debinstall #9083 ldi should not be suid, or there should be a non-suid ldi-local command [rejected]
When one tries to setup local repos for testing its debian packages, ldi must not be run as a suid debinstall command. Maybe there should be 2 commands, ldi and ldi-global, ldi not being suid, but calling when required the ldi-global (which is suid). | |
priority | normal |
---|---|
type | enhancement |
done in | <not specified> |
load | 0.000 |
load left | 0.000 |
closed by | <not specified> |
Comments
-
2009/07/08 10:50
-
2009/07/08 20:35
-
2009/07/20 10:03
-
2009/07/20 10:52, written by anon
-
2009/07/20 13:23
add commentNot sure about the suid need. It should be better to add users to the debinstall group. I will check the code to see what requires superuser privileges
About configure command, I think we could replace it by an appropriate debian postinst.
the suid was introduced to enable chowning / chmoding files that we do not own.
what about a new default upload process by invoking ssh debinstall@repository host instead ? We gain identification (by ssh keys) and no more suid bit on the binary (which can be used locally with no more modification #9083) ?
juj
why not. This needs to be done for the publish command too, and care must be taken to ensure that this account knows about the various public and private keys involved.