Subject: [tryton] Re: Tryton submitted into Fedora

From: Cédric Krier <[email-masked]>
Date: Fri, 28 Nov 2008 22:29:43 +0100

On 28/11/08 21:50 +0100, Dan Horák wrote:
> 
> I am really open to discussion here. From our position as "rpm based"
> distribution it is really bad to allow touching /usr with something that
> is not packaged in rpm. So in real world the system ends with a mix of
> standard rpm packaged modules and some user written (and non-packaged)
> ones. And in my opinion it is appropriate to use /var here, because
> there is no way (?) how to store them on 2 separate places. But when
> Tryton could publish some "best practices" guidelines, how to properly
> deal with user written modules, then moving into /usr is doable. And I
> can add (after some cleanup :-)) my module-to-specfile script to make
> the transition from a module into a rpm almost trivial.
> 

I think the best would be to put standard modules in /usr.And for
specific modules put it in other place with a symlink to /usr

-- 
Cédric Krier

B2CK SPRL
Rue de Rotterdam, 4
4000 Liège
Belgium
Tel: +32 472 54 46 59
Email: [email-masked]
Jabber: [email-masked]
Website: http://www.b2ck.com/

---

From: Hartmut Goebel <[email-masked]>
Date: Fri, 28 Nov 2008 22:16:18 +0100

Dan Horák schrieb:

> ones.

I agree here.

On the other hand I would set a secure, stable system over ease of
customization -- at least for an ERP system. Remember: there are a lot
of implications on an ERP. It *must* *not* be compromised, both for
business reasons and for compliance. And from my point of view RPMs
should aim for security.

If somebody wants to customize, I may put his stuff into /usr/local/...
and symlink it into /usr/.../trytond/modules

I think we can differ between two cases:
a) development: this is where customization is done

> there is no way (?) how to store them on 2 separate places. But when

I suggest filing an enhancement request thatfor :-)

> deal with user written modules, then moving into /usr is doable. And I

And thatfor, too :-)

-- 
Schönen Gruß - Regards
Hartmut Goebel
Dipl.-Informatiker (univ.), CISSP

Goebel Consult
Spezialist für IT-Sicherheit in komplexen Umgebungen
http://www.goebel-consult.de

---

From: Dan Horák <[email-masked]>
Date: Fri, 28 Nov 2008 21:50:40 +0100

Hartmut Goebel píše v Pá 28. 11. 2008 v 20:32 +0100:
> Hi Dan,
> 
> Thanks a lot for bringing tyrton to Fedora. I think this is a big leap
> for the project. :-)
> 
> Dan Horák schrieb:
> 
> > - the "modules" directory is moved to /var/lib/trytond/modules and
> > symlinked back to $python_sitelib, this allows to add own (non-packaged)
> > modules without touching files under /usr/...
> 
> I'm not sure if this is a good idea! Indeed I think this is quite a bad
> idea from the security point of view: /var is meant to be writable. But
> the modules (either standard or self-build) are sensible for the ERP
> system to work correctly. Thus on a production system it would be
> desirable to have them on a reay-only filesystem, this is in /usr or
> /usr/local.
> 

> Beside this: I think there should not be something like "customization"
> in a production environment. Everybody using tryton ERP seriously should
> set up some development and test environment and some staging or release
> process. Thus there is no need for providing "customization"
> capabilities while neglecting security.
> 

Yes, that should be the recommended procedure.

> > The next step will be to develop a SELinux policy, so the security will
> 
> This - on the other hand -- would be great ;-)
> 
> > and openoffice.interact python modules for really full functionality.
> 
> If you need any assistance for this package, please do not hesitate to
> contact me.(I'm the initiator of that project.)
> 

Thanks for the offer.

And if anybody from the authors (core, modules, ...) would like to join
Fedora to (co-)maintain the packages himself, just let me know, because
I can sponsor new members.

		Dan

--~--~---------~--~----~------------~-------~--~----~
[email-masked] mailing list
-~----------~----~----~----~------~----~------~--~---

---

From: Hartmut Goebel <[email-masked]>
Date: Fri, 28 Nov 2008 20:32:45 +0100

Hi Dan,

Goebel Consult

---

From: Dan Horák <[email-masked]>
Date: Fri, 28 Nov 2008 20:11:30 +0100

Hello everybody,

I have just submitted Tryton packages for review in Fedora. You can
track the process at the following URLs:
https://bugzilla.redhat.com/show_bug.cgi?id=473475 - relatorio
https://bugzilla.redhat.com/show_bug.cgi?id=473476 - trytond
https://bugzilla.redhat.com/show_bug.cgi?id=473477 - tryton
and download the rpms from http://fedora.danny.cz/tryton

There is nothing interesting on the client package, but would explain a
bit the server one.
- own user and group (tryton) are created, with /var/lib/trytond as
$HOME
- the "modules" directory is moved to /var/lib/trytond/modules and
symlinked back to $python_sitelib, this allows to add own (non-packaged)
modules without touching files under /usr/...
- pidfile is stored in /var/lib/trytond too
- the data path for attachments moved to /var/lib/trytond/data to not
interfere with the modules
- the /etc/trytond.conf config file is made 0640 for tryton:tryton -
passwords are stored there in plaintext
You see all the details in the spec file :-)

The next step will be to develop a SELinux policy, so the security will
be made as tight as possible. And also to package the missing pywebdav
and openoffice.interact python modules for really full functionality.

After passing the review process in Fedora I will make a branch for
RHEL/CentOS 5 too, so even the enterprise users could enjoy Tryton.

		Dan

-- 
Fedora and Red Hat package maintainer