Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] restricting access to important spells

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Arjan Bouter <abouter AT sourcemage.org>
  • To: Jeremy Blosser <jblosser-smgl AT firinn.org>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] restricting access to important spells
  • Date: Thu, 13 Jul 2006 17:45:47 +0200

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 13 Jul 2006 10:19:39 -0500
Jeremy Blosser <jblosser-smgl AT firinn.org> wrote:

<snip>
> >
> > 15:04 < abouter> * DETAILS,BUILD: removed unneeded gcc34
> > invokation
> > 15:04 < abouter> * POST_INSTALL: renamed to FINAL
> > 15:04 < abouter> * CONFIGURE,INSTALL: fixed securetty install and
> > made
> > it optional
> > 15:04 < abouter> * INSTALL: removed forced (ever adding!)
> > installation
> > of selinux rule
> > 15:04 < abouter> * PRE_BUILD: removed unneeded patches
> > 15:04 < abouter> * pam-selinux.patch: removed
> > of his edit
> >
> > check your logs again, it was discussed but we moved to conversation to
> > #sourcemage-dump after me dumping a few lines from linux-pam's HISTORY
>
> Sorry, I don't monitor -dump unless I need to be in there for something.
>

point taken, will try to keep such things in the normal channel

> > As you can see we did look up who broke pam, and do know what went wrong:
> > - the update was never tested
> > - the patch for selinux wasn't for the new version
> > - the forced adding of selinux rules broke login and would add to
> > /etc/pam.d/login on each cast of linux-pam
> > - the update enabled root logins on all tty's, regardless of what the SA
> > wanted
>
> Several of those are the exact opposite of what the HISTORY logged...?

The paste from HISTORY is what I spend 2 hours on fixing, it really was that
badly broken. All of it except the selinux stuff should have been obvious on
the 1st cast of the spell.

<snip>

> > What I was suggesting isn't to raise the bar for new devs, but to make
> > sure the SA can at least boot and log into his own box. Which I think
> > isn't too much to ask for, even in the test grimoire.
>
> Test is expected to break, and break horribly from time to time. But
> people are REQUIRED to test their changes before putting them in test. If
> they don't do this they don't keep access.
>

I was under the impression that test was a buffer to make sure stable works.
I do expect a certain amount of spells to break every now and then. But as
Mathieu pointed out in his reply, the spells that a dev knows can break a box
horribly are usually left alone by people who aren't too comfortable with
these spells. Just common sense IMHO.

I for one wouldn't think of messing with stuff like gcc, and I've done some
serious reading before I even thought about touching stuff like PAM. Even in
the test grimoire.

Treating spells for essential stuff the same as spells for games is asking
for trouble. If nethack breaks it's annoying, if something like coreutils
breaks it's game over for the box.

Arjan Bouter

+=======
Source Mage GNU/Linux developer,
http://www.sourcemage.org
Registered as user #310617 with the Linux Counter,
http://counter.li.org.
GnuPG Key 79D4B14E = 94AD 3FD1 E259 67ED 632E 2B06 CFBE 1154 79D4 B14E
+===
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFEtmqrz74RVHnUsU4RAukeAJ0d8WD0X0l5LbrjNi7iYNb19NRLZACfQBy/
c1yUeKD3upMM6vqbrk4dweQ=
=zaCG
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page