|author||Michał Górny <firstname.lastname@example.org>||2020-01-08 15:08:06 +0100|
|committer||Michał Górny <email@example.com>||2020-01-08 15:08:06 +0100|
|parent||Anti-eblit policy (diff)|
Signed-off-by: Michał Górny <firstname.lastname@example.org>
1 files changed, 55 insertions, 0 deletions
diff --git a/user-group.rst b/user-group.rst
new file mode 100644
@@ -0,0 +1,55 @@
+Users and groups
+.. index:: user
+.. index:: group
+User and group account policy
+:Reported: by repoman and pkgcheck (as deprecated eclass)
+All new user/group accounts must be created via `GLEP 81`_ packages.
+The existing packages should be migrated on the next version bump or
+Existing and historical fixed UIDs/GIDs in range 0..499 (used
+in baselayout or via user.eclass) as listed in uid-gid.txt can be reused
+as-is in acct-* packages.
+UIDs and GIDs in range 0..100 are reserved for important system
+accounts. New assignments in that range need to be explicitly approved
+by the QA lead, in response to a justified request from the developer.
+The range 101..499 is provided for regular use by packages.
+The assignments from this range follow the following rules:
+1. A developer can select an arbitrary free UID/GID from this range.
+ If in doubt, it is recommended to select successive numbers from 499
+2. Unless there is a very good reason not to, matching users and groups
+ should use the same number. It is acceptable to leave gaps
+ in assignments as a result of that.
+3. Before pushing the new acct-* packages, the developer must push
+ an update to uid-gid.txt adding the 'acct' entry for the desired
+ UID/GID. This serves as a synchronization primitive to prevent
+Further UID/GID ranges will be open in the future as the need arises.
+*Rationale*: this is the second version of the policy for GLEP 81
+packages. It simplifies the process to aid rapid adoption of the new
+system. Review requirement and pointless cross-distro syncing were
+removed, in favor of a simple process of allocating the next free number
+and using it.
+The ranges have been chosen to delay the imminent collision between
+explicitly reserved UIDs / GIDs and the ones allocated dynamically by
+user.eclass (starting from 999 downwards). The lowest GID range has
+been reserved for true system users and groups.
+.. _GLEP 81: https://www.gentoo.org/glep/glep-0081.html