3 ms·

What surprises me is that even after 25 years of the Internet, we cannot bring in new tools into our environment (be it a remote box I ssh into or a trimmed dow

by foo101 9y ago

What surprises me is that even after 25 years of the Internet, we cannot bring in new tools into our environment (be it a remote box I ssh into or a trimmed down docker image) on the fly. The popular package management tools rely heavily on FHS and like to install stuff into directories that require root permission. Imagine if there was a tool that could download binaries of modern tools from a certain repo and install it to our ~/bin. Imagine if we could use new command line tools as easily as we can download a fully functional complex applications securely into a browser tab just by typing its URL!

wruza 9y ago
sudo chown -R user:user /usr, that’s what you effectively suggest. Also convince tool makers to provide ppas.
laumars 9y ago
You can. There's nothing stopping you adding ~/bin to $PATH. Many compilers allow you to specify the destination location either via a ./configure flag (for example) or an environmental variable. Or there is always the option of doing a `make build` and then manually copying the binaries into your ~/bin directory without doing a `make install` You can also add ~/lib (for example) to your LD_LIBRARY_PATH path if you wanted to install custom libraries and even have your own man page path too. All of this is already possibly on Linux and Unix however I'm not sure it's something you actively want to encourage as allowing users to install whatever they want on servers lowers the security to the level of the worst user on that server. If it was really deemed necessary that users should be able to install whatever they want then I'd sooner roll out a dedicated VM per user so at least their damage is self-contained (barring any visible networked infrastructure)
- coldtea 9y ago
  >You can. There's nothing stopping you adding ~/bin to $PATH. Many compilers allow you to specify the destination location either via a ./configure flag (for example) or an environmental variable. Of course you can, technically. The parent laments why it's not easier to achieve. Already you're talking about manually building for example. Where's a package manager that will allow for that too, not just the central repo? (not just asking if such manager exists in some form, asking where it is in modern popular distros). >All of this is already possibly on Linux and Unix however I'm not sure it's something you actively want to encourage as allowing users to install whatever they want on servers lowers the security to the level of the worst user on that server. Which also touches the parent's question. Why is it not easier AND safer? It's not like we don't have security models that allow for such things...
  - hnlmorg 9y ago
    The GP had exampled one easier and safer way of doing this: sandbox each user in their own Linux instance. Anything short of that would be sacrificing security for the sake of convenience.
- foo101 9y ago
  This is precisely what I am forced to do and I do this very often when I have to setup my environment in a remote box I don't have root-login too. But this is by no means a trivial process compared to how easily we load a complex app into a browser tab just by clicking a URL. I think it is fair to hope that after 25 years of Internet, it should be easy to bring in new tools from the Internet into our local environment without requiring root access in a safe and trivial manner.
  - laumars 9y ago
    Firstly the internet is a lot older than 25 years (perhaps you mean web?) and secondly if the last 25 years has taught us anything it's that allowing users to download and install whatever they want usually leads to problems. I mean I do get your point and even sympathise with it, to a point. But if someone needs SSH access and I don't trust them enough to put them in the sudoers file, then I'm not going to trust them enough to even choose what software to install and run from their own local user area. I've been burnt before from intelligent people doing stupid things because they thought they knew what they were doing. So if you're not a sysadmin and you're logging into a shared host, then you don't get install rights. I don't think that's an unreasonable stance to take.
thristian 9y ago
Nix[1] says hi. [1]: https://nixos.org/nix/ https://nixos.org/nix/
- zzzcpan 9y ago
  Nix now can download and install binaries into a home directory? I thought it would require quite a bit of work on a building process and binary patching post installation, since you know, a lot of things require absolute paths, like an elf interpreter for example.
  - Sean1708 9y ago
    As far as I'm aware any user (regardless of whether they have root) can install/update/delete packages when Nix is run in multi-user mode[0]. [0]: https://nixos.org/nix/manual/#ch-nix-security https://nixos.org/nix/manual/#ch-nix-security
  - marcosdumay 9y ago
    The NixOS way would be to install binaries at the system directories, but for your user only. I don't know if this is possible with plain Nix (not the OS).
marcosdumay 9y ago
The problem is that after 25 years of the Internet, we have almost completely stopped using multi-user systems. It even used to be easier to make stuff run from your homedir. We are moving from it, not towards it. It is really a shame for the few multi-user setups out there.

by foo101 9y ago

wruza 9y ago

sudo chown -R user:user /usr, that’s what you effectively suggest. Also convince tool makers to provide ppas.

laumars 9y ago

You can. There's nothing stopping you adding ~/bin to $PATH. Many compilers allow you to specify the destination location either via a ./configure flag (for example) or an environmental variable. Or there is always the option of doing a `make build` and then manually copying the binaries into your ~/bin directory without doing a `make install` You can also add ~/lib (for example) to your LD_LIBRARY_PATH path if you wanted to install custom libraries and even have your own man page path too. All of this is already possibly on Linux and Unix however I'm not sure it's something you actively want to encourage as allowing users to install whatever they want on servers lowers the security to the level of the worst user on that server. If it was really deemed necessary that users should be able to install whatever they want then I'd sooner roll out a dedicated VM per user so at least their damage is self-contained (barring any visible networked infrastructure)

coldtea 9y ago
>You can. There's nothing stopping you adding ~/bin to $PATH. Many compilers allow you to specify the destination location either via a ./configure flag (for example) or an environmental variable. Of course you can, technically. The parent laments why it's not easier to achieve. Already you're talking about manually building for example. Where's a package manager that will allow for that too, not just the central repo? (not just asking if such manager exists in some form, asking where it is in modern popular distros). >All of this is already possibly on Linux and Unix however I'm not sure it's something you actively want to encourage as allowing users to install whatever they want on servers lowers the security to the level of the worst user on that server. Which also touches the parent's question. Why is it not easier AND safer? It's not like we don't have security models that allow for such things...
- hnlmorg 9y ago
  The GP had exampled one easier and safer way of doing this: sandbox each user in their own Linux instance. Anything short of that would be sacrificing security for the sake of convenience.
foo101 9y ago
This is precisely what I am forced to do and I do this very often when I have to setup my environment in a remote box I don't have root-login too. But this is by no means a trivial process compared to how easily we load a complex app into a browser tab just by clicking a URL. I think it is fair to hope that after 25 years of Internet, it should be easy to bring in new tools from the Internet into our local environment without requiring root access in a safe and trivial manner.
- laumars 9y ago
  Firstly the internet is a lot older than 25 years (perhaps you mean web?) and secondly if the last 25 years has taught us anything it's that allowing users to download and install whatever they want usually leads to problems. I mean I do get your point and even sympathise with it, to a point. But if someone needs SSH access and I don't trust them enough to put them in the sudoers file, then I'm not going to trust them enough to even choose what software to install and run from their own local user area. I've been burnt before from intelligent people doing stupid things because they thought they knew what they were doing. So if you're not a sysadmin and you're logging into a shared host, then you don't get install rights. I don't think that's an unreasonable stance to take.

thristian 9y ago

Nix[1] says hi. [1]: https://nixos.org/nix/ https://nixos.org/nix/

zzzcpan 9y ago
Nix now can download and install binaries into a home directory? I thought it would require quite a bit of work on a building process and binary patching post installation, since you know, a lot of things require absolute paths, like an elf interpreter for example.
- Sean1708 9y ago
  As far as I'm aware any user (regardless of whether they have root) can install/update/delete packages when Nix is run in multi-user mode[0]. [0]: https://nixos.org/nix/manual/#ch-nix-security https://nixos.org/nix/manual/#ch-nix-security
- marcosdumay 9y ago
  The NixOS way would be to install binaries at the system directories, but for your user only. I don't know if this is possible with plain Nix (not the OS).

marcosdumay 9y ago

The problem is that after 25 years of the Internet, we have almost completely stopped using multi-user systems. It even used to be easier to make stuff run from your homedir. We are moving from it, not towards it. It is really a shame for the few multi-user setups out there.