Re: [Buildroot] R: [PATCH] support/download/dl-wrapper: make the whole dl_dir writeable for the group

["Yann E. MORIN" <yann.morin.1998@free.fr>]

Luca, All,

On 2022-12-02 13:47 +0000, Pesce Luca spake thusly:
> > Da: Yann E. MORIN <yann.morin.1998@free.fr>
> > Inviato: giovedì 1 dicembre 2022 21:25
> > A: Pesce Luca
> > Cc: buildroot@buildroot.org
> > Oggetto: Re: [Buildroot] [PATCH] support/download/dl-wrapper: make the whole dl_dir writeable for the group
[--SNIP--]
> > > +    # Make the whole dl_dir writeable for the group, so other users within
> > > +    # the group can download new versions and update any vcs cache in it.
> > > +    chmod -f -R g+w "${dl_dir}"
> > But what if the user initially had umask 0022 to begin with? By forcing
> > the group authorization with the chmod, you are overriding the user's
> > umask settings, which is not good... I for one would not want to have
> > group-writable directories (or files) created when I would have not
> > expected it.
> Yes, I can agree with this. However, BR already overrides the user's umask,
> and, at least in my case (umask=0002), this changes the user's default,
> denying g+w by design.

Yes, but the reason we do enforce a known umask, is to guarantee some
kind of reproducibility in the generated target image. See commit
bee5745ccc20 (Makefile: don't depend on the umask) which explains,
albeit only briefly, why we do it:

    Some packages and BR itself create files and directories on the target
    with cp/mkdir/etc which depend on the umask at the time of building.

Doing the fixups in target with an explicit chmod or whatever is not
possible. Indeed, some packages also do their own chmod, and we have no
way to know.

So, we can only resort to using a known umask. We chose 0022 because it
is sane by default, and usually, packages that install files like
executalbes, will want those to be world-executable (a system would not
be very useful is only root could run programs).

> > Instead, what about something like:
[--SNIP--]
> Yes, this looks good to me: you honor user's umask in the whole download
> phase, and keep the 0022 for other files created by BR. So a better approach,
> for sure!

Could you handle refining this change, test it, and when/if that works,
send it as a proper patch, please?

Regards,
Yann E. MORIN.

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot