Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Sun, Nov 28, 2021 at 11:06:36AM +0100, Ulrich Mueller wrote: > > On Mon, Nov 15, 2021 at 09:36:32AM +0300, Eray Aslan wrote: > >> 1/ Static allocation does not really solve a problem. Not really not > >> nowadays > >> 2/ We cant keep adding new IDs to a distribution as new software gets > >> add

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Sun, Nov 28, 2021 at 02:46:24PM -0600, William Hubbs wrote: > On Sun, Nov 28, 2021 at 08:15:13PM +0100, Michał Górny wrote: > > On Sun, 2021-11-28 at 13:06 -0600, William Hubbs wrote: > > > On Sun, Nov 28, 2021 at 11:06:36AM +0100, Ulrich Mueller wrote: > > > > > > > > > On Sun, 28 Nov 2021, Wil

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Sun, Nov 28, 2021 at 02:42:23PM -0600, Gordon Pettey wrote: > On Sun, Nov 28, 2021 at 2:27 PM William Hubbs wrote: > > > On Sun, Nov 28, 2021 at 02:57:39PM -0500, Michael Orlitzky wrote: > > > We don't even do static allocation. > > > There are a few exceptional cases where a user or group ne

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Sun, Nov 28, 2021 at 08:15:13PM +0100, Michał Górny wrote: > On Sun, 2021-11-28 at 13:06 -0600, William Hubbs wrote: > > On Sun, Nov 28, 2021 at 11:06:36AM +0100, Ulrich Mueller wrote: > > > > > > > > On Sun, 28 Nov 2021, William Hubbs wrote: > > > > > > > On Mon, Nov 15, 2021 at 09:36:32AM +03

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Sun, Nov 28, 2021 at 2:27 PM William Hubbs wrote: > On Sun, Nov 28, 2021 at 02:57:39PM -0500, Michael Orlitzky wrote: > > We don't even do static allocation. > There are a few exceptional cases where a user or group needs a > > specific identifier; but those were always statically allocated a

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Sun, Nov 28, 2021 at 3:26 PM William Hubbs wrote: > > On Sun, Nov 28, 2021 at 02:57:39PM -0500, Michael Orlitzky wrote: > > On 2021-11-28 11:06:36, Ulrich Mueller wrote: > > > > > > While the rationale for static allocation that made it into GLEP 81 [1] > > > is rather weak, several people had

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Sun, Nov 28, 2021 at 02:57:39PM -0500, Michael Orlitzky wrote: > On 2021-11-28 11:06:36, Ulrich Mueller wrote: > > > > While the rationale for static allocation that made it into GLEP 81 [1] > > is rather weak, several people had argued in favour of it on the mailing > > list [2]. > > > > We

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On 2021-11-28 11:06:36, Ulrich Mueller wrote: > > While the rationale for static allocation that made it into GLEP 81 [1] > is rather weak, several people had argued in favour of it on the mailing > list [2]. > We don't even do static allocation. The UIDs and GIDs in the ebuilds are suggestions,

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Sun, 2021-11-28 at 13:06 -0600, William Hubbs wrote: > On Sun, Nov 28, 2021 at 11:06:36AM +0100, Ulrich Mueller wrote: > > > > > > > On Sun, 28 Nov 2021, William Hubbs wrote: > > > > > On Mon, Nov 15, 2021 at 09:36:32AM +0300, Eray Aslan wrote: > > > > 1/ Static allocation does not really solve

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Sun, Nov 28, 2021 at 11:06:36AM +0100, Ulrich Mueller wrote: > > On Sun, 28 Nov 2021, William Hubbs wrote: > > > On Mon, Nov 15, 2021 at 09:36:32AM +0300, Eray Aslan wrote: > >> 1/ Static allocation does not really solve a problem. Not really not > >> nowadays > >> 2/ We cant keep adding ne

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

> On Sun, 28 Nov 2021, William Hubbs wrote: > On Mon, Nov 15, 2021 at 09:36:32AM +0300, Eray Aslan wrote: >> 1/ Static allocation does not really solve a problem. Not really not >> nowadays >> 2/ We cant keep adding new IDs to a distribution as new software gets >> added - one side is unbounde

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Mon, Nov 15, 2021 at 09:36:32AM +0300, Eray Aslan wrote: > On Sun, Nov 14, 2021 at 09:15:36PM +0100, Thomas Deutschmann wrote: > > On 2021-11-11 11:59, Ulrich Mueller wrote: > > > We could: > > > > > > - Open some part of the range between 500 and 1000. For example, > > >500..799, which wou

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Sun, Nov 14, 2021 at 09:15:36PM +0100, Thomas Deutschmann wrote: > On 2021-11-11 11:59, Ulrich Mueller wrote: > > We could: > > > > - Open some part of the range between 500 and 1000. For example, > >500..799, which would leave 200 IDs for dynamic allocation. > > > > - Open part of the ran

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

> On Sun, 14 Nov 2021, Thomas Deutschmann wrote: > On 2021-11-11 11:59, Ulrich Mueller wrote: >> We could: >> - Open some part of the range between 500 and 1000. For example, >> 500..799, which would leave 200 IDs for dynamic allocation. >> - Open part of the range 60001..65533. Not sure if

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On 2021-11-11 11:59, Ulrich Mueller wrote: We could: - Open some part of the range between 500 and 1000. For example, 500..799, which would leave 200 IDs for dynamic allocation. - Open part of the range 60001..65533. Not sure if all software will be happy with that. - Admit that the conc

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

> On Thu, 11 Nov 2021, Ulrich Mueller wrote: > In any case, we have run out of GIDs: >Recommended GID only: none >Recommended UID only: 272 >Recommended UID+GID pair: none >Free UIDs: 15 >Free GIDs: 0 >Free UID+GID pairs: 0 > The question is of course how we should mo

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

> On Thu, 11 Nov 2021, James Cloos wrote: > gentoo definitely should not permit fixed use for installed packages > in the 500-600 range. > 500+ was for many, many years the start for users, and forcing anyone > to change decades-long use of particular uids or gods is not > acceptable. > real

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

gentoo definitely should not permit fixed use for installed packages in the 500-600 range. 500+ was for many, many years the start for users, and forcing anyone to change decades-long use of particular uids or gods is not acceptable. really all of 101-499,701-999,6-{nobody--} should be dynami

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Thu, Nov 11, 2021 at 2:08 PM Ulrich Mueller wrote: > > > On Thu, 11 Nov 2021, Mike Gilbert wrote: > > >> - Open part of the range 60001..65533. Not sure if all software will be > >> happy with that. > > > systemd has some code that special-cases ids in the "system" range. > > I'm not exactl

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

> On Thu, 11 Nov 2021, Mike Gilbert wrote: >> - Open part of the range 60001..65533. Not sure if all software will be >> happy with that. > systemd has some code that special-cases ids in the "system" range. > I'm not exactly sure what impact creating system users outside above > SYS_UID_MAX

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Thu, Nov 11, 2021 at 5:59 AM Ulrich Mueller wrote: > > May I remind everybody that by QA policy allocation of UIDs and GIDs > in the range 0..100 needs explicit approval by the QA lead: > https://projects.gentoo.org/qa/policy-guide/user-group.html#pg0901 > > I have fixed the used_free_uidgids.s

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On 11/11/2021 12.48, Ulrich Mueller wrote: On Thu, 11 Nov 2021, Florian Schmaus wrote: We could: - Open some part of the range between 500 and 1000. For example, 500..799, which would leave 200 IDs for dynamic allocation. +1, since I am not aware of any significant downsides doing so. Co

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

> On Thu, 11 Nov 2021, Jaco Kroon wrote: > # getent passwd | awk -F: '{ print $3 }' | sort -g | tail -n3 > 37945 > 37946 > 65534 <-- this happens to be nobody. > 6 up to where?  65533? I'd say 60001..60999 for now, and increase by another 1000 when (and if) it will become necessary. > I

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

Hi, On 2021/11/11 14:10, Pacho Ramos wrote: > In any case, 300 additional IDs may not be future proof at the rate >> we're currently allocating them. So I wonder if we shouldn't move to >> above 6 immediately, or alternatively, give up the whole concept. >> >> Ulrich > Personally I would move

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Thu, Nov 11, 2021 at 12:48:46PM +0100, Ulrich Mueller wrote: > In any case, 300 additional IDs may not be future proof at the rate > we're currently allocating them. So I wonder if we shouldn't move to > above 6 immediately, or alternatively, give up the whole concept. Agreed here, I'd /lik

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

El jue, 11-11-2021 a las 12:48 +0100, Ulrich Mueller escribió: > > > > > > On Thu, 11 Nov 2021, Florian Schmaus wrote: > > > > We could: > > > - Open some part of the range between 500 and 1000. For example, > > > 500..799, which would leave 200 IDs for dynamic allocation. > > > +1, since I am no

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

> On Thu, 11 Nov 2021, Florian Schmaus wrote: >> We could: >> - Open some part of the range between 500 and 1000. For example, >> 500..799, which would leave 200 IDs for dynamic allocation. > +1, since I am not aware of any significant downsides doing so. > Could you elaborate why the range

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On Thu, Nov 11, 2021 at 6:34 AM Florian Schmaus wrote: > > On 11/11/2021 11.59, Ulrich Mueller wrote: > > We could: > > > > - Open some part of the range between 500 and 1000. For example, > >500..799, which would leave 200 IDs for dynamic allocation. > > +1, since I am not aware of any signif

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On 11.11.2021 13.34, Florian Schmaus wrote: > On 11/11/2021 11.59, Ulrich Mueller wrote: >> We could: >> >> - Open some part of the range between 500 and 1000. For example, >>    500..799, which would leave 200 IDs for dynamic allocation. > > +1, since I am not aware of any significant downsides d

Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

On 11/11/2021 11.59, Ulrich Mueller wrote: We could: - Open some part of the range between 500 and 1000. For example, 500..799, which would leave 200 IDs for dynamic allocation. +1, since I am not aware of any significant downsides doing so. Could you elaborate why the range 500-799 only l

[gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

May I remind everybody that by QA policy allocation of UIDs and GIDs in the range 0..100 needs explicit approval by the QA lead: https://projects.gentoo.org/qa/policy-guide/user-group.html#pg0901 I have fixed the used_free_uidgids.sh script such that it will no longer recommend any IDs below 101.