FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Gentoo > Gentoo User

 
 
LinkBack Thread Tools
 
Old 09-11-2010, 11:06 PM
Peter Humphrey
 
Default sudo in kernel config ?

On Saturday 11 September 2010 23:03:14 Etaoin Shrdlu wrote:

> Makes sense?

Not convinced. Sorry.

--
Rgds
Peter. Linux Counter 5290, 1994-04-23.
 
Old 09-11-2010, 11:15 PM
Etaoin Shrdlu
 
Default sudo in kernel config ?

On Sun, 12 Sep 2010 00:06:04 +0100 Peter Humphrey
<peter@humphrey.ukfsn.org> wrote:

> On Saturday 11 September 2010 23:03:14 Etaoin Shrdlu wrote:
>
> > Makes sense?
>
> Not convinced. Sorry.

The Merriam-Webster gives this definition of "potential":

"existing in possibility : capable of development into actuality"

which is exactly what I meant in my original post. I linked a document (if
you read that), and the exploit described there could happen only if one
installed the kernel sources downloaded from kernel.org. Hence the
"potential" in the above meaning: if one did not use those sources,
there was no risk for that specific exploit.

But since you're not convinced, now it would be nice, for my own education,
and perhaps someone else's, that you elaborated a bit more. What exactly do
you find non convincing in that usage of the adjective? How would you
express the concept better?
 
Old 09-11-2010, 11:17 PM
Alan McKinnon
 
Default sudo in kernel config ?

Apparently, though unproven, at 23:47 on Saturday 11 September 2010, Dale did
opine thusly:


> >> My point was, if the sources are say in the user group, then any user
> >> can edit them? Right now, they are in the root group and owned my root
> >> which for security reasons is a good idea. That way a regular user can't
> >> edit or modify the kernel sources.
> >
> > The group can only write if the files have the group write permission
> > set. Still in Unix 101 domain, hehe
>
> I know that. Why would a person want anyone BUT root to be able to
> access and change the kernel sources? Lets see if asking it this way
> makes more sense. lol


Gentoo does things different. If you read Documentation/* in the kernel
sources, you will not find there what Gentoo has.

/usr/src/linux was intended by the kernel devs[1] to be where the system
headers are stored - what glibc uses to build. Like everything else in /usr/
this is obviously writeable for root only (usually).

The intent is that you download kernel sources to ~, build there and sudo make
install.

Gentoo needs a kernel tree (not just headers) for all manner of stuff to build
against. These days many distros also do it this way to accommodate the needs
of getting nvidia-drivers and vm products to build their drivers etc. This
must obviously also be writeable only for root.

So, the ancient "advice" about not building as root is bullshit. It might have
been good advice once but like all advice it's time is past.

To answer your question:

"You wouldn't. Anything else is just daft."


[1] this itself might be ancient cruft and hopelessly out of date

--
alan dot mckinnon at gmail dot com
 
Old 09-12-2010, 07:29 AM
Gregory Shearman
 
Default sudo in kernel config ?

In linux.gentoo.user, you wrote:
>
> Some people, such as myself, use kernel sources outside of portage (I
> follow a git repo) and do so as a non-root user. In this case the
> kernel tree is not owned by root and the config/compile is easily done
> as a non-root user.
>
> If you are super-paranoid. You can make a non-root copy
> of /usr/src/linux and compile it as a non-root user.
>
> But there really isn't any point in using sudo. It's effectively doing
> the same thing that you are trying to avoid.

I agree there's no point in using sudo, but what's the problem? You
don't need to edit the kernel sources merely to build a new kernel. You
can build your kernel outside the tree using for example:
make O=/home/user/kernel/tree/ menuconfig
make O=/home/user/kernel/tree/

All files are put into the user's directory.

All that's need is the KBUILD_OUTPUT environment variable set, so that
drivers can find the kernel .config file etc.

I've built my kernels like this for years now. All kernels are built by
a specific user and then installed as root. No problem, no worries about
permissions and no altering the portage installed kernel sources so that
a purge (emerge -P gentoo-sources) will automatically remove the whole
tree.

--
Regards,

Gregory.
 
Old 09-12-2010, 08:14 AM
Stéphane Guedon
 
Default sudo in kernel config ?

Le Saturday 11 September 2010 22:51:47, Alan McKinnon a écrit :
> Apparently, though unproven, at 22:34 on Saturday 11 September 2010, Nikos
>
> Chantziaras did opine thusly:
> > On 09/11/2010 11:18 PM, Alan McKinnon wrote:
> > > Apparently, though unproven, at 11:46 on Saturday 11 September 2010,
> > > Albert
> > >
> > > Hopkins did opine thusly:
> > >> On Sat, 2010-09-11 at 10:24 +0200, Stéphane Guedon wrote:
> > >>> few months ago, I read linux kernel in a nutschell(sic), and the
> > >>> author wrote we shouldn't do kernel operations (config and build) as
> > >>> root.
> > >>
> > >> I call bullsh*t. I've been compiling kernels for 17 years and for the
> > >> most part have done it as root without any problems.
> > >
> > > Same here.
> > >
> > > The root user (sometimes portage) creates /usr/src/linux-*
> > >
> > > Someone tell me again exactly how user alan is supposed to build those
> > > sources?
> >
> > chown -R
>
> I utterly fail to see the point of this prohibition against building as
> root.
>
> Sure, it makes sense when I'm installing perl stuff for my users and last
> command is sudo make install. But for everything else?

Linux kernel in a nutschell, chapter 1 - Introduction.

You can read the pdf I send.

I am not paranoid anymore, saying it again. Just curious, wanting to know,
this sorte of things...

--
Stéphane Guedon
page web : http://www.22decembre.eu/
carte de visite : http://www.22decembre.eu/downloads/Stephane-Guedon.vcf
clé publique gpg : http://www.22decembre.eu/downloads/Stephane-Guedon.asc
 
Old 09-12-2010, 09:16 AM
Peter Humphrey
 
Default sudo in kernel config ?

On Sunday 12 September 2010 00:15:34 Etaoin Shrdlu wrote:

> But since you're not convinced, now it would be nice, for my own
> education, and perhaps someone else's, that you elaborated a bit
> more. What exactly do you find non convincing in that usage of the
> adjective? How would you express the concept better?

I did say I wasn't getting at you in particular, but what I dislike is
being bombarded by the broadcast media with "potential this" and
"possible that", when only a few years ago no-one would have dreamed of
putting the extra word in. We even heard of someone being charged with
an alleged crime recently, which is plain nonsense.

A risk is a risk, no matter how indirect it starts out.

But this is all way off-topic, so I propose to pipe down. No-one's likely
to be convinced anyway.

--
Rgds
Peter. Linux Counter 5290, 1994-04-23.
 
Old 09-12-2010, 10:24 AM
Etaoin Shrdlu
 
Default sudo in kernel config ?

On Sun, 12 Sep 2010 10:16:31 +0100 Peter Humphrey
<peter@humphrey.ukfsn.org> wrote:

> On Sunday 12 September 2010 00:15:34 Etaoin Shrdlu wrote:
>
> > But since you're not convinced, now it would be nice, for my own
> > education, and perhaps someone else's, that you elaborated a bit
> > more. What exactly do you find non convincing in that usage of the
> > adjective? How would you express the concept better?
>
> I did say I wasn't getting at you in particular, but what I dislike is
> being bombarded by the broadcast media with "potential this" and
> "possible that", when only a few years ago no-one would have dreamed of
> putting the extra word in. We even heard of someone being charged with
> an alleged crime recently, which is plain nonsense.

I see. I haven't had a TV set for about 12 years now, so I'm probably
somewhat less exposed to that, although I think I see where you're coming
from.

> A risk is a risk, no matter how indirect it starts out.

Of course, but it may affect different people to different degrees, or may
not even affect some of them. That's what I meant.

A rose is a rose is a rose, but it can be pink, red, white...it still
remains a rose. But sometimes the attribute can make a difference.
 
Old 09-12-2010, 04:36 PM
Bill Longman
 
Default sudo in kernel config ?

I agree there's no point in using sudo, but what's the problem? You


don't need to edit the kernel sources merely to build a new kernel. You

can build your kernel outside the tree using for example:

make O=/home/user/kernel/tree/ menuconfig

make O=/home/user/kernel/tree/



This is how I do it, too, when testing the kernel before I do it for real. This way, the code stays owned by root and I can make to my hearts content, with different kernels going into different directories that I control.

--
Bill Longman
 
Old 09-12-2010, 04:45 PM
Al
 
Default sudo in kernel config ?

>> This was actually a potential risk once upon a time:
>
> Sorry to drift from the topic, but would somebody please explain to me
> what a potential risk is? How does it differ from a risk?

A risk is always potential. A potential risk is when you are not sure
if it is a risk at all.

Al
 
Old 09-12-2010, 04:59 PM
walt
 
Default sudo in kernel config ?

On 09/11/2010 01:18 PM, Alan McKinnon wrote:


The root user (sometimes portage) creates /usr/src/linux-*

Someone tell me again exactly how user alan is supposed to build those
sources?


From the kernel README:

To configure and build the kernel use:
cd /usr/src/linux-2.6.N
make O=/home/name/build/kernel menuconfig
make O=/home/name/build/kernel
 

Thread Tools




All times are GMT. The time now is 03:49 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright ©2007 - 2008, www.linux-archive.org