Mailing List Archive

USE="acl" in profiles
There is a slight problem regarding the USE-Settings in the profiles:

GRP_STAGE23_USE="ipv6 pam tcpd readline nls ssl gpm perl python berkdb acl ncurses"

As you can see, this defines acl. Now:

USE="x86 oss apm arts avi berkdb bitmap-fonts crypt cups encode foomaticdb gdbm
gif gpm gtk gtk2 imlib jpeg kde gnome libg++ libwww mad mikmod motif mpeg ncurses
nls oggvorbis opengl pam pdflib png python qt quicktime readline sdl slang spell
ssl svga tcpd truetype X xml2 xmms xprint xv zlib"

This doesn't define acl.

This could break things if users don't set USE="acl" on bootstrap/emerge system.
Possible solutions could be to either remove acl from GRP_STAGE23_USE or add it to
USE. The first solution would cause everybody using acl to not be able to install without
any problems. Putting it into USE would cause an overhead for everybody. The overhead
doesn't seem to be that big, but...well...it's an overhead.

What do you think about it and how do you think this should be solved?

Regards,
Benni
--
Benjamin Judas

---------------------------------------------------------------------
Gentoo-developer http://dev.gentoo.org/~beejay
Giessen, Germany http://www.gentoo.org

GPG-Key : 0xC31DEDD8
Key-Fingerprint : 4E65 AAFE 785B 61D8 E4D9 1671 E017 87B7 C31D EDD8
Jabber : beejay@im.gentoo.org
Re: USE="acl" in profiles [ In reply to ]
Is it really necessary? And if it is, better put it inside the profile, right?

--
Ioannis Aslanidis
<deathwing00[at]forums.gentoo.org> 0xC2539DA3
<aioannis[at]tinet.org> 0xF202D067
<dwcommander[at]users.sourceforge.net>

Hellenic Gentoo GNU/Linux project manager (http://hellenicgentoo.sf.net)
FIRECOPS++ project manager (http://firecops.sf.net)

Computer Engineering student at Universitat Rovira i Virgili

--
gentoo-dev@gentoo.org mailing list
Re: USE="acl" in profiles [ In reply to ]
On Mon, 2004-09-20 at 18:41 +0200, Benjamin Judas wrote:
>
> What do you think about it and how do you think this should be solved?
>

I'd say go ahead and remove it from the stages. IIRC, the acl use in the
stages is a hold over from the 1.4 days.

Cheers,
--
John Davis
Gentoo Linux Developer
<http://dev.gentoo.org/~zhen>

----
GnuPG Public Key: <http://dev.gentoo.org/~zhen/zhen_pub.asc>
Fingerprint: 4F9E 41F6 D072 5C1A 636C 2D46 B92C 4823 E281 41BB
Re: USE="acl" in profiles [ In reply to ]
On Mon, 2004-09-20 at 12:41, Benjamin Judas wrote:
> There is a slight problem regarding the USE-Settings in the profiles:
>
> GRP_STAGE23_USE="ipv6 pam tcpd readline nls ssl gpm perl python berkdb acl ncurses"
>
> As you can see, this defines acl. Now:
>
> USE="x86 oss apm arts avi berkdb bitmap-fonts crypt cups encode foomaticdb gdbm
> gif gpm gtk gtk2 imlib jpeg kde gnome libg++ libwww mad mikmod motif mpeg ncurses
> nls oggvorbis opengl pam pdflib png python qt quicktime readline sdl slang spell
> ssl svga tcpd truetype X xml2 xmms xprint xv zlib"
>
> This doesn't define acl.
>
> This could break things if users don't set USE="acl" on bootstrap/emerge system.
> Possible solutions could be to either remove acl from GRP_STAGE23_USE or add it to
> USE. The first solution would cause everybody using acl to not be able to install without
> any problems. Putting it into USE would cause an overhead for everybody. The overhead
> doesn't seem to be that big, but...well...it's an overhead.
>
> What do you think about it and how do you think this should be solved?

We should not remove the ability to install using acl. I also think
that it is required for somethings (hardened?) and should stay. I think
my main problem is I don't understand how the situation is broken.
Could you perhaps paint a better picture for me (and all the other
devs)?

--
Chris Gianelloni
Release Engineering - Operations/QA Manager
Games - Developer
Gentoo Linux

Is your power animal a penguin?
Re: USE="acl" in profiles [ In reply to ]
On Mon, 2004-09-20 at 15:47, John Davis wrote:
> On Mon, 2004-09-20 at 18:41 +0200, Benjamin Judas wrote:
> >
> > What do you think about it and how do you think this should be solved?
> >
>
> I'd say go ahead and remove it from the stages. IIRC, the acl use in the
> stages is a hold over from the 1.4 days.

This means users will not be able to install using ext2/3/reiserfs/xfs
with acl support.

I find that to be a very bad solution.

--
Chris Gianelloni
Release Engineering - Operations/QA Manager
Games - Developer
Gentoo Linux

Is your power animal a penguin?
Re: USE="acl" in profiles [ In reply to ]
Chris Gianelloni wrote:

> On Mon, 2004-09-20 at 12:41, Benjamin Judas wrote:
>
>>There is a slight problem regarding the USE-Settings in the profiles:
>>
>>GRP_STAGE23_USE="ipv6 pam tcpd readline nls ssl gpm perl python berkdb acl ncurses"
>>
>>As you can see, this defines acl. Now:
>>
>>USE="x86 oss apm arts avi berkdb bitmap-fonts crypt cups encode foomaticdb gdbm
>>gif gpm gtk gtk2 imlib jpeg kde gnome libg++ libwww mad mikmod motif mpeg ncurses
>>nls oggvorbis opengl pam pdflib png python qt quicktime readline sdl slang spell
>>ssl svga tcpd truetype X xml2 xmms xprint xv zlib"
>>
>>This doesn't define acl.
>>
>>This could break things if users don't set USE="acl" on bootstrap/emerge system.
>>Possible solutions could be to either remove acl from GRP_STAGE23_USE or add it to
>>USE. The first solution would cause everybody using acl to not be able to install without
>>any problems. Putting it into USE would cause an overhead for everybody. The overhead
>>doesn't seem to be that big, but...well...it's an overhead.
>>
>>What do you think about it and how do you think this should be solved?
>
>
> We should not remove the ability to install using acl. I also think
> that it is required for somethings (hardened?) and should stay. I think
> my main problem is I don't understand how the situation is broken.
> Could you perhaps paint a better picture for me (and all the other
> devs)?
>

acl has nothing to do with hardened, it isn't needed for selinux and we
don't support it.

further, we have our own stages and profile and therefore it wouldn't be
an issue anyway.

I don't think acl's should be included by default, the acl users must be
an incredibly small number and it doesn't make sense to built it into
stage 2,3 anyway (probably).

Joshua

--
gentoo-dev@gentoo.org mailing list
Re: USE="acl" in profiles [ In reply to ]
On Tuesday 21 September 2004 15:15, Chris Gianelloni wrote:
> On Mon, 2004-09-20 at 15:47, John Davis wrote:
> > On Mon, 2004-09-20 at 18:41 +0200, Benjamin Judas wrote:
> > > What do you think about it and how do you think this should be solved?
> >
> > I'd say go ahead and remove it from the stages. IIRC, the acl use in the
> > stages is a hold over from the 1.4 days.
>
> This means users will not be able to install using ext2/3/reiserfs/xfs
> with acl support.

While I don't see any problems keeping acl, it is no problem at all to enable
acl's on those filesystems after installation. The default stages do not
contain acl's in any case so any advantage for installing on an acl enabled
filesystem are not there.

Paul

--
Paul de Vrieze
Gentoo Developer
Mail: pauldv@gentoo.org
Homepage: http://www.devrieze.net
Re: USE="acl" in profiles [ In reply to ]
Just feel it is necessary to point out that USE=acl has no harmful affect on
non-ACL systems.
I had no intention of ever using ACLs, nor do I often use them today. However,
there are one or two files/directorys on my system that they have come in
handy for. The point here is, you really never know that you won't need ACLs
at some point... and there's not really any overhead, either (except a bit
more disk usage when you use them).
--
Luke-Jr
Developer, Utopios
http://utopios.org/
Re: USE="acl" in profiles [ In reply to ]
On Tue, 2004-09-21 at 09:49, Paul de Vrieze wrote:
> On Tuesday 21 September 2004 15:15, Chris Gianelloni wrote:
> > On Mon, 2004-09-20 at 15:47, John Davis wrote:
> > > On Mon, 2004-09-20 at 18:41 +0200, Benjamin Judas wrote:
> > > > What do you think about it and how do you think this should be solved?
> > >
> > > I'd say go ahead and remove it from the stages. IIRC, the acl use in the
> > > stages is a hold over from the 1.4 days.
> >
> > This means users will not be able to install using ext2/3/reiserfs/xfs
> > with acl support.
>
> While I don't see any problems keeping acl, it is no problem at all to enable
> acl's on those filesystems after installation. The default stages do not
> contain acl's in any case so any advantage for installing on an acl enabled
> filesystem are not there.

The user would have to:
USE=acl emerge coreutils rsync

before they could use any acl, but I believe that they should be able to
enable it in the kernel without having to have USE=acl... can anyone
confirm this? If not, I'll have to get some testing done on it.

--
Chris Gianelloni
Release Engineering - Operations/QA Manager
Games - Developer
Gentoo Linux

Is your power animal a penguin?
Re: USE="acl" in profiles [ In reply to ]
On Tuesday 21 September 2004 16:21, Chris Gianelloni wrote:
> before they could use any acl, but I believe that they should be able to
> enable it in the kernel without having to have USE=acl... can anyone
> confirm this? If not, I'll have to get some testing done on it.

Yes, you can enable it in the kernel without. Those patches mainly make
coreutils, rsync and others acl aware, keeping acl's with files. You'll also
want to have the attr and acl packages.

Paul

--
Paul de Vrieze
Gentoo Developer
Mail: pauldv@gentoo.org
Homepage: http://www.devrieze.net
Re: USE="acl" in profiles [ In reply to ]
On Tue, 2004-09-21 at 10:45, Paul de Vrieze wrote:
> On Tuesday 21 September 2004 16:21, Chris Gianelloni wrote:
> > before they could use any acl, but I believe that they should be able to
> > enable it in the kernel without having to have USE=acl... can anyone
> > confirm this? If not, I'll have to get some testing done on it.
>
> Yes, you can enable it in the kernel without. Those patches mainly make
> coreutils, rsync and others acl aware, keeping acl's with files. You'll also
> want to have the attr and acl packages.

In that case, consider it removed from the 2004.3 cascaded profile,
which I will be creating for x86 before too long.

--
Chris Gianelloni
Release Engineering - Operations/QA Manager
Games - Developer
Gentoo Linux

Is your power animal a penguin?
Re: USE="acl" in profiles [ In reply to ]
On вт, 2004-09-21 at 17:58, Chris Gianelloni wrote:
> On Tue, 2004-09-21 at 10:45, Paul de Vrieze wrote:
> > On Tuesday 21 September 2004 16:21, Chris Gianelloni wrote:
> > > before they could use any acl, but I believe that they should be able to
> > > enable it in the kernel without having to have USE=acl... can anyone
> > > confirm this? If not, I'll have to get some testing done on it.
> >
> > Yes, you can enable it in the kernel without. Those patches mainly make
> > coreutils, rsync and others acl aware, keeping acl's with files. You'll also
> > want to have the attr and acl packages.
>
> In that case, consider it removed from the 2004.3 cascaded profile,
> which I will be creating for x86 before too long.
Hi,
Could i suggest you include 'acl' in hardened 2004.3-stages & profiles?
running: #emerge system -epv | grep acl gives:
[ebuild N ] sys-apps/acl-2.2.13-r3 -debug +nls 0 kB
[ebuild N ] sys-apps/coreutils-5.2.1-r2 +acl -build -debug +nls
(-selinux) -static (-uclibc) 0 kB
[ebuild N ] net-misc/rsync-2.6.0-r3 +acl -build -debug -static 0 kB
[ebuild N ] app-editors/vim-core-6.3-r2 +acl -debug +ncurses +nls
(-selinux) 0 kB
[ebuild N ] app-editors/vim-6.3-r1 +acl -cscope -debug +gpm
-minimal +ncurses +nls +perl +python -ruby (-selinux) -vim-with-x 0 kB
(sys-apps/acl is only 121 KB in size).
There are 5 packages including sys-apps/acl which use acl in the base
system.
Besides this using ACL compliments grsec2 in protecting dirs and files.
Enabling ACL in the kernel for etx2/3, reiserfs, xfs completes the
picture for a hardened install.
Think that ACLs are good addition to ordinary Unix/Linux permissions.
Thanks.
Rumen
Re: USE="acl" in profiles [ In reply to ]
On Tue, 2004-09-21 at 09:13, Chris Gianelloni wrote:
> On Mon, 2004-09-20 at 12:41, Benjamin Judas wrote:
> > There is a slight problem regarding the USE-Settings in the profiles:
> >
> > GRP_STAGE23_USE="ipv6 pam tcpd readline nls ssl gpm perl python berkdb acl ncurses"
> >
> > As you can see, this defines acl. Now:
> >
> > USE="x86 oss apm arts avi berkdb bitmap-fonts crypt cups encode foomaticdb gdbm
> > gif gpm gtk gtk2 imlib jpeg kde gnome libg++ libwww mad mikmod motif mpeg ncurses
> > nls oggvorbis opengl pam pdflib png python qt quicktime readline sdl slang spell
> > ssl svga tcpd truetype X xml2 xmms xprint xv zlib"
> >
> > This doesn't define acl.
> >
> > This could break things if users don't set USE="acl" on bootstrap/emerge system.
> > Possible solutions could be to either remove acl from GRP_STAGE23_USE or add it to
> > USE. The first solution would cause everybody using acl to not be able to install without
> > any problems. Putting it into USE would cause an overhead for everybody. The overhead
> > doesn't seem to be that big, but...well...it's an overhead.
> >
> > What do you think about it and how do you think this should be solved?
>
> We should not remove the ability to install using acl. I also think
> that it is required for somethings (hardened?) and should stay. I think
> my main problem is I don't understand how the situation is broken.
> Could you perhaps paint a better picture for me (and all the other
> devs)?


drop it++

Some USE flags almost need maintainers (and this is one of them). There
are special patches that have to be applied to packages that don't seem
to be going upstream. Sometimes these are patches that conflict with the
natural course of upgrading/version bumps of packages and the complete
logic has to be reworked. When these conflicts happen where the acl flag
conflicts said patches are simply dropped. So I'm thinking that a full
bootstrap is currently only half arse with USE=acl and not a complete
solution.

If somebody/existing dev is willing to take on the responsibility for
said flag then hey great leave it in the stages but as is it's
incomplete as I've pointed out.

And as josh has pointed out hardened does not need it in anyway shape or
form.

Furthermore it's quite a confusing USE flag name to begin with.
What's it really needed for?

Gentoo supports atleast 3 types of access control systems that I can
think of so not sure why this one has to be so descriptive.

--
Ned Ludd <solar@gentoo.org>
Gentoo (hardened,security,infrastructure,embedded,toolchain) Developer
Re: USE="acl" in profiles [ In reply to ]
On Tue, 2004-09-21 at 15:00, Ned Ludd wrote:


> Gentoo supports atleast 3 types of access control systems that I can
> think of so not sure why this one has to be so descriptive.

s/descriptive/undescriptive/g

--
Ned Ludd <solar@gentoo.org>
Gentoo (hardened,security,infrastructure,embedded,toolchain) Developer
Re: USE="acl" in profiles [ In reply to ]
On Tue, 2004-09-21 at 15:00, Ned Ludd wrote:
> On Tue, 2004-09-21 at 09:13, Chris Gianelloni wrote:
> > On Mon, 2004-09-20 at 12:41, Benjamin Judas wrote:
> > > There is a slight problem regarding the USE-Settings in the profiles:
> > >
> > > GRP_STAGE23_USE="ipv6 pam tcpd readline nls ssl gpm perl python berkdb acl ncurses"
> > >
> > > As you can see, this defines acl. Now:
> > >
> > > USE="x86 oss apm arts avi berkdb bitmap-fonts crypt cups encode foomaticdb gdbm
> > > gif gpm gtk gtk2 imlib jpeg kde gnome libg++ libwww mad mikmod motif mpeg ncurses
> > > nls oggvorbis opengl pam pdflib png python qt quicktime readline sdl slang spell
> > > ssl svga tcpd truetype X xml2 xmms xprint xv zlib"
> > >
> > > This doesn't define acl.
> > >
> > > This could break things if users don't set USE="acl" on bootstrap/emerge system.
> > > Possible solutions could be to either remove acl from GRP_STAGE23_USE or add it to
> > > USE. The first solution would cause everybody using acl to not be able to install without
> > > any problems. Putting it into USE would cause an overhead for everybody. The overhead
> > > doesn't seem to be that big, but...well...it's an overhead.
> > >
> > > What do you think about it and how do you think this should be solved?
> >
> > We should not remove the ability to install using acl. I also think
> > that it is required for somethings (hardened?) and should stay. I think
> > my main problem is I don't understand how the situation is broken.
> > Could you perhaps paint a better picture for me (and all the other
> > devs)?
>
>
> drop it++

It is dropped in the newly-created default-linux/x86/2004.3 profile. It
is, in fact, the only change at the moment. I am not sure if we will
see any other changes at this point in the profile before 2004.3, but I
still wouldn't recommend people switching to it simply because we
might... *grin*

> Some USE flags almost need maintainers (and this is one of them). There
> are special patches that have to be applied to packages that don't seem
> to be going upstream. Sometimes these are patches that conflict with the
> natural course of upgrading/version bumps of packages and the complete
> logic has to be reworked. When these conflicts happen where the acl flag
> conflicts said patches are simply dropped. So I'm thinking that a full
> bootstrap is currently only half arse with USE=acl and not a complete
> solution.
>
> If somebody/existing dev is willing to take on the responsibility for
> said flag then hey great leave it in the stages but as is it's
> incomplete as I've pointed out.
>
> And as josh has pointed out hardened does not need it in anyway shape or
> form.
>
> Furthermore it's quite a confusing USE flag name to begin with.
> What's it really needed for?
>
> Gentoo supports atleast 3 types of access control systems that I can
> think of so not sure why this one has to be so descriptive.

Hey, man... removing it is fine by me. That's like 2 more packages that
don't get added to the LiveCD and take up room.

--
Chris Gianelloni
Release Engineering - Operations/QA Manager
Games - Developer
Gentoo Linux

Is your power animal a penguin?
Re: USE="acl" in profiles [ In reply to ]
> > Gentoo supports atleast 3 types of access control systems that I can
> > think of so not sure why this one has to be so descriptive.
>
> Hey, man... removing it is fine by me. That's like 2 more packages that
> don't get added to the LiveCD and take up room.

Hey man.. :-)

I hope you didn't misinterpret the last mail as any sort of attack on or
towards you. The RE: to you was just as good as anybody in my minds eye.

Glad your able to save a few cpu cycles and QA becomes much cleaner and
simpler for/by default.

-peace

--
Ned Ludd <solar@gentoo.org>
Gentoo (hardened,security,infrastructure,embedded,toolchain) Developer
Re: USE="acl" in profiles [ In reply to ]
On Tue, 2004-09-21 at 16:59, Ned Ludd wrote:
> Hey man.. :-)
>
> I hope you didn't misinterpret the last mail as any sort of attack on or
> towards you. The RE: to you was just as good as anybody in my minds eye.

I didn't think that was an attack at all. I was trying to be a little
humorous, since I was pretty much for the removal all along and you went
into this pretty long, but quite informative spiel on the evils of
USE=acl.

> Glad your able to save a few cpu cycles and QA becomes much cleaner and
> simpler for/by default.

Definitely. In fact, I had tried to remove the acl/attr packages at one
point and it broke things like "ls", so needless to say I was a bit
miffed. My current stance on the LiveCD is any byte saved is one less
byte wasted on the mirrors.

> -peace

Ditto...

--
Chris Gianelloni
Release Engineering - Operations/QA Manager
Games - Developer
Gentoo Linux

Is your power animal a penguin?
Re: USE="acl" in profiles [ In reply to ]
>>Glad your able to save a few cpu cycles and QA becomes much cleaner and
>>simpler for/by default.
>
>
> Definitely. In fact, I had tried to remove the acl/attr packages at one
> point and it broke things like "ls", so needless to say I was a bit
> miffed. My current stance on the LiveCD is any byte saved is one less
> byte wasted on the mirrors.

Just a note on this. Unpack a stage3 tarball. "emerge ufed". Set your
USE flags, noting that acl isn't really very useful anyway and dropping
it. Do an "emerge depclean". Watch your stage3 eat itself alive.

And yes, I have done this loooooads of times, and had to retrieve
libacl.so and libattr.so from the LiveCD.

--
gentoo-dev@gentoo.org mailing list
Re: USE="acl" in profiles [ In reply to ]
On Wednesday 22 September 2004 5:33 pm, Robert Moss wrote:
> >>Glad your able to save a few cpu cycles and QA becomes much cleaner and
> >>simpler for/by default.
> >
> > Definitely. In fact, I had tried to remove the acl/attr packages at one
> > point and it broke things like "ls", so needless to say I was a bit
> > miffed. My current stance on the LiveCD is any byte saved is one less
> > byte wasted on the mirrors.
>
> Just a note on this. Unpack a stage3 tarball. "emerge ufed". Set your
> USE flags, noting that acl isn't really very useful anyway and dropping
> it. Do an "emerge depclean". Watch your stage3 eat itself alive.
>
> And yes, I have done this loooooads of times, and had to retrieve
> libacl.so and libattr.so from the LiveCD.
Good thing they were on the LiveCD...
Maybe someone should fix depclean to check what was in USE at emerge-time
instead of the current USE?
--
Luke-Jr
Developer, Utopios
http://utopios.org/
Re: USE="acl" in profiles [ In reply to ]
* Robert Moss (robmoss@gentoo.org) wrote:
> >>Glad your able to save a few cpu cycles and QA becomes much cleaner and
> >>simpler for/by default.
> >
> >
> >Definitely. In fact, I had tried to remove the acl/attr packages at one
> >point and it broke things like "ls", so needless to say I was a bit
> >miffed. My current stance on the LiveCD is any byte saved is one less
> >byte wasted on the mirrors.
>
> Just a note on this. Unpack a stage3 tarball. "emerge ufed". Set your
> USE flags, noting that acl isn't really very useful anyway and dropping
> it. Do an "emerge depclean". Watch your stage3 eat itself alive.
>
> And yes, I have done this loooooads of times, and had to retrieve
> libacl.so and libattr.so from the LiveCD.

acl isn't even on by default, so you don't have to remove it accidently
just unpacking a stage3 and running depclean will break it

--
Thomas Matthijs (axxo,knu,keanu)
jabber: axxo[at]amessage[dot]be
GPG Key-ID: 0x682A3231

--
gentoo-dev@gentoo.org mailing list
Re: USE="acl" in profiles [ In reply to ]
On Wed, 2004-09-22 at 13:33, Robert Moss wrote:
> Just a note on this. Unpack a stage3 tarball. "emerge ufed". Set your
> USE flags, noting that acl isn't really very useful anyway and dropping
> it. Do an "emerge depclean". Watch your stage3 eat itself alive.
>
> And yes, I have done this loooooads of times, and had to retrieve
> libacl.so and libattr.so from the LiveCD.

Thanks for your experiences with USE=acl. I've removed it from the
2004.3 profile for x86, and hope the other arches follow suit. 2004.3
now won't eat itself when you "emerge depclean"... or at least, not
because of this.

*grin*

--
Chris Gianelloni
Release Engineering - Operations/QA Manager
Games - Developer
Gentoo Linux

Is your power animal a penguin?