8E0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 09:31:00 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6MFUsaF029951 for ; Wed, 22 Jul 2009 15:30:55 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN600K00WAB8K00@fe-emea-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 16:30:53 +0100 (BST) Received: from [129.156.173.199] ([unknown] [129.156.173.199]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN600MM7WFBBZ10@fe-emea-09.sun.com>; Wed, 22 Jul 2009 16:30:48 +0100 (BST) Date: Wed, 22 Jul 2009 16:30:47 +0100 From: Darren J Moffat Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A672F02.5080703@sun.com> Sender: Darren.Moffat@Sun.COM To: "Garrett D'Amore" Cc: James Carlson , U.V.Ravindra@Sun.COM, Danek Duvall , PSARC-ext@Sun.COM, James Walker Message-id: <4A6730A7.9080902@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <20090721234853.GM23953@smelly.SFBay.Sun.COM> <4A667740.6010000@sun.com> <4A672A04.5040709@workingcode.com> <4A672DDB.6070508@Sun.COM> <4A672F02.5080703@sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20090127) Status: RO Content-Length: 1582 Garrett D'Amore wrote: > Darren J Moffat wrote: >> James Carlson wrote: >>> It'd be an interesting idea for testing, but I think it'd actually be >>> counter-productive to do this. The problem is that the actual privilege >>> enforcement (and thus the effects of each privilege bit) are hard-coded >>> into the kernel itself. There's no good way to replicate that logic out >>> into a user-space wrapper so that the code somehow 'knows' whether a >>> given system call should have succeeded give a privilege set. >> >> Also for privilege debugging it shouldn't be necessary. This is what >> the "Privilege Debug Mode" is for see ppriv(1). For the cases where >> that isn't sufficient or accurate then the Sun Blueprint >> "Privilege Debugging in the Solaris 10 Operating System"[1] is useful. >> >> [1] http://www.sun.com/blueprints/0206/819-5507.pdf >> >> Not that I'm biased by being a co-author on the above blueprint, but I >> think that is a better way of dealing with privilege debugging that >> attempting to do a "fakeroot" for privileges which by its very nature >> of being upstream will rot and be wrong. >> >> It will also be even more of an issue if/when FMAC makes its way into >> OpenSolaris distributions. >> >> Having said all that I have no problem with fakeroot being delivered. >> I would have possible issues if I see OpenSolaris originated projects >> wanting to depend on fakeroot. > > Agreed. Do you want to derail the case to generate an opinion to this > effect? Nope I think this email in the case log is sufficient. -- Darren J Moffat From gdamore@sun.com Wed Jul 22 08:36:02 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MFa2uL005851 for ; Wed, 22 Jul 2009 08:36:02 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n6MFa2LS013527 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 09:36:02 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN60010LWO0YB00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 08:36:00 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN6000X5WNZ1130@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 08:35:59 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6MFZxc3013240 for ; Wed, 22 Jul 2009 08:35:59 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN600J00WHFFS00@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 08:35:59 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN60083EWNYFD50@fe-sfbay-09.sun.com>; Wed, 22 Jul 2009 08:35:59 -0700 (PDT) Date: Wed, 22 Jul 2009 08:35:58 -0700 From: "Garrett D'Amore" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A6730A7.9080902@Sun.COM> Sender: Garrett.Damore@sun.com To: Darren J Moffat Cc: James Carlson , U.V.Ravindra@sun.com, Danek Duvall , PSARC-ext@sun.com, James Walker Message-id: <4A6731DE.5080009@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <20090721234853.GM23953@smelly.SFBay.Sun.COM> <4A667740.6010000@sun.com> <4A672A04.5040709@workingcode.com> <4A672DDB.6070508@Sun.COM> <4A672F02.5080703@sun.com> <4A6730A7.9080902@Sun.COM> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 1855 Darren J Moffat wrote: > Garrett D'Amore wrote: >> Darren J Moffat wrote: >>> James Carlson wrote: >>>> It'd be an interesting idea for testing, but I think it'd actually be >>>> counter-productive to do this. The problem is that the actual >>>> privilege >>>> enforcement (and thus the effects of each privilege bit) are >>>> hard-coded >>>> into the kernel itself. There's no good way to replicate that >>>> logic out >>>> into a user-space wrapper so that the code somehow 'knows' whether a >>>> given system call should have succeeded give a privilege set. >>> >>> Also for privilege debugging it shouldn't be necessary. This is >>> what the "Privilege Debug Mode" is for see ppriv(1). For the cases >>> where that isn't sufficient or accurate then the Sun Blueprint >>> "Privilege Debugging in the Solaris 10 Operating System"[1] is useful. >>> >>> [1] http://www.sun.com/blueprints/0206/819-5507.pdf >>> >>> Not that I'm biased by being a co-author on the above blueprint, but >>> I think that is a better way of dealing with privilege debugging >>> that attempting to do a "fakeroot" for privileges which by its very >>> nature of being upstream will rot and be wrong. >>> >>> It will also be even more of an issue if/when FMAC makes its way >>> into OpenSolaris distributions. >>> >>> Having said all that I have no problem with fakeroot being >>> delivered. I would have possible issues if I see OpenSolaris >>> originated projects wanting to depend on fakeroot. >> >> Agreed. Do you want to derail the case to generate an opinion to >> this effect? > > Nope I think this email in the case log is sufficient. > Ok, thanks. I haven't heard the project team agree to the various changes, specifically that faked should be in /usr/lib, and making sure that references to TCP are removed from any usage messages. - Garrett From James.Walker@sun.com Wed Jul 22 10:15:46 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MHFjDQ010875 for ; Wed, 22 Jul 2009 10:15:45 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6MHFQSx008835 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 18:15:44 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN70081D1A64E00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.Com); Wed, 22 Jul 2009 10:15:42 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN7000MQ19E19C0@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.Com); Wed, 22 Jul 2009 10:15:14 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6MHFEXw003408 for ; Wed, 22 Jul 2009 17:15:14 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN7007000FX4400@mail-amer.sun.com> for PSARC-ext@Sun.Com (ORCPT PSARC-ext@Sun.Com); Wed, 22 Jul 2009 11:15:14 -0600 (MDT) Received: from [172.20.25.153] ([unknown] [172.20.25.153]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN7005G618WIAC0@mail-amer.sun.com>; Wed, 22 Jul 2009 11:14:56 -0600 (MDT) Date: Wed, 22 Jul 2009 11:33:31 -0600 From: Jim Walker Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> Sender: James.Walker@sun.com To: psarc-ext@sun.com Cc: U.V.Ravindra@sun.com Reply-to: James.Walker@sun.com Message-id: <4A674D6B.8060308@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080728) Status: RO Content-Length: 61 This case was approved at todays PSARC meeting. Cheers, Jim From u.v.ravindra@sun.com Wed Jul 22 11:05:04 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MI53wC013231 for ; Wed, 22 Jul 2009 11:05:04 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id n6MI4n4o007600; Thu, 23 Jul 2009 02:04:57 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN7004053K8FD00@brm-avmta-1.central.sun.com>; Wed, 22 Jul 2009 12:04:56 -0600 (MDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN700FW03K7MDA0@brm-avmta-1.central.sun.com>; Wed, 22 Jul 2009 12:04:55 -0600 (MDT) Received: from mahogany.local (punchin-client-10-7-250-69.SFBay.Sun.COM [10.7.250.69]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6MI4sOj183497; Wed, 22 Jul 2009 11:04:54 -0700 (PDT) Date: Wed, 22 Jul 2009 11:04:55 -0700 From: "U.V. Ravindra" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A6731DE.5080009@sun.com> To: "Garrett D'Amore" Cc: Darren J Moffat , James Carlson , Danek Duvall , PSARC-ext@sun.com, James Walker Reply-to: u.v.ravindra@sun.com Message-id: <4A6754C7.4030706@sun.com> Organization: Sun Microsystems, Inc. MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <20090721234853.GM23953@smelly.SFBay.Sun.COM> <4A667740.6010000@sun.com> <4A672A04.5040709@workingcode.com> <4A672DDB.6070508@Sun.COM> <4A672F02.5080703@sun.com> <4A6730A7.9080902@Sun.COM> <4A6731DE.5080009@sun.com> User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.4; en-US; rv:1.9.1b3pre) Gecko/20090223 Thunderbird/3.0b2 Status: RO Content-Length: 2142 Garrett D'Amore wrote on Wed Jul 22 2009 08:35:58 GMT-0700 (PDT) : > Darren J Moffat wrote: >> Garrett D'Amore wrote: >>> Darren J Moffat wrote: >>>> James Carlson wrote: >>>>> It'd be an interesting idea for testing, but I think it'd actually be >>>>> counter-productive to do this. The problem is that the actual >>>>> privilege >>>>> enforcement (and thus the effects of each privilege bit) are >>>>> hard-coded >>>>> into the kernel itself. There's no good way to replicate that logic >>>>> out >>>>> into a user-space wrapper so that the code somehow 'knows' whether a >>>>> given system call should have succeeded give a privilege set. >>>> >>>> Also for privilege debugging it shouldn't be necessary. This is what >>>> the "Privilege Debug Mode" is for see ppriv(1). For the cases where >>>> that isn't sufficient or accurate then the Sun Blueprint >>>> "Privilege Debugging in the Solaris 10 Operating System"[1] is useful. >>>> >>>> [1] http://www.sun.com/blueprints/0206/819-5507.pdf >>>> >>>> Not that I'm biased by being a co-author on the above blueprint, but >>>> I think that is a better way of dealing with privilege debugging >>>> that attempting to do a "fakeroot" for privileges which by its very >>>> nature of being upstream will rot and be wrong. >>>> >>>> It will also be even more of an issue if/when FMAC makes its way >>>> into OpenSolaris distributions. >>>> >>>> Having said all that I have no problem with fakeroot being >>>> delivered. I would have possible issues if I see OpenSolaris >>>> originated projects wanting to depend on fakeroot. >>> >>> Agreed. Do you want to derail the case to generate an opinion to this >>> effect? >> >> Nope I think this email in the case log is sufficient. >> > Ok, thanks. I haven't heard the project team agree to the various > changes, specifically that faked should be in /usr/lib, and making sure > that references to TCP are removed from any usage messages. > Apologies for not being able to respond earlier. The project team agrees with the ARC's recommendation as to the location of faked and the removal of TCP references from the man page and usage. -Ravindra. From gdamore@Sun.COM Wed Jul 22 12:09:51 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n6MJ9olk006437 for ; Wed, 22 Jul 2009 12:09:50 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n6MJ9lcl018876 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 22 Jul 2009 20:09:49 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KN700F0D6KBIZ00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 12:09:47 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KN700BZM6K7JN60@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 12:09:45 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n6MJ9h2R008620 for ; Wed, 22 Jul 2009 12:09:43 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KN700D0067H1700@fe-sfbay-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 22 Jul 2009 12:09:43 -0700 (PDT) Received: from [192.168.251.11] ([unknown] [76.93.15.33]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KN7007C86K6VGC0@fe-sfbay-10.sun.com>; Wed, 22 Jul 2009 12:09:43 -0700 (PDT) Date: Wed, 22 Jul 2009 12:09:42 -0700 From: "Garrett D'Amore" Subject: Re: fakeroot [PSARC/2009/406 FastTrack timeout 07/28/2009] In-reply-to: <4A6754C7.4030706@sun.com> Sender: Garrett.Damore@Sun.COM To: U.V.Ravindra@Sun.COM Cc: Darren J Moffat , James Carlson , Danek Duvall , PSARC-ext@Sun.COM, James Walker Message-id: <4A6763F6.4060202@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200907212341.n6LNf0jG006556@sac.sfbay.sun.com> <20090721234853.GM23953@smelly.SFBay.Sun.COM> <4A667740.6010000@sun.com> <4A672A04.5040709@workingcode.com> <4A672DDB.6070508@Sun.COM> <4A672F02.5080703@sun.com> <4A6730A7.9080902@Sun.COM> <4A6731DE.5080009@sun.com> <4A6754C7.4030706@sun.com> User-Agent: Thunderbird 2.0.0.18 (X11/20081201) Status: RO Content-Length: 2293 U.V. Ravindra wrote: > Garrett D'Amore wrote on Wed Jul 22 2009 08:35:58 GMT-0700 (PDT) : >> Darren J Moffat wrote: >>> Garrett D'Amore wrote: >>>> Darren J Moffat wrote: >>>>> James Carlson wrote: >>>>>> It'd be an interesting idea for testing, but I think it'd >>>>>> actually be >>>>>> counter-productive to do this. The problem is that the actual >>>>>> privilege >>>>>> enforcement (and thus the effects of each privilege bit) are >>>>>> hard-coded >>>>>> into the kernel itself. There's no good way to replicate that logic >>>>>> out >>>>>> into a user-space wrapper so that the code somehow 'knows' whether a >>>>>> given system call should have succeeded give a privilege set. >>>>> >>>>> Also for privilege debugging it shouldn't be necessary. This is what >>>>> the "Privilege Debug Mode" is for see ppriv(1). For the cases where >>>>> that isn't sufficient or accurate then the Sun Blueprint >>>>> "Privilege Debugging in the Solaris 10 Operating System"[1] is >>>>> useful. >>>>> >>>>> [1] http://www.sun.com/blueprints/0206/819-5507.pdf >>>>> >>>>> Not that I'm biased by being a co-author on the above blueprint, but >>>>> I think that is a better way of dealing with privilege debugging >>>>> that attempting to do a "fakeroot" for privileges which by its very >>>>> nature of being upstream will rot and be wrong. >>>>> >>>>> It will also be even more of an issue if/when FMAC makes its way >>>>> into OpenSolaris distributions. >>>>> >>>>> Having said all that I have no problem with fakeroot being >>>>> delivered. I would have possible issues if I see OpenSolaris >>>>> originated projects wanting to depend on fakeroot. >>>> >>>> Agreed. Do you want to derail the case to generate an opinion to this >>>> effect? >>> >>> Nope I think this email in the case log is sufficient. >>> >> Ok, thanks. I haven't heard the project team agree to the various >> changes, specifically that faked should be in /usr/lib, and making sure >> that references to TCP are removed from any usage messages. >> > > Apologies for not being able to respond earlier. > > The project team agrees with the ARC's recommendation as to the > location of faked and the removal of TCP references from the man > page and usage. This case was approved at PSARC today. - Garrett > > > -Ravindra. >