(original idea courtesy of bentley@)

Okay, so we should probably be running @tags as an under-privileged user.

There's a chicken-and-egg issue, namely, that the tag-generated files usually
belong to root.

They ARE the ugly duckling, and they've been a plague, since forever
(for pkg_check, and for semarie's work: they are the files that are unaccounted
for).

Enter:

@extraglob

it's an annotation I added ages ago to handle these.

Simply put: we got ~200 @exec/@unexec left in the ports tree
a lot of these (most of the @unexec) are removing those files that got
generated somehow.

The idea was always to NOT use @unexec, but have a higher level primitive
to remove them.

Enter @extraglob
----------------

basically: stuff like @extraglob /var/tomcat/conf/
will remove the tomcat dir with everything inside it

or stuff like
@extraglob /var/db/gconf/gconf.xml.defaults/


Enter ownership
---------------
The idea is to be able  to annotate @extraglob, @tag, @exec*, @unexec*
with owner=... group=... annotations (optional and prepended)

For any keyword that runs anything, that keyword would be run as the
user/group indicated (note that by this point, all @owner/@group
annotations have been handled, so the users do exist)
AND for @extraglob stuff, the ownership would have been adjusted

so say you have a tag that generates 
@extraglob somefile.tag

with those annotations, on installation/update, the tag is given the
right ownership, and when @tag  * at-end  triggers, the command is
run with the right owner -> correct privsep.

Plan for deployment:
- @extraglob is already recognized and won't cause any issue
- pkg_add changes first, so that rm -> extraglob can happen later in packages
- extraglob in packages... if the tools are not there yet, you may end with
remnant files on your installation after deleting stuff
- ownership for remaining tags/exec/unexec/extraglobs

- assessing the few @exec/@unexec that remain.

I've been scolded by various people for not discussing my plans in enough
details. I hope this is enough for you. If not, PLEASE FUCKING ASK QUESTIONS!!!