Arch Linux

justin-8

Member

From: Queensland, Australia

Registered: 2013-06-18

Posts: 53

UID and GID in AUR packages

Hey everyone,

Since the pacman update a few weeks back that now checks UID/GID ownership on package updates I'm sure a lot of people have noticed warnings when installing AUR packages along the lines of:

  warning: directory ownership differs on /usr/lib/node_modules/jshint/src/platforms/ filesystem: 99:0  package: 0:0 

Official Arch packages have static UID/GID's specified and recorded here: https://wiki.archlinux.org/index.php/De … D_Database

Most packages (that I've seen at least) on the AUR use post_install hooks to do useradd/groupadd if they don't exist and then chown/chgrp the folders/files as required post-install. Unless the UID/GID is known before packaging (i.e. statically set so it is the same on a build machine and a user's machine) then it cannot be known by pacman.

Some packages now on the AUR are starting to use their own UID/GIDs hard coded. This *could* be a good idea and I would be onboard with it if there was some way of managing the list of chosen IDs so that we can avoid conflicts. But as it is many people are just choosing what they think will work, and without ensuring that the user is created already or by the package before trying to chown to a specific ID it can result in security holes of files being owned by random users. It may not be on purpose, but a lot of people without experience with this sort of thing can make security holes without even being aware of it.

Is there any official stance on what is correct in the AUR, and if so, what is it? If there is no official stance, then it would be really useful if we (AUR package maintainers) could be given some sort of direction that we can all follow to keep Arch stable and secure.

clfarron4

Member

From: London, UK

Registered: 2013-06-28

Posts: 2,175

Website

Re: UID and GID in AUR packages

I haven't seen anything official on the topic, but graysky tried to initiate a discussion about this with little success on the forums quite a while back. They do say this in that post:

I can grep for 'useradd' in my abs tree and parse through the resulting 137 lines but there must be a better way.

I'm pretty sure I've seen and replied to another post on this say exactly what I just said, but I can't seem to find it right now.

EDIT: With the AUR planned to move to a GIT-based system for package maintainers at some point in the future, I think it would be less of an issue, but I do understand the present issue right now.

Last edited by clfarron4 (2015-04-28 11:09:36)

---

Claire is fine.
Problems? I have dysgraphia, so clear and concise please.
My public GPG key for package signing
My x86_64 package repository

Raynman

Member

Registered: 2011-10-22

Posts: 1,539

Re: UID and GID in AUR packages

Since the pacman update a few weeks back that now checks UID/GID ownership on package updates I'm sure a lot of people have noticed warnings when installing AUR packages along the lines of:

Maybe you should check your mirrors. The last pacman update (to 4.2.1) was two months ago and it disabled these warnings, so we can keep using the post_install chown method until something better is agreed on and implemented.

justin-8

Member

From: Queensland, Australia

Registered: 2013-06-18

Posts: 53

Re: UID and GID in AUR packages

@clfarron4 That's sort of related; except I did mention exactly what he was searching for in my post; But the issue is that we have no real way to manage this currently and if too many AUR maintainers go off and pick random UID/GID combos we will end up with more and more conflicting packages which would make the AUR go from being super simple and easy (at least compared to PPAs/COPR/etc), to a pain when lots of things need to be modified on update, and check what UID you changed a package too, edit the pkgbuild, build it. etc, etc.

Maybe I missed something, but how would moving to a git based system help with tracking IDs? There are lots of other advantages and I can't wait for it to not be only on the dev version, but that I don't quite see.

Last edited by justin-8 (2015-04-28 11:30:28)

justin-8

Member

From: Queensland, Australia

Registered: 2013-06-18

Posts: 53

Re: UID and GID in AUR packages

@Raynman I had noticed they hadn't appeared in my more recent updates, but didn't realize it was intentionally disabled. I would prefer to stick to the current method as it is considerably more robust, at least without a way of preventing conflicting IDs. My issue is that I've been noticing other package maintainers hard coding IDs and wanted to have some some sort of at least semi-official notice I can point them to  when they eventually have conflicting IDs.