Bug 140552 – emerge -Fp some_pkg fails for non-root users

• Status: RESOLVED FIXED
• Product: Portage Development

[Description Martin Minkov 2006-07-15 13:10:42 UTC]

In emerge the combination of the --pretend and --fetch-all-uri options leads to an error, if the command is run by a non-root user.

$ emerge -Fp portage

Calculating dependencies... done!

Traceback (most recent call last):
  File "/usr/bin/emerge", line 3524, in ?
    mydepgraph.merge(pkglist)
  File "/usr/bin/emerge", line 1911, in merge
    "\n".join(myfavdict.values()))
  File "/usr/lib/portage/pym/portage_util.py", line 693, in write_atomic
    f = atomic_ofstream(file_path)
  File "/usr/lib/portage/pym/portage_util.py", line 633, in __init__
    super(atomic_ofstream, self).__init__(tmp_name, mode=mode, **kargs)
IOError: [Errno 13] Permission denied: '/var/lib/portage/world.11894'

The package itself is not important. The command fails no matter which package it is performed on, as long as it is not run by root.

Steps to reproduce:
1. Create a user.
2. [OPTIONAL] Add the user to the "portage" group. <-- This is for completeness.
3. Run "emerge -Fp portage"

The problem is in the access mask for /var/lib/portage

$ ls -la /var/lib/portage

drwxr-s---  2 root portage   96 15 &#1102;&#1083;&#1080; 22,37 .
drwxr-xr-x 18 root root     448  8 &#1102;&#1083;&#1080; 10,38 ..
-rw-rw----  1 root portage 5956 15 &#1102;&#1083;&#1080; 20,58 config
-rw-r--r--  1 root root    3205 15 &#1102;&#1083;&#1080; 22,37 world

Suggested solutions:
1. Non-root users are not to be allowed to use this combination. The error is caught and a descriptive error message is printed. <-- Not really nice, since they can do an "emerge -fp some_pkg".
2. The temporary world file is created in another directory. Since I am not fluent in system security, I cannot suggest details.
3. Changing the access mask of /var/lib/portage as a solution to allow write access for users in the portage group. There might be security complications. This is a partial solution as for users not in the portage group the error will still occur.

That's what I can come up with. HTH

Additional info:

$ emerge --info

Portage 2.1-r1 (default-linux/x86/2006.0, gcc-3.4.6, glibc-2.3.6-r4, 2.6.16-gentoo-r12 i686)
=================================================================
System uname: 2.6.16-gentoo-r12 i686 AMD Sempron(tm)  2200+
Gentoo Base System version 1.6.15
app-admin/eselect-compiler: [Not Present]
dev-lang/python:     2.4.3-r1
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r3
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O3 -march=athlon-xp -mtune=athlon-xp -pipe -fforce-addr -fomit-frame-pointer "
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-O3 -march=athlon-xp -mtune=athlon-xp -pipe -fforce-addr -fomit-frame-pointer  -fvisibility-inlines-hidden"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks metadata-transfer sandbox sfperms strict"
GENTOO_MIRRORS="http://gentoo.itdnet.net/gentoo"
LANG="bg_BG.CP1251"
LC_ALL="bg_BG.CP1251"
LINGUAS="bg en"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 3dnow 3dnowext X aac alsa apache2 apm avi bitmap-fonts bzip2 cli crypt dlloader dri emboss encode expat ffmpeg flac gif gpm gstreamer gtk2 imlib ipv6 jpeg mad mmx mmxext mp3 mpeg ncurses nls nptl nptlonly nsplugin nvidia ogg opengl pam pcre perl png python qt qt3 qt4 quicktime readline reflection rtc sdl session spell spl sse ssl tcpd tiff truetype truetype-fonts type1-fonts udev unicode usb userlocales vorbis xml xmms xorg xv zlib elibc_glibc input_devices_keyboard input_devices_mouse kernel_linux linguas_bg linguas_en userland_GNU video_cards_nv video_cards_nvidia"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS

[Comment 1 Zac Medico 2006-08-04 21:36:08 UTC]

This is fixed in svn r4155.

[Comment 2 Lucas Chiesa 2006-08-05 08:53:13 UTC]

I've tried to reproduce this bug in 3 different systems. 2 x86 and 1 amd64 without any success. Though the portage version is the same, can the SVN fixed been applied without changing the version?

I've attached the emerge --info of these 3 systems.

It looks that this bug can be marked FIXED, but I'm not that confident yet ;)

Lucas Chiesa

[Comment 3 Lucas Chiesa 2006-08-05 08:53:55 UTC]

Created attachment 93511 [details]
first system emerge --info

[Comment 4 Lucas Chiesa 2006-08-05 08:54:17 UTC]

Created attachment 93512 [details]
second system emerge --info (amd64)

[Comment 5 Lucas Chiesa 2006-08-05 08:54:36 UTC]

Created attachment 93513 [details]
third system emerge --info

[Comment 6 Zac Medico 2006-08-05 12:08:01 UTC]

(In reply to comment #2)
> It looks that this bug can be marked FIXED, but I'm not that confident yet ;)

If you've been unable to trigger the symptom of the bug it's problably because your user is in the portage group.  My testing showed that the world file was being updated when it wasn't supposed to (thus the fix in svn r4155).

[Comment 7 Zac Medico 2006-08-06 04:16:03 UTC]

This has been released in 2.1.1_pre4-r4.

[Comment 8 Zac Medico 2006-08-06 04:19:12 UTC]

fixed...