public-mirrors
/
composer
mirror of https://github.com/composer/composer
1
0
Fork 0
Code

Update docs about root usage, refs #11093

pull/11079/merge
Jordi Boggiano 2022-10-13 16:53:33 +02:00
parent bc93f734bc
commit 4faa8c03ce
No known key found for this signature in database
GPG Key ID: 7BBD42C429EC80BC
1 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
doc/faqs/how-to-install-untrusted-packages-safely.md
View File

@ -1,5 +1,21 @@
# How do I install untrusted packages safely? Is it safe to run Composer as superuser or root? # How do I install untrusted packages safely? Is it safe to run Composer as superuser or root?
## Why am I seeing a "Do not run Composer as root/super user" warning/error?
It was always discouraged to run Composer as root for the reasons detailed below.
As of Composer 2.4.2, plugins are disabled automatically when running as root and
there is no sign that the user is consciously doing this. There are two ways this user consent
can be given:
- If you run interactively, Composer will prompt if you are sure that you want to continue
running as root. If non-interactive plugins will be disabled, unless..
- If you set the [COMPOSER_ALLOW_SUPERUSER](../03-cli.md#composer-allow-superuser) environment
variable to `1`, this also indicates that you intended to run Composer as root and are accepting
the risks of doing so.
## Is it safe to run Composer as superuser or root?
Certain Composer commands, including `exec`, `install`, and `update` allow third party code to Certain Composer commands, including `exec`, `install`, and `update` allow third party code to
execute on your system. This is from its "plugins" and "scripts" features. Plugins and scripts have execute on your system. This is from its "plugins" and "scripts" features. Plugins and scripts have
full access to the user account which runs Composer. For this reason, it is strongly advised to full access to the user account which runs Composer. For this reason, it is strongly advised to
@ -21,5 +37,5 @@ to install untrusted dependencies you should sandbox them completely in a contai
Also note that the `exec` command will always run third party code as the user which runs `composer`. Also note that the `exec` command will always run third party code as the user which runs `composer`.
See [Environment variable - COMPOSER_ALLOW_SUPERUSER](../03-cli.md#composer-allow-superuser) See the [COMPOSER_ALLOW_SUPERUSER](../03-cli.md#composer-allow-superuser) environment variable for
for more info on how to disable warning more info on how to disable the warnings.