debinstall #9083 ldi should not be suid, or there should be a non-suid ldi-local command [rejected]

When one tries to setup local repos for testing its debian packages, ldi must not be run as a suid debinstall command.

Maybe there should be 2 commands, ldi and ldi-global, ldi not being suid, but calling when required the ldi-global (which is suid).

prioritynormal
typeenhancement
done in<not specified>
load0.000
load left0.000
closed by<not specified>

Workflow history

from state (1)to statecommentdateUser
openrejected

ldi-local was just a trick to have private repositories due to lgp limitation. Last lgp version manage now local repository by creating Packages.gz file itself.

2009/09/01 17:05 UTC 

Comments

  • 2009/07/08 10:50

    Not sure about the suid need. It should be better to add users to the debinstall group. I will check the code to see what requires superuser privileges

    • 2009/07/08 20:35

      About configure command, I think we could replace it by an appropriate debian postinst.

    • 2009/07/20 10:03

      the suid was introduced to enable chowning / chmoding files that we do not own.

      • 2009/07/20 10:52, written by anon

        what about a new default upload process by invoking ssh debinstall@repository host instead ? We gain identification (by ssh keys) and no more suid bit on the binary (which can be used locally with no more modification #9083) ?

        juj

        • 2009/07/20 13:23

          why not. This needs to be done for the publish command too, and care must be taken to ensure that this account knows about the various public and private keys involved.

add comment

Ticket #9083 - latest update on 2009/09/01, created on 2009/04/23 by David Douard