Matthew Miller <mattdm <at> mattdm.org> writes:
>
> On Wed, Oct 08, 2008 at 10:31:46PM +0000, Kevin Kofler wrote:
> > The problem is that sudo doesn't work out of the box, it needs manual
> > configuration.
>
> And fixing that is in progress too.

By putting the first user into /etc/sudoers? That's completely and utterly
broken. Just because Ubuntu does something doesn't mean it makes sense. ;-)
sudo either needs to be fixed to prompt for the root password instead of
denying access altogether if the user is not in sudoers or replaced by
something which does (and can still be invoked with "sudo" because that's the
command people know).

Kevin Kofler

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Wed, Oct 8, 2008 at 11:12 PM, Kevin Kofler <kevin.kofler@chello.at> wrote:

> sudo either needs to be fixed to prompt for the root password instead of
> denying access altogether if the user is not in sudoers or replaced by

I've not tested this on Fedora quite yet, but I think in openSUSE they
have this by default:

Defaults: targetpw
ALL = ALL (ALL) ALL

This will cause sudo to prompt for the password of root if sudo is not
configured. And there's a very clear comment that you shouldn't take
out the first line without also taking out the second . IMHO,
that's a fairly sane solution to the problem.

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Thu, Oct 09, 2008 at 03:12:20AM +0000, Kevin Kofler wrote:
> By putting the first user into /etc/sudoers? That's completely and utterly

No.

> broken. Just because Ubuntu does something doesn't mean it makes sense. ;-)
> sudo either needs to be fixed to prompt for the root password instead of
> denying access altogether if the user is not in sudoers or replaced by
> something which does (and can still be invoked with "sudo" because that's the
> command people know).

That's doable as a config option, and a good suggestion.

--
Matthew Miller <mattdm@mattdm.org>
Senior Systems Architect
Cyberinfrastructure Labs
Computing & Information Technology
Harvard School of Engineering & Applied Sciences

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Ralf Corsepius wrote:

On Wed, 2008-10-08 at 16:01 -0500, Callum Lerwick wrote:

On Tue, 2008-10-07 at 08:33 -0400, Matthew Miller wrote:

On Tue, Oct 07, 2008 at 01:25:26AM -0400, Jon Stanley wrote:

The proper time to voice objections to this would have been there, 6
weeks ago now.

Well, as I thought the discussion had been left before that meeting, fixing
the general problem of user-level commands in the wrong places was the
feature and it was going to be solved properly. The feature is called "sbin
sanity", and I'm 100% in support of that. The "ah, hell, just put everything
in the path and call that sane" change came as a surprise to me.

https://fedoraproject.org/wiki/Features/SbinSanity

And under Scope it says: "Change the default PATH to
include /usr/local/sbin:/usr/sbin:/sbin for all users. Note that it must
come at the end of the path for normal users, or consolehelper will
break." According to the history, it's been there since at least May 24
2008, when it was imported from MoinMoin. A period of ~5 months.

If you're surprised by this, you simply aren't paying attention to the
feature process. I've seen many emails go out on fedora-announce about
the status of features, in which checking up on features you are
interested in is a single click away.

Also notable, in the discussion section of the May 24 revision, since
moved to the Talk page:

"Alternate approach: couldn't we just symlink commonly-used binaries
into /bin or /usr/bin?

Yes, but this requires editing and rebuilding dozens of RPMs and
constant argument about which binaries deserve special treatment. Lots
more work for very little actual improvement."

No one in this thread is making any point that hasn't already been
considered.

Correct, because none of these "alternatives" is discussworthy. Both are
equally broken.


What's broken about putting symlinks to the dozen or so programs that
have common non-root usage into /usr/bin? The symlinks could even be a
separate package that people who didn't like the idea could remove.
They don't even need to depend on the target package - if the target
executable doesn't exist you aren't any worse off with the symlink than
without. Nothing would have to be rebuilt.


--
Les Mikesell
lesmikesell@gmail.com

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Thu, 2008-10-09 at 07:50 -0500, Les Mikesell wrote:
> The symlinks could even be a
> separate package that people who didn't like the idea could remove.
> They don't even need to depend on the target package - if the target
> executable doesn't exist you aren't any worse off with the symlink than
> without. Nothing would have to be rebuilt.

Wouldn't work. You'd either have one package with a mess of dangling
symlinks, or you'd need a symlink package per main package which would
be as much or more work than just putting it in the main package to
begin with.
--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Callum Lerwick <seg <at> haxxed.com> writes:
> Wouldn't work. You'd either have one package with a mess of dangling
> symlinks, or you'd need a symlink package per main package which would
> be as much or more work than just putting it in the main package to
> begin with.

That's why Les said "if the target executable doesn't exist you aren't any
worse off with the symlink than without". Now that's a statement one can agree
or disagree with. I for one think having stuff in /usr/bin which points nowhere
is broken and it could actually make tab completion even less useful than the
status quo (depending on how smart the tab completion is with respect to broken
symlinks). So I think that, while this wasn't necessarily a bad idea in
principle, in practice (as you say) it won't work.

Kevin Kofler

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

Callum Lerwick wrote:

On Thu, 2008-10-09 at 07:50 -0500, Les Mikesell wrote:
The symlinks could even be a
separate package that people who didn't like the idea could remove.
They don't even need to depend on the target package - if the target
executable doesn't exist you aren't any worse off with the symlink than
without. Nothing would have to be rebuilt.


Wouldn't work. You'd either have one package with a mess of dangling
symlinks, or you'd need a symlink package per main package which would
be as much or more work than just putting it in the main package to
begin with.


Yes, putting it in the main package is the correct approach but that
hasn't been done and doesn't seem that likely. One package with
symlinks that might be dangling solves the real problem at the expense
of possibly annoying a few people who would have the simple option of
removing the package if they imagine that dangling symlinks are a
problem. Are there really installations that don't include ifconfig
anyway? How many others are there with common non-root usage?


--
Les Mikesell
lesmikesell@gmail.com

--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list

On Fri, 2008-10-10 at 08:34 +0000, Kevin Kofler wrote:
> Callum Lerwick <seg <at> haxxed.com> writes:
> > Wouldn't work. You'd either have one package with a mess of dangling
> > symlinks, or you'd need a symlink package per main package which would
> > be as much or more work than just putting it in the main package to
> > begin with.
>
> That's why Les said "if the target executable doesn't exist you aren't any
> worse off with the symlink than without". Now that's a statement one can agree
> or disagree with. I for one think having stuff in /usr/bin which points nowhere
> is broken and it could actually make tab completion even less useful than the
> status quo (depending on how smart the tab completion is with respect to broken
> symlinks). So I think that, while this wasn't necessarily a bad idea in
> principle, in practice (as you say) it won't work.

Well I was thinking more in terms of violating packaging guidelines.
rpmlint complains loudly about dangling symlinks. It could very well
*technically* work.
--
fedora-devel-list mailing list
fedora-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-devel-list