My two questions are: what does habitat do with umasks, and what should it do?
I've been using habitat for all of two weeks now... I'm not really sure what all it can do and what it should do. It's been really awesome for managing system packages. Stuff I just don't want to deal with. "Oh, you need java,
hab pkg install core/jdk8 && hab pkg binlink core/jdk8. job done. (Yea, you have to go manage
JAVA_HOME and it's not in any obvious location but that's a conversation for another time) You can even manage your bootloader with habitat! I'm not suggesting
hab as a replacement for
yum... but I kinda am... (I may have use habitat to install wget the other day)
Since we run in a multi-user environment users need to be able to execute packages installed on the system. What I've run into, when Habitat is installed using the canonical install script and the system has a
umask 027, users can't execute packages because the filesystem tree seems to respect the system umask. I.e. every directory under
chmod 550 (I always have to do the math so:
r-xr-x--- ) therefore users have no access to
If it were yum/an rpm those permissions would be set appropriately... I'm not suggesting that this is the right answer of course. Perhaps the answer is that everyone who wants to use hab packages should be in the
hab group? That wouldn't resolve the issue in #4625 which as @eeyun points out in a previous post
The solution to 4625 appears to be to fix the node scaffold. That seems to be the current behavior, but I'm not so sure I'm sold that that is the correct behavior in all situations.
For instance, I don't think that it's up to the package maintainer to manage the permissions of
/hab/svc. If the habitat supervisor is running, I think I should be able to start multiple processes as different users. The default seems to be run everything as
hab but why can't I set that at runtime? Say I want to run my webserver as
webserver and my web process as
rackserver and my database as
dbserver, I probably don't want all those users running in the same group.
It's kinda like "containers without containers"...
Anyway, that's my 2¢, I'm not sure if I'm even using Habitat right, but it seems to work well so far!