Re: Games Team policy on games being setgid

On Tue, 30 Dec 2025 at 08:18:37 +0100, Alexandre Detiste wrote:
>Are old high score tables as valuables as a ... PostgreSQL database ?

No, but that doesn't mean we shouldn't keep them intact if it's 
straightforward to do so.

And this isn't just high-score tables: I think some of the roguelike 
genre (angband, nethack and friends) store the entire saved state of 
games in progress below /var/games, and our users are likely to be 
rather grumpy about losing a game in progress when they upgrade from 
stable to new-stable.

These games are the reason I didn't simply suggest forbidding setgid: I 
suspect that for some of them, we'll need to leave the game (or a 
wrapper) setgid in Debian 14 'forky', so that it can copy saved games in 
progress to the user's home directory on startup, so that they can still 
be played after we finally remove setgid (presumably in Debian 15 
'duke'). (I think it's OK to lose a game-in-progress if the player didn't 
resume it for an entire release cycle.)

I started to use src:hannah (Help Hannah's Horse, a Pacman clone) as an 
example, but there are several barriers to that:

- it isn't actually Games Team maintained, but instead NMU'd by
   Alexandre (if someone is interested in maintaining this game, we should
   ask Marga if she's willing to hand it over to the Games Team - she'll
   probably say yes since she hasn't touched it since 2008)

- the setgid doesn't actually do anything useful, because the patch to
   make the game write to /var/games/hannah/ hasn't been applied since
   trixie

- even if the patch was applied, it still wouldn't work as intended,
   because nothing creates /var/games/hannah/ with suitable permissions,
   so the game can't write there even with setgid

So for this specific game, instead I'm looking at providing patches to 
make it fully unprivileged.

>I mean,
>what should happen on upgrade : leaving the inert binary blob there or simply
>delete it ?

We can leave it there (hopefully it's small), and delete it after 
migration or on purge. Maintainer scripts can delete files, so there's 
no need to remain setgid just for that.

     smcv