Browse Source

De-escalate to an unprivileged users during 'make build' and 'make release'.

- If you start make build as root, everything will be run as root.
Nothing new here. New is, that you can set BUILDUSER=somebody and the
unprived parts will be run as somebody.
- If you start make build with sudo, the unprived parts will be run as
the real user (meaning YOU). You can still set BUILDUSER=somebody and
the uprived parts will run as somebody.
- If you start make build as a normal user it will error out. "I'm sorry
Dave."
Note that DESTDIR must be on partition with the noperm flag set for make
release to work correctly as an unprivileged user.
idea and ok deraadt
input and ok tb ratchov millert
rpe, halex and probably others where part of the conversation to make
this happen, thanks!
OPENBSD_6_1
natano 8 years ago
parent
commit
e46707e627
1 changed files with 10 additions and 4 deletions
  1. +10
    -4
      src/etc/Makefile

+ 10
- 4
src/etc/Makefile View File

@ -1,4 +1,4 @@
# $OpenBSD: Makefile,v 1.435 2016/10/04 16:54:31 deraadt Exp $
# $OpenBSD: Makefile,v 1.436 2016/10/05 18:00:41 natano Exp $
TZDIR= /usr/share/zoneinfo
LOCALTIME= Canada/Mountain
@ -241,6 +241,15 @@ release:
@false
.else
release:
@if [[ `id -u` -ne 0 ]]; then \
echo 'must be called by root' 2>&1; \
false; \
fi
su ${BUILDUSER} -c 'exec ${MAKE} release-sets'
${MAKE} distrib
su ${BUILDUSER} -c 'exec ${MAKE} sha'
release-sets:
cd ${RELEASEDIR} && rm -f SHA256
cd ../distrib/sets && exec sh maketars ${OSrev}
@ -251,9 +260,6 @@ sha:
cksum -a sha256 BUILDINFO INSTALL.`arch -ks` \
${ALL_KERNELS} ${MDEXT} ${MISETS} | sort > SHA256
release: sha
sha: distrib
distrib: release-sets kernels
release-sets: distribution kernels
.endif


Loading…
Cancel
Save