On Fri, Feb 28, 2014 at 5:32 AM, Bernhard Voelker wrote:

On 02/28/2014 10:53 AM, Guido Berhoerster wrote:

...

I'd like to propose the following addition to the packaging policy regarding users and groups (https://en.opensuse.org/openSUSE:Packaging_guidelines#Users_and_Groups):

The names of users and groups which are created by a package should be prefixed with an underscore "_". This creates a safe namespace for the distribution and avoids collisions between system group and usernames which are created by packages and regular group and usernames.

I'm afraid I don't get the point.

What are examples of possible collisions? I mean which of the following are subject to collisions on a typical system?

$ cut -d: -f1 /etc/passwd | head -n -2 | paste -s -d ' ' at avahi bin colord daemon dnsmasq ftp games gdm lp mail man messagebus news nobody nscd ntop ntp obsrun polkitd postfix pulse root rtkit sshd statd svn tftp usbmux uucp vboxadd wwwrun

The "problem" with this example is you're only looking at local accounts and not including environments which use external naming services such as NIS/NIS+, LDAP, AD, etc, which may has hundreds or thousands of accounts and groups. In these environments collisions happen regardless of how much to try to limit scoop of user/group lookups.

Second, this will be inconsistent anyway because I don't think that anyone will want to rename e.g. 'root' to '_root' (for which someone already proposed an exemption list).

Third, some daemon user names today are already too long (>8) for tools like ps(1) ...

useradd(8) limits users names to 32 chars, see the CAVEATS section, however that is a local limit and if you're using an external name service longer user names are valid. I just created an LDAP user w/a username of 72 char's which was completely valid, not that I'm saying you'd want to do that. The LOGIN_NAME_MAX, getconf LOGIN_NAME_MAX, on my SLES/openSUSE systems is 256, and POSIX 2.9.2, _POSIX_LOGIN_NAME_MAX, sets that value to 9 chars.

$ ps -fu messagebus | cut -c 1-30 UID PID PPID C STIME message+ 413 1 0 Feb27

... and therefore an additional "_" makes things worse.

With the above in mind, I'd tend to -1.

Have a nice day, Berny

-- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

-- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

On Fri, 28 Feb 2014 16:01, Bernhard Voelker wrote: <snip>

Again: what was the starting point of the discussion, i.e. the problem? User "wwwrun" vs. "apache" as mentioned in the other thread? Well, that doesn't have much to do with collisions with normal user names, does it?

IMHO user apache is only valid to be used by a program named apache(|2), see other 'bound' names e.g. dnsmasq, vsftp, squid, avahi, lightdm, polkitd, postfix, rtkit, or similar. wwwrun on the other hand, implies all http-deamons, including php-instances, or other programs (e.g. loadbalancer, reverse proxies) dedicated to running a web-presence. "messagebus" is a afford, it should not have passed any simple sanity-check. Either it should be named dbus or _dbus or severely shorted to msgbus or even mbus (my fav is _dbus). No local service account should need more than 6 letters/digits, sorely from lowercase [a-z0-9] anything else gives us as admins or users hell, more likely sooner than later (hello, Murphy!), also, that would allow to start all local service accouts with a underscore (brings it up to 7 digits). See the mess around charsets, encodings, fonts and other 'oh so nice to have' 'features/bugs'. (Sorry, I'm jaded, mixed environment, multi unixes + M$, since 1996) - Yamaban. -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

* Bernhard Voelker [2014-02-28 11:32]:

On 02/28/2014 10:53 AM, Guido Berhoerster wrote:

...

I'd like to propose the following addition to the packaging policy regarding users and groups (https://en.opensuse.org/openSUSE:Packaging_guidelines#Users_and_Groups):

The names of users and groups which are created by a package should be prefixed with an underscore "_". This creates a safe namespace for the distribution and avoids collisions between system group and usernames which are created by packages and regular group and usernames.

I'm afraid I don't get the point.

What are examples of possible collisions? I mean which of the following are subject to collisions on a typical system?

$ cut -d: -f1 /etc/passwd | head -n -2 | paste -s -d ' ' at avahi bin colord daemon dnsmasq ftp games gdm lp mail man messagebus news nobody nscd ntop ntp obsrun polkitd postfix pulse root rtkit sshd statd svn tftp usbmux uucp vboxadd wwwrun

Have a look at the link I provided, there are 134 usernames and 139 group names. The point is to have a clean separation between the distribution and admin-controlled group and usernames, i.e. an admin should be able to rely on packages not creating non-prefixed usernames (outside aaa_base).

Second, this will be inconsistent anyway because I don't think that anyone will want to rename e.g. 'root' to '_root' (for which someone already proposed an exemption list).

Yes, in the other thread I already said aaa_base should be exempt so that root, nobody, nogroup and a few others are preserved. aaa_base is installed on every system and only provides a few users/groups.

Third, some daemon user names today are already too long (>8) for tools like ps(1) ...

$ ps -fu messagebus | cut -c 1-30 UID PID PPID C STIME message+ 413 1 0 Feb27

... and therefore an additional "_" makes things worse.

If you look at the above list you'll find quite a few that are already longer than 8 characters, I think there has been support for 32 character names at least since glibc 2.0 which would be 1997. ps can display the username without truncation, it just doesn't do so by default for historical reasons, see http://procps.sourceforge.net/faq.html. It also truncates other columns like the command. -- Guido Berhoerster -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

* Bernhard Voelker [2014-02-28 17:11]:

On 02/28/2014 04:09 PM, Guido Berhoerster wrote:

...

It also truncates other columns like the command.

Hmm, as other tools may also cut long user names at the end, what about *suffixing* daemon user names, e.g. "tfp$" (which useradd(8) permits) ... okay, this one looks MS'ish. ;-/

However, I think SUSE will live isolated with any such convention. How do other *IXes do this?

OpenBSD has been using this scheme since about 2002/2003, seem my initial mail which links to a post that analyzes the required modifications in their ports tree. -- Guido Berhoerster -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

* Bruno Friedmann [2014-02-28 18:39]:

On Friday 28 February 2014 10.53:56 Guido Berhoerster wrote:

...

I'd like to propose the following addition to the packaging policy regarding users and groups (https://en.opensuse.org/openSUSE:Packaging_guidelines#Users_and_Groups):

The names of users and groups which are created by a package should be prefixed with an underscore "_". This creates a safe namespace for the distribution and avoids collisions between system group and usernames which are created by packages and regular group and usernames.

Existing users and groups can be renamed with the following scriptlet:

%pre getent group GROUP >/dev/null && groupmod -n _GROUP GROUP getent group _GROUP >/dev/null || groupadd -r _GROUP getent passwd USER >/dev/null && usermod -l _USER USER getent passwd _USER >/dev/null || useradd -r -g _GROUP -d HOMEDIR -s /sbin/nologin -c "user for PACKAGENAME" _USER

I'm not in favor of this kind of solution. Simply due to the fact that I already use _ as an identifier for customers groups used samba & nfs serveurs. It clearly separate my groups from anything coming from packages.

If you run your script there's a risk to have collision with my already setup group like a _www like inserting package user in a personal group

Well, we are actually trying to address exactly this problem, only the other way around. And after the transition you'll have the guarantee that there will never be a collision with package groups/user, something that you don't have right now. There is a list of all groups and users created by packages in Factory, so you can easily write a small script that checks for potential collisions and preemptively rename affected users/groups, e.g. _www to __www.

What about using % ? :-)

Not as a prefix, from useradd(8): Usernames must start with a lower case letter or an underscore, followed by lower case letters, digits, underscores, or dashes. They can end with a dollar sign. In regular expression terms: [a-z_][a-z0-9_-]*[$]? -- Guido Berhoerster -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org

В Fri, 28 Feb 2014 18:39 +0100 Bruno Friedmann пишет:

What about using % ? :-)

It will likely be confusing to use in sudoers. -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org