[Bug 176253] Review Request: clement-2.1
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: Review Request: clement-2.1
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176253
------- Additional Comments From jmp(a)safe.ca 2006-08-14 10:39 EST -------
(In reply to comment #24)
> > E: clement non-standard-gid /var/spool/clement-2.1/mqueue clement
>
> Who cares? This is not the first package that creates a new user/group.
Me!.
Agree this is not the first package creating a user/group....
problem, if rpmlint is THE reference and rpmlint is reporting error how
can I make the difference between real error which are errors from simple
advice... now in my case there is 48 "errors" which are 'who cares',....
hmmmm......
>
> > My understanding of the last Michael comment is to let the sys-admin
> > delete the remaining user/group himself, right?
>
> Yes. If package removal does not get rid of all files owned by that
> user/group, the next package might allocate the same uid/gid and give
> some other software access to the old files, which are still left
> on the file-system as orphans.
OK, lets keep the user/group then
>
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.
17 years, 10 months
[Bug 176253] Review Request: clement-2.1
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: Review Request: clement-2.1
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176253
------- Additional Comments From bugs.michael(a)gmx.net 2006-08-14 10:19 EST -------
> E: clement non-standard-gid /var/spool/clement-2.1/mqueue clement
Who cares? This is not the first package that creates a new user/group.
> My understanding of the last Michael comment is to let the sys-admin
> delete the remaining user/group himself, right?
Yes. If package removal does not get rid of all files owned by that
user/group, the next package might allocate the same uid/gid and give
some other software access to the old files, which are still left
on the file-system as orphans.
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.
17 years, 10 months
[Bug 176253] Review Request: clement-2.1
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: Review Request: clement-2.1
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176253
------- Additional Comments From jmp(a)safe.ca 2006-08-14 10:05 EST -------
So I added clement as group & user as suggested.
got this from rpmlint (many lines of this kind)
E: clement non-standard-gid /var/spool/clement-2.1/mqueue clement
A file in this package is owned by a non standard group.
Standard groups are:
root, bin, daemon, sys, adm, tty, disk, lp, mem, kmem, wheel, mail,
news, uucp, man, games, gopher, dip, ftp, lock, nobody, users
Does not look like as a 'Warning' to me, how to make it as a Warning?
Also got this warning
W: clement dangerous-command-in-%preun userdel
because I would like to delete created user when removing all the application,
there is a kind of ambiguity here as some file could be left if the application
was in production previously.
My understanding of the last Michael comment is to let the sys-admin delete
the remaining user/group himself, right?
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.
17 years, 10 months
[Bug 176253] Review Request: clement-2.1
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: Review Request: clement-2.1
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176253
------- Additional Comments From bugs.michael(a)gmx.net 2006-08-14 09:40 EST -------
> 2) rpmlint complain if you add/create a user
Hmm? The "dangerous-command-in" _warning_ about userdel/groupdel?
This is misinformation. Surely there are valid cases when creating
a new user or group is required/justified.
Similarly, there are cases when deleting a user or group during
package removal can be done, i.e. if no files owned by that uid/gid
are left anywhere.
In particular, since you want a "centralized quarantine area" (quote),
you need a special uid/gid and not use an existing uid/gid which is
shared with other programs/services.
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.
17 years, 10 months
[Bug 176253] Review Request: clement-2.1
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: Review Request: clement-2.1
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176253
------- Additional Comments From j.w.r.degoede(a)hhs.nl 2006-08-14 08:43 EST -------
(In reply to comment #18)
> Seems I do not explain myself right...
> %{_usr}/bin/%{name} MUST be own by 'somebody' else than root to have clement to
> know, once started, under which ID it must run (the application look about
> the file ownership and say 'ok lets seteuid to this'), if the application
> is not setuid the only other way is to hard code the effective uid, this is
> not good from my stand point. I choosed 'mail' because this ID is used by
> related application. I want to give possibility to change this on the fly
> by local sysadmin.
>
I understand.
> useradd and groupadd clement where part of the original implementation but
> removed to comply to rpmlint.
> If rpmlint is a reference tools to 'the right way to do something' warning
> can't ignore. IMHO rpmlint warning are 'you are doing something which can work
> but are against established standard'.
No, a rpmlint warning means you shouldnot be doing this unless you've got a good
reason, and it this case we have a good reason so using user and groupadd is ok.
(In reply to comment #19)
> > I choosed 'mail' because this ID is used by related application.
>
> This asks for a very close look. Either it is a necessity, by design,
> that the program must run as "mail". Or it is a fault, and it runs with
> a shared uid/gid it should not have access to.
>
If I understand jmp correctly its the latter (a fault) jmp if you think it is
better to have it run as clement, feel free to add the user, in exceptional
cases (which daemons always are) you can ignore the relevant rpmlint warnings,
thats why they are warnings, rpmlint deliberatly has 2 levels of compaining,
warn and error, and these are only warnings.
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.
17 years, 10 months
[Bug 176253] Review Request: clement-2.1
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: Review Request: clement-2.1
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176253
------- Additional Comments From jmp(a)safe.ca 2006-08-14 08:42 EST -------
(In reply to comment #19)
> > I choosed 'mail' because this ID is used by related application.
>
> This asks for a very close look. Either it is a necessity, by design,
> that the program must run as "mail". Or it is a fault, and it runs with
> a shared uid/gid it should not have access to.
>
OK....
lets resolv the equation
1) the application must not run as root
2) rpmlint complain if you add/create a user
3) We should not use an existing user
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.
17 years, 10 months
[Bug 176253] Review Request: clement-2.1
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: Review Request: clement-2.1
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176253
------- Additional Comments From bugs.michael(a)gmx.net 2006-08-14 08:14 EST -------
> I choosed 'mail' because this ID is used by related application.
This asks for a very close look. Either it is a necessity, by design,
that the program must run as "mail". Or it is a fault, and it runs with
a shared uid/gid it should not have access to.
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.
17 years, 10 months