no longer write to home folder directly; use /etc/skel

phabricator-migrator · February 19, 2024, 5:47pm

Information

ID: 419
PHID: PHID-TASK-satzm5cagfdqrtkqwmas
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

rationale:

for example https://github.com/Whonix/anon-gpg-tweaks/blob/3ebe733fa5198bc88de1af659d309f121d032205/debian/anon-gpg-tweaks.postinst#L23-L31 is non-ideal.
** hardcoded to user user, other created users won’t profit from these
** using sudo -u in maintainer script
** won’t work anymore in Qubes, once TemplateBasedVMs no longer inherits their TemplateVMs home (home folder of template not inherited by DispVM · Issue #1335 · QubesOS/qubes-issues · GitHub)

TODO:

~~no longer have packages (maintainer scripts) directly write to /home~~
~~use /etc/skel instead~~
~~copy files from /etc/skel to /home/user at first boot~~

Related, separate ticket:
ship Tor Browser tarballs in Qubes TemplateVMs in /var/cache/tb-binary and extract in AppVMs at boot time to user's home folder (T417)

Comments

Patrick

2015-12-03 22:11:08 UTC

no longer write to home folder directly; use /etc/skel;

https://phabricator.whonix.org/T419

proper error handling in xchat-reset
https://github.com/Whonix/xchat-improved-privacy/commit/aadea76e21b3804c053338bc9449b6c7962a91dd

Patrick

2015-12-03 22:33:42 UTC

no longer write to home folder directly; use /etc/skel;

https://phabricator.whonix.org/T419
https://github.com/Whonix/anon-mixmaster/commit/29105ddaecd1280ca706a7dfd7a19a53acf3ccdf
no longer write to home folder directly; use /etc/skel · Whonix/whonix-base-files@c34f29f · GitHub
added /etc/skel/.bashrc to debian/whonix-base-files.displace · Whonix/whonix-base-files@1a5ef1f · GitHub
fix https://phabricator.whonix.org/T419 · Whonix/whonix-base-files@b58518c · GitHub
https://github.com/Whonix/anon-torchat/blob/master/etc/skel/.torchat/torchat.ini
https://github.com/Whonix/anon-gpg-tweaks/commit/2ace0c0768d7f44fae12df48ac4b29287349b993

Patrick

2015-12-03 22:54:08 UTC

Patrick

2015-12-10 21:34:56 UTC

Patrick

2016-01-07 22:40:30 UTC

fix / code simplification

https://phabricator.whonix.org/T419
fix / code simplification · Whonix/whonix-base-files@9d7da26 · GitHub
separate done file for Qubes TemplateVMs to make this work with the
current home folder population for Qubes DispVMs.
https://github.com/QubesOS/qubes-core-agent-linux/blob/f380c346cf9af3f058b8ece853d7d4a5ece28815/misc/dispvm-prerun.sh#L6-L12

https://phabricator.whonix.org/T419
https://phabricator.whonix.org/T463
separate done file for Qubes TemplateVMs to make this work with the · Whonix/whonix-base-files@9ade708 · GitHub

Patrick

2016-01-07 22:52:44 UTC

Patrick

2016-01-07 22:55:57 UTC

Patrick

2016-04-21 21:42:31 UTC

Patrick

2016-04-26 20:01:49 UTC

There is a problem with the script which runs as root - https://github.com/Whonix/whonix-base-files/blob/master/usr/lib/anon-base-files/first-boot-skel - with the following commands.
sudo -u "$user_name" cp --verbose --no-clobber --archive --parents --recursive "$fso_basename" "$home_dir"
sudo -u "$user_name" cp --verbose --no-clobber --archive "$fso_basename" "$home_dir"
sudo -u "$user_name" cp --verbose --archive "$skel_folder/.bashrc.whonix" "$home_dir/.bashrc"
sudo -u user is problematic. It’s useful to not have files within /home/user being owned by root. But when using sudo -u user we cannot read files from folder /etc/skel/.gnupg, since these are owned by root. This could be solved by using cp as root and the fixing ownership using chown. It’s not great since in corner cases (power loss; race conditions) the execution could stop after cp ending up with files owned by root in users’s home.

Patrick

2016-04-26 21:20:16 UTC