Skip to Content.
Sympa Menu

sm-commit - Re: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (1606c4cfd3e311e841fa816a61aeb5cc42351879)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: Re: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (1606c4cfd3e311e841fa816a61aeb5cc42351879)
  • Date: Tue, 15 Jan 2008 21:32:28 -0800

On Tuesday 15 January 2008 08:29:08 Ladislav Hagara wrote:
> It depends.
> Looking into DETAILS of linux, there is none SECURITY_PATCH.
> Looking into ChangeLogs of 2.6.23 linux kernel, there is a CVE mentioned
> also in:
> 2.6.23.10 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.10
> 2.6.23.8 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.8
> 2.6.23.7 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.7
>
> Look at www interface to linux 2.6.23 git, additional CVEs:
> http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fstable%2Flinux-2.6.23.y.git
>&a=search&h=HEAD&st=commit&s=CVE
>
> The problem / the advantage of our linux spell is that users can choose
> both their own version of linux kernel and their own patches. I do not
> know if this CVE is also a problem of 2.6.22 or 2.6.24-rc kernels. If we
> had DEFAULT linux kernel "LATEST_maintenance_patches" we should
> certainly use SECURITY_PATCH in DETAILS of linux. Of course if the
> security problem was only in rc kernel, the SECURITY_PATCH could cause
> to recompile also stable linux kernel. We should probably need
> SECURITY_PATCH in "latest.defaults" (file of linux spell):
> LATEST_maintenance_patches=patch-2.6.23.14:SECURITY_PATCH=2
> LATEST_PRE_2_6=patch-2.6.24-rc7:SECURITY_PATCH=6
>
> I suggested several times that we should integrate changes of linux
> spell in test grimoire immediately into stable grimoire. Now we have
> 2.6.23.14 in test and 2.6.23.9 in stable (CVE also in 2.6.23.10).

I would also like the kernel package up-to-date in stable, especially for
security releases. Always feel free to request an integration, though most
likely only security updates to the kernel will be approved for stable
integration.

If someone wants to modify the linux package to support SECURITY_PATCH
defined
per kernel release (e.g. 2.6.23 has SECURITY_PATCH incremented, but it won't
affect someone on 2.6.24-rc or 2.6.22). Of course, there would be a whole
mess of what kernel versions a CVE applies to, so it may be near impossible
to implement this effectively.

-sandalle

--
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61 | http://www.sourcemage.org/
http://eric.sandall.us/ | http://counter.li.org/ #196285

Attachment: signature.asc
Description: This is a digitally signed message part.




Archive powered by MHonArc 2.6.24.

Top of Page