Security bugs are reported here via bugzilla

[Seth Alan Woolley <seth AT positivism.org>]

I wouldn't be opposed to putting them in all devel so our devs can play 
around with them.  When it hits test though we should put in a notice in 
the grimoire changelog and the ML so people who update get a proper 
heads-up.

If we don't want any included, we should decide that while it's in 
devel/test grimoire so we at least see what the impact is.  I'd want to 
include as much as possible, in my mind.

I presume also you'll make anything that can impact the system default 
to not enabled and promptable to on.

Thanks for all your work on this, Thomas.

Seth

On Tue, Sep 20, 2005 at 05:41:31PM +0200, Thomas HOUSSIN wrote:
> Hi all, 
> 
> You may have heard about the hardened grimoire. The goal of this
> grimoire is to add various security features to Source Mage : for
> example support of Stack Smashing Protector (
> http://www.trl.ibm.com/projects/security/ssp/), full support of
> grsecurity, PaX, etc. See
> http://wiki.sourcemage.org/index.php?page=Hardened+Grimoire for more
> about it.
> 
> I began to work on this a while ago. I didn't change anything in
> perforce for a long time, but installed a test machine (which I didn't
> have anymore) and tested lots of spells (including kde, gnome, etc). I
> didn't notice any major problems ; next step now would be to integrate
> this work in the devel grimoire. This would bring nice new features,
> but also more work and bugs reports, especially at the beginning (and
> especially I guess the non-executable pages feature in PaX), more than
> security team alone can handle. So the question is : do you want
> some/all of these features in devel, and which ones ?
> 
> Thomas
> 
> -- 
> Thomas Houssin
> 
> Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
> Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36 
> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36
> _______________________________________________
> SM-Security mailing list
> SM-Security AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-security
> 

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454  E082 99F0 69DC FDCE E733

Attachment: pgpAmP9AhvJ6r.pgp
Description: PGP signature