From ecb32bf457ed27b75c9b4386ca1acfbd4b63869e Mon Sep 17 00:00:00 2001 From: Eli Schwartz Date: Tue, 7 Feb 2023 21:24:55 -0500 Subject: minstall: drop privileges before running rebuild_all If the user runs `sudo meson install` this may run ninja to build everything that gets installed. This naturally happens as root also, by default, which is bad. Instead, detect root elevation tools and drop the uid/gid of the child ninja process back to the original invoking user before doing anything. --- docs/markdown/snippets/meson_install_drop_privs.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 docs/markdown/snippets/meson_install_drop_privs.md (limited to 'docs/markdown/snippets') diff --git a/docs/markdown/snippets/meson_install_drop_privs.md b/docs/markdown/snippets/meson_install_drop_privs.md new file mode 100644 index 0000000..e08dfc0 --- /dev/null +++ b/docs/markdown/snippets/meson_install_drop_privs.md @@ -0,0 +1,16 @@ +## `sudo meson install` now drops privileges when rebuilding targets + +It is common to install projects using sudo, which should not affect build +outputs but simply install the results. Unfortunately, since the ninja backend +updates a state file when run, it's not safe to run ninja as root at all. + +It has always been possible to carefully build with: + +``` +ninja && sudo meson install --no-rebuild +``` + +Meson now tries to be extra safe as a general solution. `sudo meson install` +will attempt to rebuild, but has learned to run `ninja` as the original +(pre-sudo or pre-doas) user, ensuring that build outputs are generated/compiled +as non-root. -- cgit v1.1