<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello Hi,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I think you're overthinking it.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">At any given time, the BDS conformance of any process, whatever its role, should be
evaluated in terms of *its own* environment. Even if that didn't make abundant sense, there really isn't any other viable alternative for a specification relying so fundamentally on environment variables.</span></div>
<div class="elementToProof"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<div class="elementToProof"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">System services are no exception. Consider that even if a service could determine the
value of, say, the XDG_CACHE_HOME variable of a client process, chances are poor that the service could access the designated directory even if it wanted to do. And it would be an enormous security vulnerability if it could and did.</span></div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Bear in mind also that even different processes running strictly by, as, and for a particular user don't have to have the same values for their BDS-relevant environment variables. In this sense too, BDS is inescapably a per-process specification.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
John Bollinger</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend" class="elementToProof"><span style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></div>
<hr style="display: inline-block; width: 98%;">
<div dir="ltr" id="divRplyFwdMsg"><span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> xdg <xdg-bounces@lists.freedesktop.org> on behalf of 90 <hi@90.gripe><br>
<b>Sent:</b> Monday, March 11, 2024 1:16 PM<br>
<b>To:</b> xdg@lists.freedesktop.org <xdg@lists.freedesktop.org><br>
<b>Subject:</b> Inquiry regarding XDG Base Directory Specification and daemon processes running as root (2nd Attempt)</span>
<div> </div>
</div>
<div><span style="font-size: 11pt;">[You don't often get email from hi@90.gripe. Learn why this is important at
<a href="https://aka.ms/LearnAboutSenderIdentification" id="OWA9f42dcf2-3845-26a0-ec25-0f13ff58d999" class="OWAAutoLink" data-auth="NotApplicable" data-loopstyle="linkonly">
https://aka.ms/LearnAboutSenderIdentification</a> ]<br>
<br>
Caution: External Sender. Do not open unless you know the content is safe.<br>
<br>
<br>
Seeing as last month's inquiry from me went unanswered - probably not helped by the fact that I accidentally sent it to the mailing list twice at that moment - I would like to make another attempt at asking it. Advice on how to go about such implementations
for XDGBDS compliance in this case would be greatly appreciated. Quoted below:<br>
<br>
> In recent times, I've gotten quite heavily interested and invested into the XDGBDS and compliance with it across various pieces of software, and have even gone around to a couple of project to either propose compromises for adoption — for projects which have
refused in the past to adopt it - or outright contribute it myself via patches and the like. However, a problem has come up with this endeavour which I would like to ask for some insight on.<br>
><br>
> As you may know, some programs on Unix-like operating systems consist of both a client component typically run by the current user and a server component, typically a daemon, which may or may not be invoked by a different user such as 'root'. In those cases,
it usually isn't possible for this other user to determine environment variables set by the user for which BDS compliance is desired. One could, in theory, scan through the entire process tree and look for the highest-level processes being run by the compliant
user before reading the environment of those processes and checking for the relevant XDG_ variables, but I imagine that this would be rather fickle and error-prone. Hence, I wondered if anyone had some other idea in mind as to how full compliance may be achieved
for such server software involving daemons. How might one go about this in a reasonable manner?<br>
<br>
Kind regards.</span></div>
<br>
<hr>
<font face="Arial" color="Gray" size="2"><br>
Email Disclaimer: www.stjude.org/emaildisclaimer<br>
Consultation Disclaimer: www.stjude.org/consultationdisclaimer<br>
</font>
</body>
</html>