On 08/30/2017 05:25 AM, Michał Górny wrote:
>
> This package does not belong in Gentoo. We do packaging, not some ugly
> malware that prevents users from uninstalling itself. Every package must
> be uninstallable. Even if it destroys my system, developers have no
> right to prevent valid uninstall action from proceeding.
>
So you're saying I should have it "sleep 2983702947523704" in prerm?
=)
I've been working on the user packages GLEP that I started and then
forgot about sometime at the beginning of the year. I'm trying to finish
up the reference implementation.
When it comes to removing users, everyone's suggestions were along the
same lines:
1a. If you try to uninstall a user package, it should die(), because
calling userdel can be a security risk if the user still owns
files.
1b. Same as 1a, with an I_KNOW_WHAT_I_AM_DOING override.
2. We can scan the file system to see if the user owns anything, and
if he doesn't, call userdel. If he does, warn the user, and die().
3. During upgrades, the existing user will be left in place. But If a
user package tries to switch it's UID in a new version, check to
make sure that the old UID doesn't own any files, maybe die(), etc.
But all of them involve being able to die() out of a removal action.
It's not refusing to uninstall the system user -- that's already the
status quo -- it's just refusing to remove the /package/ given that we
can't actually remove the system user. Trying to keep the system and the
PM in agreement (with an override).
Anyway, I was trying to implement (1b), so that's how I found myself
asking this question. Since I'm providing an I_KNOW_WHAT_IM_DOING
override, you still have the ability to shoot yourself in the foot, but
for all of this to work I'd still need a way to stop an uninstallation.
