Cloning as root
reddit / freebsd

----------------------------------------------------------------------
Original_Two9716 · 2022-08-24 18:52

Simple question: When the Handbook suggests using git as the primary
way of obtaining the `/usr/src`, `/usr/doc` and such:
1. Should one clone as **root** there using `sudo` or `doas`, or clone
'locally' and copy there?
2. Is using git as root safe in general?
3. There's also the `/usr/doc/Makefile`. Should one `sudo make` there?

----------------------------------------------------------------------
rdcldrmr · 2022-08-24 19:44

That's bad advice in the handbook which should be fixed.

Create a dedicated user, named _gitclone or anything you want, and run
git as that user (with sudo) after changing the permissions of
/usr/src.

----------------------------------------------------------------------
Original_Two9716 · 2022-08-24 19:48

Yes, running programs like git under `sudo` feels very weird.

----------------------------------------------------------------------
12Darius21 · 2022-08-25 05:29

Another option is to change ownership of /usr/src and /usr/obj to
whatever your user is. It won't affect anything else in the system
(and these days you are likely the only human using a given system)

----------------------------------------------------------------------
Original_Two9716 · 2022-08-25 09:30

That sounds like the best solution. Wouldn't it cause any issues
chowning those files?

----------------------------------------------------------------------
mirror176 · 2022-08-25 11:26

From a security perspective, giving your user write access to the
operating system and additional program's source code that will be
used to build the binaries isn't much of a separation from giving your
user write access to the system binaries that will result from its
compilation+install. I'd trust git under root more than I'd trust my
main user account having access to edit the same stuff that the system
is built from. If not trusting git to be a secure enough program to
trust with root privileges, it would be better that it be ran from a
separate dedicated user. If the main user doesn't access things other
than needed to download and apply updates, it shouldn't much matter
but if they do then there are now attack vectors of everything else
they use to consider.

----------------------------------------------------------------------
12Darius21 · 2022-08-25 12:59

This is just yak shaving. The practical difference is minuscule,
there's no point making your life gratuitously harder to fight phantom
threats.

----------------------------------------------------------------------
12Darius21 · 2022-08-25 13:00

Nope, the only thing that uses them is if you build your own world or
kernel.

FreeBSD update might complain they are modified but if you are
building world or source then you aren't using that anyway.