From 10476eb8c3cf1ff8ac538bcf223d032bb935fc02 Mon Sep 17 00:00:00 2001 From: Martin Natano Date: Wed, 5 Oct 2016 18:00:42 +0000 Subject: De-escalate to an unprivileged users during 'make build' and 'make release'. - If you start make build as root, everything will be run as root. Nothing new here. New is, that you can set BUILDUSER=somebody and the unprived parts will be run as somebody. - If you start make build with sudo, the unprived parts will be run as the real user (meaning YOU). You can still set BUILDUSER=somebody and the uprived parts will run as somebody. - If you start make build as a normal user it will error out. "I'm sorry Dave." Note that DESTDIR must be on partition with the noperm flag set for make release to work correctly as an unprivileged user. idea and ok deraadt input and ok tb ratchov millert rpe, halex and probably others where part of the conversation to make this happen, thanks! --- etc/Makefile | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'etc') diff --git a/etc/Makefile b/etc/Makefile index 5be76089576..22ec0e1a51c 100644 --- a/etc/Makefile +++ b/etc/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.435 2016/10/04 16:54:31 deraadt Exp $ +# $OpenBSD: Makefile,v 1.436 2016/10/05 18:00:41 natano Exp $ TZDIR= /usr/share/zoneinfo LOCALTIME= Canada/Mountain @@ -241,6 +241,15 @@ release: @false .else +release: + @if [[ `id -u` -ne 0 ]]; then \ + echo 'must be called by root' 2>&1; \ + false; \ + fi + su ${BUILDUSER} -c 'exec ${MAKE} release-sets' + ${MAKE} distrib + su ${BUILDUSER} -c 'exec ${MAKE} sha' + release-sets: cd ${RELEASEDIR} && rm -f SHA256 cd ../distrib/sets && exec sh maketars ${OSrev} @@ -251,9 +260,6 @@ sha: cksum -a sha256 BUILDINFO INSTALL.`arch -ks` \ ${ALL_KERNELS} ${MDEXT} ${MISETS} | sort > SHA256 -release: sha -sha: distrib -distrib: release-sets kernels release-sets: distribution kernels .endif -- cgit v1.2.3