1

We have a requirement to create yum .repo file dynamically on the go and use it. But don't have root/sudo to create it in /etc/yum.repos.d. (requirement is to get the url of rpm using yumdownloader utility and not installing it on machine) So is it possible to create repo file other than the default location (/etc/yum.repos.d) and make yum to load file from also the new location ?

1
  • Please note that this has severe security implications, namely privilege escalation. The user being able to modify a repo (or other yum config item) can install and run any code. Thereby the user can easily gain root rights (and so can any process run by the user, e.g. her web browser).
    – Ned64
    Feb 15, 2018 at 16:15

2 Answers 2

Reset to default
1

Sure. Basically I copied the main yum.conf and appended a repository configuration onto that in my home directory

$ cd
$ cat yum.conf
[main]
cachedir=/home/jhqdoe/var/cache/yum/$basearch/$releasever
keepcache=1
debuglevel=2
logfile=/home/jhqdoe/var/log/yum.log
exactarch=1
obsoletes=1
gpgcheck=1
plugins=1
installonly_limit=5

[blah]
name=Extra Packages for Centos 7 - $basearch
baseurl=http://blah.example.edu/packages/epel-7-$basearch/
enabled=1

And then there's a --config option to yum that yumdownloader inherits.

$ rm zsh-5.4.2-1.el7.centos.src.rpm
$ yumdownloader --config=$HOME/yum.conf --source zsh
Complementos cargados:auto-update-debuginfo, fastestmirror, langpacks
...
$ ls zsh-5.4.2-1.el7.centos.src.rpm
zsh-5.4.2-1.el7.centos.src.rpm
$

(yum may still peek at the global config, I deleted the global repository while testing this to hide that "duplicate repo" message.)

4
  • ... or you could ln -s /home/jhqdoe/yum.conf /etc.
    – Ned64
    Feb 15, 2018 at 16:12
  • yum checks signatures of packages to install, so in order to have a user install any file from her own repo her key needs to be trusted, or gpg checks disabled, for that repo (which is a security risk!).
    – Ned64
    Feb 15, 2018 at 16:17
  • Thanks @thrig, it is working fine as expected. As said earlier we are not installing anything, just need to get the URL of the rpm thats it. Which is just working fine using this trick.
    – Reddysekhar Gaduputi
    Feb 16, 2018 at 4:56
  • This is turning out to be quite useful for my use case, which involves querying metadata available in an internal dev only repo and download all RPMs. I am using repoquery --config=yum.conf --disablerepo=* --enablerepo=blah -a --pkgnarrow=available --qf "%{name} | xargs yumdownloader --urls --config=etc/yum.conf --disablerepo=* --enablerepo=blah to get the download URLs for all available packages.
    – haridsv
    Mar 5, 2019 at 12:24
0

Since you cannot get root, there seem to be no point in teaching yum other repo config locations. Even if you succeed, yum would have to be started as root to install anything.

1
  • Well, not if you run yum by cron (see the yum-cron package) or other means. The security implications remain, though.
    – Ned64
    Feb 15, 2018 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .