Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] restricting access to important spells

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Arjan Bouter <abouter AT sourcemage.org>
  • To: Jeremy Blosser <jblosser-smgl AT firinn.org>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] restricting access to important spells
  • Date: Thu, 13 Jul 2006 17:01:40 +0200

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 13 Jul 2006 09:27:50 -0500
Jeremy Blosser <jblosser-smgl AT firinn.org> wrote:

<snip>

>
> What Seth said, with the addition that I'm looking at the IRC log of this
> conversation and I don't even see that you guys have a solid idea of spell
> changes that caused your problems.
>

This is a dump of the conversation on IRC, with unrelated stuff cut out:

15:04 < abouter> * DETAILS,BUILD: removed unneeded gcc34 invokation
15:04 < abouter> * POST_INSTALL: renamed to FINAL
15:04 < abouter> * CONFIGURE,INSTALL: fixed securetty install and
made
it optional
15:04 < abouter> * INSTALL: removed forced (ever adding!)
installation
of selinux rule
15:04 < abouter> * PRE_BUILD: removed unneeded patches
15:04 < abouter> * pam-selinux.patch: removed
15:04 < abouter> that's what needed fixing after the previous update
15:04 < dkowis> so he didn't test it
15:04 < dkowis> at all
15:04 < dkowis> ?
15:05 < abouter> that's my guess
15:05 < dkowis> you're going to have to talk to the person doing the commit
15:05 < abouter> which is fine for wesnoth, but not pam
15:05 < dkowis> and ask him if it was tested
<snip>
15:06 < abouter> took me 2 hours to fix the mess (using init=/bin/bash)
15:07 < dkowis> I agree
15:07 < dkowis> technically, abouter, you should've been running linux-pam
from
stable
15:07 < dkowis> something that critical should be run from something we know
works
<snip>
15:08 < abouter> dkowis: what if i _was_ running pam from stable, by the time
i
noticed the bugs, it would be in the stable tarball...
<snip>
15:08 < dkowis> I have no desire to remove access to people
15:09 < dkowis> I think that would be counter- productive
15:09 < dkowis> access from
15:09 < abouter> if it can be avoided, neither do i
15:09 < dkowis> so have you volunteered to be the "maintainer" of linux-pam?
15:10 < dkowis> ensure that the modifications to it are goldeen?
15:10 < dkowis> at least for the short term
15:10 < dkowis> until something can be done to facilitate this
15:11 < lejatorn> dkowis: I bet it could have made it to stable if abouter
didn't find, because as you pointed at, we ARE so few ppl.
15:11 < dkowis> yes
15:12 < abouter> dkowis: sure i'll volunteer to maintain pam
15:12 < dkowis> kay
15:12 < abouter> if that's what it takes
15:12 < dkowis> it is going to take stuff like that
15:12 < dkowis> at least for now
15:12 < dkowis> until some other process is determined
15:13 < dkowis> some "critical spells" process
15:13 < sqweek> either way , Ladislav should be made aware of the
consequences
of his edit

check your logs again, it was discussed but we moved to conversation to
#sourcemage-dump after me dumping a few lines from linux-pam's HISTORY

As you can see we did look up who broke pam, and do know what went wrong:
- - the update was never tested
- - the patch for selinux wasn't for the new version
- - the forced adding of selinux rules broke login and would add to
/etc/pam.d/login on each cast of linux-pam
- - the update enabled root logins on all tty's, regardless of what the SA
wanted

As you can see I'll volunteer to maintain the linux-pam spell if that's what
it takes to avoid it breaking again.
The reason I didn't contact Ladislav about it is that i didn't want to chew
his head off for breaking the spell as I do appericiate the work he does for
SMGL.

What I was suggesting isn't to raise the bar for new devs, but to make sure
the SA can at least boot and log into his own box. Which I think isn't too
much to ask for, even in the test grimoire.

Arjan Bouter

+=======
Source Mage GNU/Linux developer,
http://www.sourcemage.org
Registered as user #310617 with the Linux Counter,
http://counter.li.org.
GnuPG Key 79D4B14E = 94AD 3FD1 E259 67ED 632E 2B06 CFBE 1154 79D4 B14E
+===
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFEtmBUz74RVHnUsU4RAiOvAKCAPGmKcr8Cpe4BLmShEaqJ5fefWwCeLaqV
mmccCFqHF0L8gO7S4K1gkqw=
=wQ78
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page