Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] restricting access to important spells

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Arjan Bouter <abouter AT sourcemage.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] restricting access to important spells
  • Date: Fri, 14 Jul 2006 11:28:40 +0200

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 13 Jul 2006 21:39:48 +0200
Ladislav Hagara <ladislav.hagara AT unob.cz> wrote:

> Howdy my infallible colleagues, :-)
>
> firstly - I am PROUD we have UP-TO-DATE last linux-pam in test grimoire
> and I am very GLAD I could help with it.
> Linux-pam was not updated in test grimoire more then year.

Due to a WIP hanging on selinux stuff, about which I've always said: "do not
enable it"
The same reason I never committed the selinux init script.
The logical thing to do would have been to comment out the selinux part and
remove the WIP.

> BTW, we had in test grimoire (now in stable) version 0.79 and look into
> history who updated it. :-)

No argument there

>
> The main problem was with WIP in devel linux-pam:
> 2005-05-24 David Brown <dmlb2000 AT excite.com>
> The selinux stuff shouldn't be integrated to test yet until we know it will
> work

Interesting isn't it? That's about the time when i took a break from smgl
development due to problems in real life.
I notified the project and grimoire leads that I would be gone for quite a
while.
Also, at that time I was the only one actively trying to get selinux to work.
Waiting for a WIP on a hibernating project doesn't make much sense to me.

>
> Probably all developers were only waiting until we know..., and because
> almost nobody really used devel girmoire (we had stopped providing it to
> our users) all developers were only WAITING.
> BTW, I always was against we stopped providing of devel grimoire. :-)
>
> There is a mail from Arwed from Sat Jun 10 2006 [1] asking us to test
> and integrate linux-pam to test grimoire.
> ... (David Brown, Ladislav Hagara, Sergey Lipnevich, whoever else feels
> like helping) ...
> so I started working on it. It was on Thu Jun 29 2006 [2]. More than 3
> weeks after Arwed asked it. :-(
> I am very sorry I was busy those 3 weeks but whoever could start working
> on it.
>
> Of course I TESTED it and it really WORKED for me [3]. I have NEVER
> submitted change to test grimoire before I really tested it.
> Why if you had problem you did not write about that to sm-commit list?
> How many users had this problem?
> I read NOW for the first time you had some problem.

If you don't have libselinux installed, the only thing you could have noticed
was the gcc34 stuff.
The selinux part is incomplete. period.
Therefore it shouldn't be enabled on anything by default as we've got more
and more users with very heavy 'Y' keys.

>
> Arjan, why did not you discuss it and submitted your changes [4]? You
> really did not write about problems you had.
> BTW, I reply to your commit to sm-commit list [5] and asked several
> questions. Still no answers. :-(

I've been working ~60 hour weeks lately and that has an influence on the
amount of mail I read each day.
Sorry if I missed yours.

> What about for example question/fact:
>
> > +config_query PAM_SECTTY "Install a default /etc/securetty?" n &&
> If user cast linux-pam for the first time with default answer (*n*)
> he/she will not be able to login on console (no /etc/securetty). :-(
>

That's the default config for linux-pam as installed from source by hand.

Along the same line one could argue that /etc/pam.d/other should contain
pam_permit instead of pam_deny because
"it's convenient not having to configure things".

There's a message in FINAL stating that one needs to edit /etc/securetty to
enable root logins.

But if you want to change that question to have a default on 'y' I'm not
stopping you.

>
> And some comments to this topic.
> I am really against of restricting access to test grimoire.
> It is a TEST grimoire. We had only a few active developers and you want
> to ban them from helping Source Mage.

Where did you hear that lie? I'm the last one suggesting to ban people from
helping on Source Mage.
If people would read carefully they would have noticed the words "certain
important spells". The key words being certain and important. I've never
suggested limiting access to everything else in the grimoire.

> Moreover, do you really want ME to stop helping with developing of
> Source Mage? Impossible. :-)

I've looked through the previous emails on this topic and can't find where I
said that.
Quite the opposite is true actually: "I do appericiate the work he does for
SMGL."

>
> Test grimoire should be open for all voluntaries (of course there are
> exceptions if somebody INTENTIONALLY vandalize).
> And we all have to be replaceable. Please NO spells with only acces to
> one SUPERdeveloper.
> People are coming and leaving (SUPERdevelopers too) but the Source Mage
> GNU/Linux will be here forever. :-)

I sure hope so, Source Mage stole my heart and my hard disks a long time ago
and I consider it's devs as friends.

May I suggest we drop this topic before it turns into a finger pointing
contest?
The general feeling amongst the smgl devs seems to be "keep the test grimoire
open to all".
The majority rules, one of the strengths of our distro.

Arjan Bouter

+=======
Source Mage GNU/Linux developer,
http://www.sourcemage.org
Registered as user #310617 with the Linux Counter,
http://counter.li.org.
GnuPG Key 79D4B14E = 94AD 3FD1 E259 67ED 632E 2B06 CFBE 1154 79D4 B14E
+===
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFEt2PIz74RVHnUsU4RAp2KAJ9+3yrQIkWeV6tKojU77ipKd/UcSwCfTUJs
swWan4BMj+KAzSjrNfX8TeA=
=/1Jc
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page