[IronPython] Default install location and site-packages

[Dino Viehland]

Michael wrote:
> Dino Viehland wrote:
> > Michael wrote:
> >
> >> Curt Hagenlocher wrote:
> >>
> >>> In principle, allowing unprivileged users to install code into a
> >>> location where it can unknowingly be accessed by privileged users is a
> >>> security problem. A "per-user" approach is the right one.
> >>>
> >> Unknowingly?
> >>
> >
> > I've just installed some software.  Installing that software required that
> > I elevate to admin and left that software in a typically global location
> > on my machine (either C:\... or C:\Program Files\...) where my normal user
> > account does not have writes to access.
> >
> > What's the least surprising - that the global location is now suddenly
> > writable or that the global location remains writable only be
> > administrators?
> >
> 
> Your answer seems orthogonal to the question I asked.
> 
> As you answered my question with a question perhaps I can do the same:
> 
> A user has an installed version of Python and an installed version of
> IronPython. He wishes to install a library for both IronPython and
> Python so he runs:
> 
>     python setup.py install
>     ipy.exe setup.py install
> 
> The first succeeds, naturally. Are you saying that it would be *more*
> surprising if the second succeeded?
> 
> Unfortunately at the moment it fails silently, but an "access denied"
> error would not be much more helpful.

My point is simply that if a user is surprised by the fact that we've created
a globally writable place that effects the code they're running then they have
unknowingly done this.  Or another way to put this is any decision which leads 
to less security shouldn't ever be a surprise to the user.

I'll agree that the difference between CPython and IronPython may be 
surprising to someone who is used to CPython.  But it seems like CPython is
the one who's doing something wrong here.  I just checked on a Linux machine
and there CPython is behaving like we are:

dinov at sh0:/usr/lib/python2.5/site-packages$ ls
apt          aptsources                  python-support.pth
apt_inst.so  debconf.py                  README
apt_pkg.so   python_apt-0.6.17.egg-info  unattended_upgrades-0.1.egg-info
dinov at sh0:/usr/lib/python2.5/site-packages$ cp apt_inst.so xx
cp: cannot create regular file `xx': Permission denied
dinov at sh0:/usr/lib/python2.5/site-packages$