Hi.

On Tue, 07 Oct 2008 09:22:54 +0200, Enrico Scholz wrote:

> Perhaps, Fedora should get a fishing and agrarian committee where
> things can be accepted which were declined in previous discussions.

I think you may have to explain that one to the non-EU people here

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Tue, 7 Oct 2008 00:09:08 -0400, Matthew Miller wrote:

> $ /usr/sbin/firstboot
> firstboot ERROR: You must be root to run firstboot.
>
> That can pretty much stand in analogy for the entire rest of whatever you
> had to say.
>
> No, we don't start voting. We put things where it's sensible.

We do have a committee that's supposed to make sensible decisions, don't
we? Superuser executables in standard user's path is a crack idea.
Feel free to count that as one objection to those plans.

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Jon Stanley wrote:

....
The proper time to voice objections to this would have been there, 6
weeks ago now.


That statement would be correct if you were being criticized for trying
the change. But the criticism is about the consequence of the change and
that is always an open issue. Especially since there are many people who
are affected by this change who aren't subscribed to this particular list.

....
And to belabor the point even more, are there commands in the CURRENT
default path that can't be executed by normal users? You better
believe it! Following is from my F8 system:

$ ping -f 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
ping: cannot flood; minimal interval, allowed for user, is 200ms
$

Following your reasoning, I propose we move ping to /sbin. Not a very
sound course of reasoning, is it?




Please respond to the objection itself. There is a big difference
between "program can't be run" and "parameter can't be used". The latter
is not a path issue. You would have made a better point with "yum" whose
primary functionality needs root privileges but has user level options
like list.


BTW, I am very surprised that there are people out there who know how to
use "ifconfig" but don't know how to use "locate ifconfig | grep bin "
to see if the command really exists. I would expect to have the issue
show up more for people who expect to use ipconfig. So if you are
worried about scaring away newbies by making them think about system
admin functions, I suggest that you implement ipconfig.


If opinions count in this thread, I would personally want to see command
completion limited to what I have in my path. And I don't want "/sbin"
in my default path when I am not acting as a sys-admin.


--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Tue, Oct 07, 2008 at 01:25:26AM -0400, Jon Stanley wrote:
> The proper time to voice objections to this would have been there, 6
> weeks ago now.

Well, as I thought the discussion had been left before that meeting, fixing
the general problem of user-level commands in the wrong places was the
feature and it was going to be solved properly. The feature is called "sbin
sanity", and I'm 100% in support of that. The "ah, hell, just put everything
in the path and call that sane" change came as a surprise to me.


> 1) I've been admin'ing Linux (and Solaris, in the interest of full
> disclosure, and occasionally some AIX or HP-UX thrown in for good
> measure) boxen in some form for about 10 years now. One of the first
> things that I do in my user profile is to put these exact directories
> in my PATH. It makes my job easier. This particular reasoning is not
> good enough

You're doing this because either

1) You're not used to using sudo for admin commands (and now sudo works
right by default -- a change that predated )
2) There's a few user-level commands in the wrong place.


> 2) I support alot of newbie users. Let me try and explain this in a
> format that everyone will understand:

So, again, this makes it clear to me that most people who are chiming in in
support of the path change haven't been paying attention. Arrgh. Like I
said, talk about bike painting!

I support a lot of new users too. That's why I've been concerned about this.

Tell the user "sudo ifconfig". It's better than having them "su -" and *does
the right thing the right way*. (Although arguably ifconfig is one of the
commands that could be moved to /bin -- it's one of the few tricky cases so
it's a bad example.)


> So yes, this feature is necessary in order to make the distro more
> accessible to new users. For the small minority that don't agree with
> this change, it's highly likely that you know what you're doing and
> are using puppet or something similar, and can revert the change
> locally with a trivial amount of effort.

Or, maybe I've been working for years on getting into Fedora a better
solution that's better for new users and for heavy command-line users alike,
and am frustrated that it's been undermined.




> $ ping -f 192.168.1.1
[...]
> Following your reasoning, I propose we move ping to /sbin. Not a very
> sound course of reasoning, is it?

*rolls eyes*

Obviously your reasoning is not very sound. There's a CLEAR difference
between commands which can't or don't work at all without root, and those
which have additional features which work as root. Again, one of the easy
cases and we can both see where it belongs, so it's ridiculous to pick it as
an example.

--
Matthew Miller <mattdm@mattdm.org>
Senior Systems Architect
Cyberinfrastructure Labs
Computing & Information Technology
Harvard School of Engineering & Applied Sciences

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Matthew Miller <mattdm@mattdm.org> writes:

> No, we don't start voting. We put things where it's sensible. That's usually
> incredibly obvious, and where it's a more difficult case, we make a decision
> based on a reasonable policy. Like with, say, "does it even work as
> non-root" as one element. Crazy talk, I know, but there you have it.

If it is so incredibly obvious, how did tcpdump end up in /sbin? Once
you have moved all the networking utilities and all the disk utilities
from /sbin, is there really anything left?


/Benny

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Tue, Oct 7, 2008 at 8:18 AM, Benny Amorsen <benny+usenet@amorsen.dk> wrote:
> Matthew Miller <mattdm@mattdm.org> writes:
>
>> No, we don't start voting. We put things where it's sensible. That's usually
>> incredibly obvious, and where it's a more difficult case, we make a decision
>> based on a reasonable policy. Like with, say, "does it even work as
>> non-root" as one element. Crazy talk, I know, but there you have it.
>
> If it is so incredibly obvious, how did tcpdump end up in /sbin? Once
> you have moved all the networking utilities and all the disk utilities
> from /sbin, is there really anything left?


What system/specification is fedora following?

According to the FHS [1]:
/sbin is for "Utilities used for system administration (and other
root-only commands)"


[1] http://www.pathname.com/fhs/pub/fhs-2.3.html#SBINSYSTEMBINARIES

--
Fedora 9 : sulphur is good for the skin
( www.pembo13.com )

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Tue, 2008-10-07 at 08:33 -0400, Matthew Miller wrote:
> On Tue, Oct 07, 2008 at 01:25:26AM -0400, Jon Stanley wrote:
> > The proper time to voice objections to this would have been there, 6
> > weeks ago now.
>
> Well, as I thought the discussion had been left before that meeting, fixing
> the general problem of user-level commands in the wrong places was the
> feature and it was going to be solved properly. The feature is called "sbin
> sanity", and I'm 100% in support of that. The "ah, hell, just put everything
> in the path and call that sane" change came as a surprise to me.

https://fedoraproject.org/wiki/Features/SbinSanity

And under Scope it says: "Change the default PATH to
include /usr/local/sbin:/usr/sbin:/sbin for all users. Note that it must
come at the end of the path for normal users, or consolehelper will
break." According to the history, it's been there since at least May 24
2008, when it was imported from MoinMoin. A period of ~5 months.

If you're surprised by this, you simply aren't paying attention to the
feature process. I've seen many emails go out on fedora-announce about
the status of features, in which checking up on features you are
interested in is a single click away.

Also notable, in the discussion section of the May 24 revision, since
moved to the Talk page:

"Alternate approach: couldn't we just symlink commonly-used binaries
into /bin or /usr/bin?

Yes, but this requires editing and rebuilding dozens of RPMs and
constant argument about which binaries deserve special treatment. Lots
more work for very little actual improvement."

No one in this thread is making any point that hasn't already been
considered.
--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Matthew Miller <mattdm <at> mattdm.org> writes:
> Tell the user "sudo ifconfig". It's better than having them "su -" and *does
> the right thing the right way*. (Although arguably ifconfig is one of the
> commands that could be moved to /bin -- it's one of the few tricky cases so
> it's a bad example.)

The problem is that sudo doesn't work out of the box, it needs manual
configuration.

If someone taught sudo to prompt for the root password if the user is not in
sudoers, maybe even using consolehelper, so the password gets cached, your
suggestion would become a serious one. But in the current state, it's just a
PITA to teach a newbie (and the fact that there is a warning at the top
of /etc/sudoers not to edit it with anything other than visudo and vi being a
major usability disaster doesn't help - of course you can override EDITOR for
visudo or even ignore the huge warning and just use kwrite as root to edit it,
but the mere existence of that warning, with no instructions on how to use an
editor other than vi, is still very newbie-unfriendly), so newbie-friendly
instructions use su instead. Using sudo also reduces security (as only the user
password is needed to get root access, not the root password).

The problem is that sudo tries to be a helpful tool, but fails horribly at it.

Kevin Kofler

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Wed, Oct 08, 2008 at 10:31:46PM +0000, Kevin Kofler wrote:
> The problem is that sudo doesn't work out of the box, it needs manual
> configuration.


And fixing that is in progress too.


I'm okay with the current solution as a temporary patch if it makes people
feel better for now. It's annoying but I can live with it as a compromise --
but not as an excuse to avoid solving the problem.

--
Matthew Miller <mattdm@mattdm.org>
Senior Systems Architect
Cyberinfrastructure Labs
Computing & Information Technology
Harvard School of Engineering & Applied Sciences

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Wed, 2008-10-08 at 16:01 -0500, Callum Lerwick wrote:
> On Tue, 2008-10-07 at 08:33 -0400, Matthew Miller wrote:
> > On Tue, Oct 07, 2008 at 01:25:26AM -0400, Jon Stanley wrote:
> > > The proper time to voice objections to this would have been there, 6
> > > weeks ago now.
> >
> > Well, as I thought the discussion had been left before that meeting, fixing
> > the general problem of user-level commands in the wrong places was the
> > feature and it was going to be solved properly. The feature is called "sbin
> > sanity", and I'm 100% in support of that. The "ah, hell, just put everything
> > in the path and call that sane" change came as a surprise to me.
>
> https://fedoraproject.org/wiki/Features/SbinSanity
>
> And under Scope it says: "Change the default PATH to
> include /usr/local/sbin:/usr/sbin:/sbin for all users. Note that it must
> come at the end of the path for normal users, or consolehelper will
> break." According to the history, it's been there since at least May 24
> 2008, when it was imported from MoinMoin. A period of ~5 months.
>
> If you're surprised by this, you simply aren't paying attention to the
> feature process. I've seen many emails go out on fedora-announce about
> the status of features, in which checking up on features you are
> interested in is a single click away.
>
> Also notable, in the discussion section of the May 24 revision, since
> moved to the Talk page:
>
> "Alternate approach: couldn't we just symlink commonly-used binaries
> into /bin or /usr/bin?
>
> Yes, but this requires editing and rebuilding dozens of RPMs and
> constant argument about which binaries deserve special treatment. Lots
> more work for very little actual improvement."
>
> No one in this thread is making any point that hasn't already been
> considered.
Correct, because none of these "alternatives" is discussworthy. Both are
equally broken.

Ralf




--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list