Why won't pkg download as unprivileged user?

[loveydovey]

As you know, apt hands downloads to _apt unprivileged user. Pkg on FreeBSD downloads everything as root - not very security-oriented.

Is there a good reason for this to be so?

 

[loveydovey]

You CAN do this manually by:

pkg update

# as regular user: fetch all pending upgrades (and new dependencies)
pkg fetch -u -d -U -y -o ~/pkgs

# as root: upgrade
pkg add -f ~/pkgs/..../*.pkg

I think it deserves to be this way with pkg by default.

 

[DanielBowman]

You CAN do this manually by:

pkg update

# as regular user: fetch all pending upgrades (and new dependencies)
pkg fetch -u -d -U -y -o ~/pkgs

# as root: upgrade
PKG_CACHEDIR=/home/you/pkgs pkg upgrade

I think it deserves to be this way with pkg by default.

Not sure I want some peasant account to touch my packages...which I then install.
Chain of custody issue, I guess.

 

[MG]

Because it needs to put files in system directories that need root for write access? Never heard of apt, btw.

 

[cracauer@]

The pure download is relatively harmless. Now, decompression could always use some restricted process.

 

[monwarez]

As you know, apt hands downloads to _apt unprivileged user. Pkg on FreeBSD downloads everything as root - not very security-oriented.

Is there a good reason for this to be so?

Are you sure that it didn't drop all privilege at some point ? There is some support for capsicum on pkg, so one would need to properly audit the code to know for sure if the fetch call isn't capsicumized.