etc/group - current time (not to be confused with --Current) - What is good practice/recommended?

chrisretusn · 03-22-2023, 10:55 PM

Quote:

Originally Posted by metaed

Except wheel, yes?

Oops, missed that.

Fixed it.

chrisretusn · 03-22-2023, 10:57 PM

Quote:

Originally Posted by Jeebizz

Is lp for printing? I am not part of that, and I can print just fine, same with scanner - I just have a printer and non of thew crap multifunction printer/scanner devices, but I am not part of scanner and I can print still (hplip)...

I think the group lp was used back in the day when we used lp to print; which is still usable today in Slackware.

henca · 03-23-2023, 02:11 AM

Quote:

Originally Posted by brianL

And I will learn how to use vi/vim (I've been saying that for years).

The most important (and not completely intuitive) thing to know about vi is the key kombination:

Code:

<ESC> : q !

That is press escape, ":", "q" and "!" to exit vi after you accidently started vi.

From the ABCs of unix at http://www.linux-databook.info/?page_id=4315

Code:

V is for vi, which is hard to abort.

regards Henrik

zeebra · 03-23-2023, 03:24 AM

Quote:

Originally Posted by henca

The sddm process (as any login manager like xdm, gdm, kdm) should be run as root because only root is able to become other users. When you log in with sddm you want to become your own normal user.

However, all normal users should be able to login with a login manager without having to be member of a group.

regards Henrik

That leaves the question: what is the sddm group for then?

zeebra · 03-23-2023, 03:26 AM

Quote:

Originally Posted by chrisretusn

I think the group lp was used back in the day when we used lp to print; which is still usable today in Slackware.

Not only in Slackware, but other distroes. Lp is for printing lpadm is for printer administration. Probably standard CUPS stuff.

Petri Kaukasoina · 03-23-2023, 04:45 AM

Quote:

Originally Posted by henca

The sddm process (as any login manager like xdm, gdm, kdm) should be run as root because only root is able to become other users.

Quote:

Originally Posted by zeebra

That leaves the question: what is the sddm group for then?

Privilege separation. /usr/bin/sddm.bin runs as root. It starts several processes which don't need root privileges and they run as user sddm, group sddm.

There are others. Like ntpd running as ntp.ntp, polkitd running as polkitd.polkitd, atd running as daemon.daemon.

Petri Kaukasoina · 03-23-2023, 05:06 AM

Quote:

Originally Posted by zeebra

Lp is for printing lpadm is for printer administration. Probably standard CUPS stuff.

A couple of lines in /etc/cups/cups-files.conf:

Code:

# Default user and group for filters/backends/helper programs; this cannot be
# any user or group that resolves to ID 0 for security reasons...
#User lp
#Group lp

# Administrator user group, used to match @SYSTEM in cupsd.conf policy rules...
# This cannot contain the Group value for security reasons...
SystemGroup sys root wheel


# User that is substituted for unauthenticated (remote) root accesses...
#RemoteRoot remroot

So, cups runs as root, but runs filters without root privileges as user lp, group lp. Groups sys, root, wheel work for administrative tasks.

brianL · 03-23-2023, 05:17 AM

Quote:

Originally Posted by henca

The most important (and not completely intuitive) thing to know about vi is the key kombination:

Code:

<ESC> : q !

That is press escape, ":", "q" and "!" to exit vi after you accidently started vi.

From the ABCs of unix at http://www.linux-databook.info/?page_id=4315

Code:

V is for vi, which is hard to abort.

regards Henrik

But ed is worse.

Might try using ed for a month, then vi will seem like heaven.

GazL · 03-23-2023, 05:43 AM

Quote:

Originally Posted by Jeebizz

I haven't used a webcam in a while - (how does this apply to integrated webcams on a notebook though?), but if thats the main purpose and doesn't imply I need it for DRI for my GPU, I guess I can remove myself from that too.

I've always found it odd that access to V4L2 devices like webcams have been conflated with the other devices in the 'video' group, such as graphics card/dri/framebuffer devices. It feels like a mistake to me, but I've never been bothered enough to modify it.

GazL · 03-23-2023, 05:54 AM

Quote:

Originally Posted by Petri Kaukasoina

Privilege separation. /usr/bin/sddm.bin runs as root. It starts several processes which don't need root privileges and they run as user sddm, group sddm.

There are others. Like ntpd running as ntp.ntp, polkitd running as polkitd.polkitd, atd running as daemon.daemon.

On OpenBSD they started prefixing users/groups intended purely for privilege separation with an underscore to make it clear that they were system groups/users and not intended for use by real users. I won't suggest we do it here as it would be too visible/high impact a change for Slackware, but IMO it was a smart move.

allend · 03-23-2023, 08:06 AM

I have run this command on my daily driver to look at how groups affect access to various files.

Code:

find / \( -path /proc -o -path /run -o -path /sys \) -prune -o \( -group lp -o -group floppy -o -group audio -o -group video -o -group cdrom -o -group input -o -group plugdev -o -group power -o -group netdev -o -group scanner \) -exec stat -c "%G %n" {} \; | sort > /tmp/grouplist.txt

My conclusion is:
audio is required for files in /dev/sound
cdrom is required for /dev/sr0
floppy is not required (I do not have one in this PC)
input gives access to files under /dev/input (I defer to Petri Kaukasoina)
lp is required for a lot of printing stuff {I have a proprietary printer driver installed)
netdev is required for /dev/rfkill
plugdev is required (I use USB devices)
scanner is needed for sane to set a lock in /var/lock/sane
video gives access to files in /dev

Jeebizz · 03-23-2023, 09:38 AM

Quote:

Originally Posted by GazL

I've always found it odd that access to V4L2 devices like webcams have been conflated with the other devices in the 'video' group, such as graphics card/dri/framebuffer devices. It feels like a mistake to me, but I've never been bothered enough to modify it.

So then its NOT for video devices, other than just GPU ?

GazL · 03-23-2023, 12:02 PM

If you look at it logically, video capture devices have little to do with the gpu/framebuffer devices. It makes more sense to put them each in their own group, but for whatever reason they all get lumped into 'video'.

Jeebizz · 03-23-2023, 12:10 PM

Quote:

Originally Posted by GazL

If you look at it logically, video capture devices have little to do with the gpu/framebuffer devices. It makes more sense to put them each in their own group, but for whatever reason they all get lumped into 'video'.

Alright, but does one even need to be part of video for having an X11 or wayland session with direct rendering these days? Someone stated you need this for GPU passthrough, but thats too advanced for me - although I do run VMs, but I haven't the need for GPU passthrough anyways.