Bug 248782

Summary:	Portage 2.2_r16 Doesn't Handle Permissions Well
Product:	Portage Development	Reporter:	Matt <matt.palermo>
Component:	Core	Assignee:	Portage team <dev-portage>
Status:	RESOLVED FIXED
Severity:	normal	Keywords:	InVCS
Priority:	High
Version:	unspecified
Hardware:	x86
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	210077, 216231

Description Matt 2008-11-25 12:58:46 UTC

When I tried to (accidentally) fetch an app as a user, portage spit out __init__.py errors, but as root, it's fine.  I thought it should fail gracefully as user telling me that I can't:

~~~~~~~~~~~~~~~~~~~~~

$ emerge -fv net-misc/cisco-vpnclient-3des

These are the packages that would be fetched, in order:

Calculating dependencies                  ... done!
[ebuild  N F  ] net-misc/cisco-vpnclient-3des-4.8.00.0490-r1  1,998 kB

Total: 1 package (1 new), Size of downloads: 1,998 kB
Fetch Restriction: 1 package (1 unsatisfied)


>>> Fetching (1 of 1) net-misc/cisco-vpnclient-3des-4.8.00.0490-r1
Traceback (most recent call last):
  File "/usr/bin/emerge", line 18, in <module>
    retval = _emerge.emerge_main()
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 14356, in emerge_main
    myopts, myaction, myfiles, spinner)
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 13335, in action_build
    retval = mergetask.merge()
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 9714, in merge
    rval = self._merge()
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 9956, in _merge
    self._main_loop()
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 10082, in _main_loop
    while self._schedule():
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 8570, in _schedule
    return self._schedule_tasks()
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 10103, in _schedule_tasks
    if q.schedule():
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 8462, in schedule
    task.start()
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 1661, in start
    self._start()
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 3614, in _start
    self._start_task(build, self._default_final_exit)
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 1949, in _start_task
    task.start()
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 1661, in start
    self._start()
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 2502, in _start
    self._prefetch_exit(prefetcher)
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 2515, in _prefetch_exit
    retval = fetcher.execute()
  File "//usr/lib/portage/pym/_emerge/__init__.py", line 1608, in execute
    private_tmpdir = mkdtemp("", "._portage_fetch_.", global_tmpdir)
  File "/usr/lib/python2.5/tempfile.py", line 328, in mkdtemp
    _os.mkdir(file, 0700)
OSError: [Errno 13] Permission denied: '/usr/portage/local/._portage_fetch_.uohbet'
palermo@aragorn ~ $ su
Password:
root@aragorn # emerge -fv net-misc/cisco-vpnclient-3des

These are the packages that would be fetched, in order:

Calculating dependencies                      ... done!
[ebuild  N F  ] net-misc/cisco-vpnclient-3des-4.8.00.0490-r1  1,998 kB

Total: 1 package (1 new), Size of downloads: 1,998 kB
Fetch Restriction: 1 package (1 unsatisfied)


>>> Fetching (1 of 1) net-misc/cisco-vpnclient-3des-4.8.00.0490-r1

!!! net-misc/cisco-vpnclient-3des-4.8.00.0490-r1 has fetch restriction turned on.
!!! This probably means that this ebuild's files must be downloaded
!!! manually.  See the comments in the ebuild for more information.

 * Please visit:
 *  http://cco.cisco.com/en/US/products/sw/secursw/ps2308/index.html
 * and download vpnclient-linux-x86_64-4.8.00.0490-k9.tar.gz to /usr/portage/distfiles
 * Fetch failed for 'net-misc/cisco-vpnclient-3des-4.8.00.0490-r1'

>>> Failed to emerge net-misc/cisco-vpnclient-3des-4.8.00.0490-r1

 * Messages for package net-misc/cisco-vpnclient-3des-4.8.00.0490-r1:

 * Fetch failed for 'net-misc/cisco-vpnclient-3des-4.8.00.0490-r1'
$

~~~~~~~~~~~~~~~~~~~~~

While I understand the fetch restriction, portage still shouldn't have barfed out the errors as user, t should've failed with the same (or close) message that it did as root.

The usual stuff:




# emerge --info
Portage 2.2_rc16 (default/linux/x86/2008.0/desktop, gcc-4.1.2, glibc-2.6.1-r0, 2.6.26-tuxonice i686)
=================================================================
System uname: Linux-2.6.26-tuxonice-i686-Intel-R-_Pentium-R-_4_CPU_3.00GHz-with-glibc2.0
Timestamp of tree: Mon, 24 Nov 2008 23:15:01 +0000
app-shells/bash:     3.2_p33
dev-java/java-config: 1.3.7, 2.1.6
dev-lang/python:     2.4.4-r14, 2.5.2-r7
dev-util/cmake:      2.6.2
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r2
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.1-r1
sys-devel/binutils:  2.18-r3
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.23-r3
ACCEPT_KEYWORDS="x86"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=i686 -pipe -fomit-frame-pointer -w"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/config"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/splash /etc/terminfo /etc/udev/rules.d"
CXXFLAGS="-O2 -march=i686 -pipe -ftracer -fomit-frame-pointer -w"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--keep-going"
FEATURES="candy distlocks fixpackages parallel-fetch preserve-libs protect-owned sandbox sfperms strict unmerge-orphans userfetch userpriv"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
LANG="en_US.ISO-8859-1"
LC_ALL="en_US.ISO-8859-1"
LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--hash-style=gnu -Wl,--enable-new-dtags -Wl,--warn-once"
LINGUAS="en en_US"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_COMPRESS="bzip2"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/usr/portage/local"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/desktop-effects /usr/portage/local/layman/kde-testing /opt/portage"
SYNC="rsync://rsync21.us.gentoo.org/gentoo-portage"

(I didn't include my USE flags since it's a mile long list and not relevant to this issue anyway, but if you want them I'll post them)

Reproducible: Always



Expected Results:  
Should've failed saying that there was a fetch restriction and that I didn't have permission as a user to do it anyway.

Comment 1 Zac Medico gentoo-dev

2008-11-25 19:39:22 UTC

The directory that is referenced by PORTAGE_TMPDIR is expected to be world writable (with sticky bit set). This should fix it:

 chmod 1777 /usr/portage/local

I'll fix portage to raise a PermissionDenied exception in the case that you've triggered, which will cause it to bail out with a simple 'Permission Denied: /usr/portage/local' message, instead of showing a big traceback.

Comment 2 Matt 2008-11-26 01:13:47 UTC

(In reply to comment #1)
> The directory that is referenced by PORTAGE_TMPDIR is expected to be world
> writable (with sticky bit set). This should fix it:
> 
>  chmod 1777 /usr/portage/local
> 

/me shakes his head.

Yes.  It *IS* supposed to be, isn't it...

I changed the permissions and it works as it should.


> I'll fix portage to raise a PermissionDenied exception in the case that you've
> triggered, which will cause it to bail out with a simple 'Permission Denied:
> /usr/portage/local' message, instead of showing a big traceback.
> 

Thank you!  Man, I love FOSS... :-)

M.

Comment 3 Zac Medico gentoo-dev

2008-11-27 04:18:47 UTC

This is fixed in 2.1.6_rc2.