On Sat, Apr 25, 2009 at 10:31 AM, Allan McRae wrote:

Pierre Schmitz wrote:

...

Am Samstag, 25. April 2009 16:29:03 schrieb Giovanni Scafora:

...

ln -s /srv/http/cgi-bin/htsearch ${pkgdir}/usr/bin || return 1

I thnik it should be the other way round. Imho no package should install anything into /srv.

What do you guys think about this?

FHS says:

/srv contains site-specific data which is served by this system.

This main purpose of specifying this is so that users may find the location of the data files for particular service, and so that services which require a single tree for readonly data, writable data and scripts (such as cgi scripts) can be reasonably placed. Data that is only of interest to a specific user should go in that users' home directory. ...

So a cgi script seems fine...  I would tend to agree that /srv should be installed into by a package.  But I don't deal with the type of package which may want to use /srv so my opinion should be down-weighted accordingly.

Installing into /srv/ is no different than installing into /home/, IMO. It might be worse as it presents a relatively big security risk for those that do run public facing services, and suddenly a new script has been made available for web site users to run. -Dan

2009/4/25, Dan McGee :

Installing into /srv/ is no different than installing into /home/, IMO. It might be worse as it presents a relatively big security risk for those that do run public facing services, and suddenly a new script has been made available for web site users to run.

Then, as you said, we should remove that symbolic link and the file /srv/http/cgi-bin/qtest installed by default? -- Arch Linux Developer (voidnull) AUR & Pacman Italian Translations Microdia Developer http://www.archlinux.it

On 25/04/2009, Dan McGee wrote:

I would just say/think that files in /srv/ should be managed by the system admin and not pacman- anything they want in there should be linked by the sysadmin from /usr/bin/ or elsewhere, rather than the other way around. You are right. so voidnull is fixing this soon, because I'm not in my home.

-- Andrea `BaSh` Scarpino Arch Linux Developer

Am Samstag, 25. April 2009 17:36:19 schrieb Dan McGee:

Installing into srv is no different than installing into /home/, IMO. It might be worse as it presents a relatively big security risk for those that do run public facing services, and suddenly a new script has been made available for web site users to run.

If we agree to this we should add such a rule to namcap. -- Pierre Schmitz Clemens-August-Straße 76 53115 Bonn Telefon 0228 9716608 Mobil 0160 95269831 Jabber pierre@jabber.archlinux.de WWW http://www.archlinux.de

Am Samstag, 25. April 2009 19:36:12 schrieb Thomas Bächler:

IMO, /srv/http is only for apache anyway (other servers use /srv/lighttpd or so, right?).

No, /srv/http is the home of the http user; so lighttpd uses this dir by default, too.

Also phpmyadmin installs into /srv/http. IMO, it should rather install into /usr/share and then provide config files for apache, lighttpd and other common servers that configure the right Directory and Alias directives. Similar things could also be done for all many other similar packages.

That was my intention. -- Pierre Schmitz Clemens-August-Straße 76 53115 Bonn Telefon 0228 9716608 Mobil 0160 95269831 Jabber pierre@jabber.archlinux.de WWW http://www.archlinux.de