Re: Introduction of a "lock" group

2011-08-16 Thread Colin Watson
On Tue, Aug 16, 2011 at 11:19:05AM -0500, Peter Samuelson wrote: > Makes sense that tmpfiles.d comes from systemd, if he's trying to get > away from shell scripts. But for those who think it's annoying to have > to put 3 separate steps in your init script 'start' section (mkdir -p, > chown, chmod)

Re: Introduction of a "lock" group

2011-08-16 Thread Simon McVittie
On Tue, 16 Aug 2011 at 11:19:05 -0500, Peter Samuelson wrote: > But for those who think it's annoying to have > to put 3 separate steps in your init script 'start' section (mkdir -p, > chown, chmod), I'd like to point out that you may as well just use > install -d, and do it all in one step. ... a

Re: Introduction of a "lock" group

2011-08-16 Thread Peter Samuelson
[Roger Leigh] > tmpfiles.d comes from systemd, but we could adopt the concept > without systemd being involved. If we didn't adopt tmpfiles.d, > it would be the responsibility of the init script to create > the necessary directories. Makes sense that tmpfiles.d comes from systemd, if he's trying

Re: Introduction of a "lock" group

2011-08-16 Thread Roger Leigh
On Mon, Aug 15, 2011 at 07:36:26PM +0200, Iustin Pop wrote: > On Mon, Aug 15, 2011 at 06:00:50PM +0100, Roger Leigh wrote: > > On Mon, Aug 15, 2011 at 05:35:54PM +0100, Colin Watson wrote: > > > On Mon, Aug 15, 2011 at 04:11:49PM +0100, Roger Leigh wrote: > > > > Are these any other downsides we ne

Re: Introduction of a "lock" group

2011-08-16 Thread Roger Leigh
On Mon, Aug 15, 2011 at 06:03:59PM +0200, Iustin Pop wrote: > On Mon, Aug 15, 2011 at 04:11:49PM +0100, Roger Leigh wrote: > > Hi folks, > > > > Fedora has moved to having /var/lock (now /run/lock) owned by > > root:lock 0775 rather than root:root 01777. This has the advantage > > of making a sys

Re: Introduction of a "lock" group

2011-08-15 Thread Iustin Pop
On Mon, Aug 15, 2011 at 06:00:50PM +0100, Roger Leigh wrote: > On Mon, Aug 15, 2011 at 05:35:54PM +0100, Colin Watson wrote: > > On Mon, Aug 15, 2011 at 04:11:49PM +0100, Roger Leigh wrote: > > > Are these any other downsides we need to consider? One issue is the > > > existence of badly broken pr

Re: Introduction of a "lock" group

2011-08-15 Thread Roger Leigh
On Mon, Aug 15, 2011 at 05:35:54PM +0100, Colin Watson wrote: > On Mon, Aug 15, 2011 at 04:11:49PM +0100, Roger Leigh wrote: > > Fedora has moved to having /var/lock (now /run/lock) owned by > > root:lock 0775 rather than root:root 01777. This has the advantage > > of making a system directory wri

Re: Introduction of a "lock" group

2011-08-15 Thread Colin Watson
On Mon, Aug 15, 2011 at 04:11:49PM +0100, Roger Leigh wrote: > Fedora has moved to having /var/lock (now /run/lock) owned by > root:lock 0775 rather than root:root 01777. This has the advantage > of making a system directory writable only by root or setgid lock > programs, rather than the whole wo

Re: Introduction of a "lock" group

2011-08-15 Thread Roger Leigh
On Mon, Aug 15, 2011 at 06:03:59PM +0200, Iustin Pop wrote: > On Mon, Aug 15, 2011 at 04:11:49PM +0100, Roger Leigh wrote: > > Hi folks, > > > > Fedora has moved to having /var/lock (now /run/lock) owned by > > root:lock 0775 rather than root:root 01777. This has the advantage > > of making a sys

Re: Introduction of a "lock" group

2011-08-15 Thread Iustin Pop
On Mon, Aug 15, 2011 at 04:11:49PM +0100, Roger Leigh wrote: > Hi folks, > > Fedora has moved to having /var/lock (now /run/lock) owned by > root:lock 0775 rather than root:root 01777. This has the advantage > of making a system directory writable only by root or setgid lock > programs, rather th

Re: Introduction of a "lock" group

2011-08-15 Thread Andreas Barth
* Roger Leigh (rle...@codelibre.net) [110815 17:12]: > Are these any other downsides we need to consider? One issue is the > existence of badly broken programs³, which make stupid assumptions > about lockfiles. This will break all existing programms on an partial upgrades. There are three ways to

Introduction of a "lock" group

2011-08-15 Thread Roger Leigh
Hi folks, Fedora has moved to having /var/lock (now /run/lock) owned by root:lock 0775 rather than root:root 01777. This has the advantage of making a system directory writable only by root or setgid lock programs, rather than the whole world. However, due to the potential for privilege escalati