NetBSD Problem Report #57847

From www@netbsd.org  Sat Jan 13 19:47:37 2024
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 106C71A9239
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 13 Jan 2024 19:47:37 +0000 (UTC)
Message-Id: <20240113194735.CE6F41A923A@mollari.NetBSD.org>
Date: Sat, 13 Jan 2024 19:47:35 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: unprivileged pkgsrc builds should be able to make privileged binary packages
X-Send-Pr-Version: www-1.0

>Number:         57847
>Category:       pkg
>Synopsis:       unprivileged pkgsrc builds should be able to make privileged binary packages
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jan 13 19:50:00 +0000 2024
>Originator:     Taylor R Campbell
>Release:        current
>Organization:
The pkgsrc privilegedation
>Environment:
>Description:
$ cd security/sudo
$ make show-var VARNAME=UNPRIVILEGED
yes
$ make package
=> Bootstrap dependency digest>=20211023: found digest-20220214
ERROR: This package is not available in unprivileged mode.

Although unprivileged pkgsrc can't _install_ privileged packages, i.e., packages with suid executables and similar, it should be able to _build_ them, e.g. with an mtree(8) input to pkg_create to record the privileged permissions.

Similarly, unprivileged builds mask some tools like `chown', replacing them by `true' in installed scripts, like pbulk's pkg-build script.  But you should be able to do unprivileged builds of such packages; the build process doesn't need to execute chown in order to bake it into a script.
>How-To-Repeat:
1. set UNPRIVILEGED=yes
2. build a privileged package like security/sudo
3. try to use a package that runs chown at runtime
>Fix:
Yes, please!

Home	PR Database Search