Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] restricting access to important spells

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Jeremy Blosser <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] restricting access to important spells
  • Date: Thu, 13 Jul 2006 10:19:39 -0500

On Jul 13, Arjan Bouter [abouter AT sourcemage.org] wrote:
> On Thu, 13 Jul 2006 09:27:50 -0500
> Jeremy Blosser <jblosser-smgl AT firinn.org> wrote:
>
> <snip>
>
> >
> > What Seth said, with the addition that I'm looking at the IRC log of this
> > conversation and I don't even see that you guys have a solid idea of spell
> > changes that caused your problems.
> >
>
> This is a dump of the conversation on IRC, with unrelated stuff cut out:
>
> 15:04 < abouter> * DETAILS,BUILD: removed unneeded gcc34 invokation
> 15:04 < abouter> * POST_INSTALL: renamed to FINAL
> 15:04 < abouter> * CONFIGURE,INSTALL: fixed securetty install and
> made
> it optional
> 15:04 < abouter> * INSTALL: removed forced (ever adding!)
> installation
> of selinux rule
> 15:04 < abouter> * PRE_BUILD: removed unneeded patches
> 15:04 < abouter> * pam-selinux.patch: removed
> of his edit
>
> check your logs again, it was discussed but we moved to conversation to
> #sourcemage-dump after me dumping a few lines from linux-pam's HISTORY

Sorry, I don't monitor -dump unless I need to be in there for something.

> As you can see we did look up who broke pam, and do know what went wrong:
> - the update was never tested
> - the patch for selinux wasn't for the new version
> - the forced adding of selinux rules broke login and would add to
> /etc/pam.d/login on each cast of linux-pam
> - the update enabled root logins on all tty's, regardless of what the SA
> wanted

Several of those are the exact opposite of what the HISTORY logged...?

> As you can see I'll volunteer to maintain the linux-pam spell if that's
> what it takes to avoid it breaking again.
> The reason I didn't contact Ladislav about it is that i didn't want to
> chew his head off for breaking the spell as I do appericiate the work he
> does for SMGL.

If someone truly committed something to test without testing it themselves
(which I'm not sure we know for sure) then they're violating the ONE thing
we require of people that commit to test. If they make a habit of
violating this then they should lose their test commit access, period. I
don't care who they are. I don't care if they're me.

Still, IMO if we think a commit was troublesome it needs to be discussed
openly so it can be fixed. I don't see how suggesting we limit most
developers from touching something is a better or "more polite" solution
than saying "This change broke my stuff, was it tested?".

> What I was suggesting isn't to raise the bar for new devs, but to make
> sure the SA can at least boot and log into his own box. Which I think
> isn't too much to ask for, even in the test grimoire.

Test is expected to break, and break horribly from time to time. But
people are REQUIRED to test their changes before putting them in test. If
they don't do this they don't keep access.

Attachment: pgpgyFdwMd0Up.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page